Security Assessment and Testing — CISSP practice questions

Which BEST describes the purpose of a purple team exercise?

1. Blending offensive and defensive functions so that responsibility is obscured
2. Outsourcing all offensive and defensive testing to a managed service provider
3. Replacing the blue team with automated detection tooling across the whole SOC
4. Red and blue teams collaborating live to improve detection and response

Answer: D — Red and blue teams collaborating live to improve detection and response

D) Correct: Purple teaming runs offense and defense together, tuning detections and response procedures as each technique is executed rather than waiting for a report. A) Accountability stays with each team; the collaboration is deliberate, not obscuring. C) Tooling supports analysts rather than replacing them. B) Sourcing arrangements are orthogonal to the exercise format.

Which scope statement BEST reflects interface testing in an assessment plan for an industrial control environment?

1. Testing the strength of operator passwords on human machine interfaces
2. Testing exchanges across application, physical and network links
3. Testing whether the control network is segmented from the corporate network
4. Testing the availability of the historian database during a failover event

Answer: B — Testing exchanges across application, physical and network links

B) Correct — interface testing covers the exchange points between components, whether those are programmatic, physical or network boundaries. A) is a credential control test on one component, not a boundary exchange test. C) is a segmentation validation activity with a different objective. D) is a resilience test of a single service rather than an interface assessment.

A tester discovers an unrelated production system is exposed while executing an authorised assessment. What should the tester do FIRST?

1. Continue testing the newly discovered system to gauge its true exposure
2. Record it quietly and include it in the final written report
3. Remediate the exposure immediately to protect the organisation
4. Halt and report to the engagement authority for a scope decision

Answer: D — Halt and report to the engagement authority for a scope decision

D) Correct — acting outside authorised scope is prohibited regardless of intent, so the tester escalates and lets the authorising party decide. A) exceeds the rules of engagement and exposes both parties to legal risk. B) delays notice of an active exposure that management could address today. C) tempts as helpfulness but a tester is not authorised to change production systems.

A penetration test of a hospital's clinical network is proposed during operating hours. What consideration should take precedence in approving the plan?

1. The cost difference between testing during and outside operating hours
2. The completeness of the evidence obtainable under realistic load
3. The risk that testing could disrupt systems supporting patient care
4. The testing firm's preference for scheduling within business hours

Answer: C — The risk that testing could disrupt systems supporting patient care

C) Correct — where medical devices and clinical systems are in scope, safety of human life outranks assessment completeness and every commercial factor. A) is a budget consideration that cannot compete with patient safety. B) is a genuine methodological benefit and precisely the temptation to resist here. D) is a supplier convenience with no standing in the decision.

Which testing technique sends malformed or random inputs to a program to discover crashes and unexpected behaviors?

1. Regression testing
2. User acceptance testing
3. Performance benchmarking
4. Fuzzing

Answer: D — Fuzzing

D) Correct: Fuzzing (mutational, generational, coverage-guided) discovers parser and input-handling bugs. A) Regression tests ensure no new bugs in unchanged paths. C) Performance benchmarking measures throughput. B) UAT validates user requirements.

An assessor reports that the test suite exercises seventy per cent of the application's branches, and asks which requirements have no corresponding test. This assessor is performing:

1. Coverage analysis across code and requirements
2. Static application security testing of the source tree
3. Fuzz testing with malformed input generation
4. Compliance checking against a configuration baseline

Answer: A — Coverage analysis across code and requirements

A) Correct — coverage analysis measures how much of the code and of the stated requirements the testing actually reaches, exposing untested areas. B) inspects code for defects without executing it and does not measure test reach. C) generates inputs to provoke failures rather than quantifying coverage. D) compares settings to a standard, which is a different assurance activity entirely.

A manual secure code review is proposed for a small, high-risk cryptographic module already covered by automated scanning. The BEST justification for the additional effort is that manual review:

1. Is faster than automated scanning on modules of this size
2. Can judge design intent and misuse of primitives that tools cannot infer
3. Eliminates the need to run the automated scanner on that module again
4. Produces findings that regulators accept in place of independent testing

Answer: B — Can judge design intent and misuse of primitives that tools cannot infer

B) Correct — reasoning about whether cryptography is used correctly for its purpose is a judgement problem that pattern-based tools handle poorly. A) is generally false and is not the justification a manager would offer. C) is a direction reversal; the two techniques are layered, not substituted. D) asserts a regulatory equivalence that does not exist.

A firm has never tested its recovery plan and wants to begin with the least operationally disruptive exercise. Which should it run FIRST?

1. A full interruption test that shifts live production to the alternate site
2. A parallel test that brings up recovery systems alongside production
3. A tabletop exercise walking the response team through a scenario
4. A simulation test that activates the notification tree and support staff

Answer: C — A tabletop exercise walking the response team through a scenario

C) Correct — a discussion-based walkthrough validates plan logic and roles with essentially no operational risk, which is the right starting point for an untested plan. A) is the most disruptive form and is reckless as a first exercise. B) is far less disruptive than full interruption but still consumes real infrastructure and staff effort. D) sits between the two and would be premature before the plan has been walked through.

An organisation verifies backups only by checking that the backup software reported no errors. The MOST significant weakness is that this practice:

1. Fails to detect silent corruption until a real restore is needed
2. Does not record the operator who initiated each backup job
3. Cannot confirm whether the backup was encrypted in transit
4. Provides no evidence of how long each backup job took to complete

Answer: A — Fails to detect silent corruption until a real restore is needed

A) Correct — success codes cannot reveal corrupt or unreadable data, so the failure is discovered at the worst possible moment. B) is an accountability gap that does not affect recoverability. C) is a genuine control question but concerns confidentiality rather than restorability. D) is a performance metric with no bearing on whether the data can be recovered.

A programme reports that ninety-eight per cent of scheduled backup jobs completed successfully last quarter. Which additional data point is MOST important for assurance?

1. The total volume of data written to backup media
2. The results of restoration tests performed from those backups
3. The number of backup jobs that were rescheduled after failure
4. The retention period configured for each backup set

Answer: B — The results of restoration tests performed from those backups

B) Correct — a completed job proves the write happened, while only a restoration test proves the data is usable, which is the outcome the control exists to deliver. A) describes throughput and says nothing about recoverability. C) is operational housekeeping that still measures job execution rather than restorability. D) governs how long copies survive but not whether they can be read back.

What are the phases of a pen test?

1) Planning/Scoping, 2) Reconnaissance, 3) Scanning/Enumeration, 4) Exploitation, 5) Post-exploitation, 6) Reporting, 7) Remediation/Retest.

What's the difference between black, gray, and white box testing?

Black: tester has no info (true outsider). Gray: limited info (e.g., user creds). White: full info (architecture, source). Different rigor levels.

Which account management metrics belong in security process data, and what does each reveal?

Provisioning and deprovisioning time — how long access lags a joiner or leaver, where leaver lag is the material risk. Orphaned and dormant account counts — identity hygiene failures. Recertification completion rate and revocation rate — whether reviews are real or rubber-stamped. Privileged account count and proportion with standing privilege — blast radius. Failed and anomalous authentication rates — attack pressure and usability problems. Exceptions granted and still open past expiry — accumulating unmanaged risk.

What does backup verification actually have to prove, and what is the usual shortfall?

It must prove the data can be restored to a usable state within the recovery time objective and with no more loss than the recovery point objective, so verification means an actual test restore to a separate environment with application-level validation that the restored data is consistent and readable. The usual shortfall is treating a successful backup job, a completed checksum, or a green dashboard as verification. A job that completed and a restore that works are different claims, and only the second one matters on the day.