Security testing, audit strategies, and assessment methods tested on CISSP Domain 6.
35 cards · basic cards · AI-written, checked twice. Edit anything.
- What is the primary difference between vulnerability assessment and penetration testing?
- Vulnerability assessment identifies weaknesses without attempting exploitation; penetration testing actively exploits vulnerabilities to demonstrate impact.
- Name the three main types of security audits based on scope.
- Compliance audit (regulatory requirements), internal audit (management controls), external audit (third-party independent review).
- What does STRIDE stand for in threat modeling?
- Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.
- Define vulnerability scanning and its primary output.
- Automated process that identifies known vulnerabilities in systems and applications, producing a report of findings with severity ratings.
- What is the main objective of white-box code review?
- To analyze source code with full knowledge of design and implementation to identify logical flaws, security defects, and quality issues.
- How does black-box testing differ from white-box testing?
- Black-box: no knowledge of internal structure, tests external behavior; white-box: full knowledge of code, tests logic paths.
- What is gray-box testing?
- Testing with partial knowledge of internal systems, combining black-box and white-box techniques for realistic assessment.
- Name the four phases of vulnerability management.
- Asset identification, vulnerability identification, analysis and risk assessment, remediation and verification.
- What is the purpose of a test data environment in security testing?
- An isolated copy of production systems and data used for testing without risking actual business operations or exposing real data.
- Define static application security testing (SAST).
- Analysis of source or compiled code without execution to identify security vulnerabilities and coding defects.
- What does dynamic application security testing (DAST) involve?
- Testing running applications by sending inputs and analyzing outputs to discover security vulnerabilities during execution.
- What is interactive application security testing (IAST)?
- Real-time analysis of running code from within the application to detect vulnerabilities with precise accuracy.
- What sampling method is most appropriate for audit population of 10,000 items?
- Statistical sampling (systematic or random) is more appropriate than 100 percent examination for resource efficiency.
- Define risk assessment in the context of security controls.
- Process of identifying assets, threats, and vulnerabilities to calculate likelihood and impact, determining risk level.
- What is a control baseline and why is it important for security testing?
- Documented set of approved controls and configurations used as the standard for comparison when testing and auditing systems.