Security testing, audit strategies, and assessment methods tested on CISSP Domain 6.
35 cards · basic cards · AI-written, checked twice. Edit anything.
- What is the primary difference between vulnerability assessment and penetration testing?
Show answer
Vulnerability assessment identifies weaknesses without attempting exploitation; penetration testing actively exploits vulnerabilities to demonstrate impact.- Name the three main types of security audits based on scope.
Show answer
Compliance audit (regulatory requirements), internal audit (management controls), external audit (third-party independent review).- What does STRIDE stand for in threat modeling?
Show answer
Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.- Define vulnerability scanning and its primary output.
Show answer
Automated process that identifies known vulnerabilities in systems and applications, producing a report of findings with severity ratings.- What is the main objective of white-box code review?
Show answer
To analyze source code with full knowledge of design and implementation to identify logical flaws, security defects, and quality issues.- How does black-box testing differ from white-box testing?
Show answer
Black-box: no knowledge of internal structure, tests external behavior; white-box: full knowledge of code, tests logic paths.- What is gray-box testing?
Show answer
Testing with partial knowledge of internal systems, combining black-box and white-box techniques for realistic assessment.- Name the four phases of vulnerability management.
Show answer
Asset identification, vulnerability identification, analysis and risk assessment, remediation and verification.- What is the purpose of a test data environment in security testing?
Show answer
An isolated copy of production systems and data used for testing without risking actual business operations or exposing real data.- Define static application security testing (SAST).
Show answer
Analysis of source or compiled code without execution to identify security vulnerabilities and coding defects.- What does dynamic application security testing (DAST) involve?
Show answer
Testing running applications by sending inputs and analyzing outputs to discover security vulnerabilities during execution.- What is interactive application security testing (IAST)?
Show answer
Real-time analysis of running code from within the application to detect vulnerabilities with precise accuracy.- What sampling method is most appropriate for audit population of 10,000 items?
Show answer
Statistical sampling (systematic or random) is more appropriate than 100 percent examination for resource efficiency.- Define risk assessment in the context of security controls.
Show answer
Process of identifying assets, threats, and vulnerabilities to calculate likelihood and impact, determining risk level.- What is a control baseline and why is it important for security testing?
Show answer
Documented set of approved controls and configurations used as the standard for comparison when testing and auditing systems.
FlashKeepers