6.2 - Conduct Security Control Testing CISSP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security manager wants to evaluate the organization's incident detection and response capabilities against a realistic threat without causing disruption to production systems. The team has already completed a vulnerability assessment that identified several missing patches. Which activity best meets the manager's objective?

   • ARun an automated vulnerability scanner across all production IP addresses to confirm the missing patches.
   • BConduct a breach attack simulation that emulates the tactics of a known threat actor and measures detection and response times.
   • CReview firewall logs for the past month to identify any signs of previous compromise.
   • DPerform a full-scope penetration test against production systems to identify exploitable vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security tester is validating that a banking application properly rejects unauthorized actions, such as a user attempting to transfer funds from an account they do not own. Which testing approach is most appropriate for this scenario?

   • AInterface testing, which checks the API endpoints for proper input validation.
   • BMisuse case testing, which defines and executes scenarios of unauthorized or malicious use.
   • CCoverage analysis, which measures how much of the code is exercised by tests.
   • DBenchmark testing, which measures system performance under load.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of a compliance check?

   • AReviewing logs for security incidents
   • BPerforming a penetration test to exploit a vulnerability
   • CVerifying that all systems have the latest security patches installed
   • DConducting a load test to measure system capacity
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In a red team exercise, what is the primary role of the red team?

   • ATo simulate real-world attacks and attempt to bypass security controls
   • BTo facilitate communication between offensive and defensive teams
   • CTo monitor and analyze security events in real time
   • DTo defend the organization's systems and respond to attacks
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is asked to identify all known vulnerabilities in the organization's network without attempting to exploit them. The goal is to prioritize patching efforts. Which activity should the analyst perform?

   • AMisuse case testing to validate unauthorized actions.
   • BVulnerability assessment using automated scanners to identify known vulnerabilities.
   • CLog review to identify past security incidents.
   • DPenetration testing to exploit vulnerabilities and assess impact.
   Reveal Solution Discussion Select an answer first