6.1 - Design and Validate Assessment, Test, and Audit Strategies CISSP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is considering hiring an external penetration testing firm to assess its network. The company has strict data protection requirements and wants to ensure the testing does not expose sensitive data. What is the most important contractual element to include?

   • AA clause requiring the testing firm to use only its own tools and not the company's tools.
   • BA requirement that the testing firm provide a live video feed of the testing activities.
   • CA clause that the testing firm must complete the test within 24 hours.
   • DA detailed scope of work and a non-disclosure agreement (NDA) that covers all data accessed during the test.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company runs a hybrid infrastructure with on-premises data centers and a public cloud environment. The security team needs to assess the security posture of both environments. What is the most important consideration when designing the assessment strategy?

   • AEnsure the assessment covers both on-premises and cloud components, accounting for differences in visibility and control.
   • BFocus the assessment only on the cloud environment because it is more exposed to external threats.
   • CUse the same assessment tools and techniques for both environments without modification.
   • DPerform the assessment only on-premises because the cloud provider is responsible for security.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A software development company wants to assess the security of its new web application before launch. The application is hosted in a cloud environment, and the development team has staging access. The company wants to identify vulnerabilities early without affecting production. What is the best assessment approach?

   • AWait until after launch and rely on user reports to identify security issues.
   • BAsk the cloud provider to perform a security assessment of the application.
   • CConduct a black-box penetration test against the production environment to simulate a real attack.
   • DPerform a vulnerability scan and penetration test on the staging environment using the development team's credentials.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A financial services firm must validate its internal network segmentation controls before a regulatory audit. The security team has full access to the production environment and wants to minimize disruption to business operations. Which assessment strategy best meets these requirements?

   • ARun an unauthenticated internal scan continuously during business hours to identify all vulnerabilities in real time.
   • BHire an external penetration testing firm to perform black-box testing from the internet.
   • CConduct an internal vulnerability scan using credentialed scans during a scheduled maintenance window.
   • DReview firewall rule changes from the past year without performing any active testing.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A government agency is required to have an annual security assessment of its systems by an independent third party. The agency has a strong internal security team. What is the most important reason for using an external assessor?

   • ATo access advanced testing tools that the agency cannot afford.
   • BTo comply with the agency's policy of using external resources for all projects.
   • CTo provide an unbiased and independent evaluation of the agency's security posture.
   • DTo reduce the workload on the internal security team.
   Reveal Solution Discussion Select an answer first