6.2 - Conduct Security Control Testing CISSP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An organization wants to continuously test its security controls against the latest attack techniques without requiring manual red team exercises. They want to automate the process and integrate it with their security operations center. Which approach is most suitable?

   • AUse vulnerability scanning to identify missing patches.
   • BConduct a full penetration test once a year.
   • CPerform a manual red team exercise every quarter.
   • DDeploy a breach attack simulation platform that runs automated attack scenarios.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security operations team is reviewing logs from multiple sources, including firewalls, servers, and applications. They want to identify patterns that might indicate a coordinated attack. Which technique is most effective for this task?

   • AReviewing each log source independently for anomalies.
   • BCorrelating logs from different sources to identify related events.
   • CRunning a vulnerability scan to identify weaknesses.
   • DPerforming a coverage analysis of the logs.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of misuse case testing?

   • ATo ensure that the user interface is intuitive
   • BTo test how the system handles unauthorized or malicious actions
   • CTo verify that the system meets all functional requirements
   • DTo measure system performance under normal load
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How does a vulnerability assessment differ from a penetration test?

   • AA vulnerability assessment is performed by automated tools only, while a penetration test is always manual
   • BA vulnerability assessment is conducted after a penetration test to verify fixes
   • CA vulnerability assessment identifies potential weaknesses, while a penetration test attempts to exploit them to prove impact
   • DA vulnerability assessment is limited to network scans, while a penetration test covers applications
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team has completed a series of tests on a web application, including SAST, DAST, and manual penetration testing. They want to ensure that all critical code paths and user roles have been tested. Which activity should they perform to assess the completeness of their testing?

   • ACoverage analysis to identify which parts of the application were exercised by the tests.
   • BA breach attack simulation to test the organization's response to a real-world attack.
   • CA compliance check to verify that the application meets regulatory requirements.
   • DA synthetic transaction to verify that the application's core functionality works.
   Reveal Solution Discussion Select an answer first