Which of the following is an example of a misuse case?

A system administrator performing a routine backup

An attacker attempting to bypass authentication by SQL injection

A customer viewing their order history

A user successfully logging in with valid credentials

How do breach attack simulations differ from traditional penetration testing?

They focus on testing the organization's detection and response capabilities rather than just exploiting vulnerabilities

They are performed only by external consultants

They are only used for compliance purposes

They are always manual, while penetration testing is automated

A company has developed a new mobile app that communicates with a backend API. The security team wants to test the API for vulnerabilities such as broken authentication and excessive data exposure. Which testing activity is most directly focused on this concern?

Misuse case testing of the mobile app's user interface.

Coverage analysis of the mobile app's code.

Interface testing of the API endpoints, including authentication and data validation.

Benchmark testing of the API's response times.

What is the difference between static and dynamic code analysis?

Static analysis is used for web applications, while dynamic analysis is used for desktop applications

Static analysis examines code without executing it, while dynamic analysis tests code during execution

Static analysis tests the user interface, while dynamic analysis tests the backend

Static analysis is always manual, while dynamic analysis is always automated

What is the primary purpose of a purple team exercise?

To replace the need for both red and blue teams

To focus solely on exploiting vulnerabilities without any defensive input

To combine offensive and defensive perspectives to improve detection and response capabilities

To conduct compliance audits and ensure regulatory adherence

Certified Information Systems Security Professional

Domain 6Objective 2

6.2 - Conduct Security Control Testing CISSP Practice Questions (Page 6)

Part of the Security Assessment and Testing domain, which accounts for 12% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 2–3 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

10concepts

12%of the exam

Questions 26–30

26foundation · easy
Which of the following is an example of a misuse case?
Select an answer first
27foundation · easy
How do breach attack simulations differ from traditional penetration testing?
Select an answer first
28application · medium
A company has developed a new mobile app that communicates with a backend API. The security team wants to test the API for vulnerabilities such as broken authentication and excessive data exposure. Which testing activity is most directly focused on this concern?
Select an answer first
29foundation · easy
What is the difference between static and dynamic code analysis?
Select an answer first
30foundation · easy
What is the primary purpose of a purple team exercise?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.