A security assessment found a vulnerability in a legacy system that cannot be patched because the vendor no longer provides support. The system is critical to business operations. What is the MOST appropriate action?

Ignore the vulnerability because the system is legacy and will be replaced soon.

Disconnect the system from the network immediately to eliminate the risk.

Document the risk and request a formal exception with compensating controls.

Attempt to patch the system using an unsupported workaround.

Which element is essential for tracking an approved security exception?

The IP address of the affected system

The name of the person who discovered the vulnerability

An expiration date and a review schedule

The exact cost of the remediation

A vulnerability scan of a corporate network identified several findings. The security team has limited resources and must prioritize remediation. Which finding should be addressed FIRST?

A medium-severity vulnerability in an internal development server that is not internet-facing.

A high-severity issue in an internal database that contains sensitive data but is not internet-facing.

A low-severity issue in a public-facing web server that has been present for years.

A critical-severity vulnerability in an internet-facing application that is actively being exploited in the wild.

A security assessment identified a high-severity vulnerability in a custom application. The development team believes the vulnerability is not exploitable due to a compensating control. The security team disagrees. What is the MOST appropriate way to resolve this disagreement?

Require the development team to provide evidence of the compensating control and perform a verification test.

Escalate the disagreement to the application owner and let them decide.

Reclassify the finding as a low severity to reduce its priority.

Accept the development team's opinion and close the finding.

A security researcher discovered a zero-day vulnerability in a widely used open-source library. The researcher wants to publish a detailed blog post immediately to warn the community. The organization that maintains the library has not yet released a patch. What is the MOST responsible course of action for the researcher?

Publish the blog post immediately to ensure the community is aware of the risk.

Post a vague warning without technical details and wait for someone else to find the flaw.

Sell the vulnerability details to a government agency for maximum impact.

Privately disclose the vulnerability to the maintainers and coordinate a disclosure timeline that allows for a patch.

Certified Information Systems Security Professional

Domain 6Objective 4

6.4 - Analyze Test Output and Generate Report CISSP Practice Questions (Page 1)

Part of the Security Assessment and Testing domain, which accounts for 12% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 2–3 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

3concepts

12%of the exam

Questions 1–5

1application · medium
A security assessment found a vulnerability in a legacy system that cannot be patched because the vendor no longer provides support. The system is critical to business operations. What is the MOST appropriate action?
Select an answer first
2foundation · easy
Which element is essential for tracking an approved security exception?
Select an answer first
3application · medium
A vulnerability scan of a corporate network identified several findings. The security team has limited resources and must prioritize remediation. Which finding should be addressed FIRST?
Select an answer first
4application · medium
A security assessment identified a high-severity vulnerability in a custom application. The development team believes the vulnerability is not exploitable due to a compensating control. The security team disagrees. What is the MOST appropriate way to resolve this disagreement?
Select an answer first
5application · medium
A security researcher discovered a zero-day vulnerability in a widely used open-source library. The researcher wants to publish a detailed blog post immediately to warn the community. The organization that maintains the library has not yet released a patch. What is the MOST responsible course of action for the researcher?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.