6.0 Security Assessment and Testing CISSP Practice Quiz

• A. Define assessment scope, objectives, criteria, independence, timing, and evidence requirements before testing begins
• B. Treat an internal readiness review as if it were an independent external audit
• C. Skip rules of engagement on a pen test because the team is internal
• D. Begin assessment testing immediately without defining scope or success criteria

A valid assessment strategy starts with clear boundaries and criteria so results are meaningful and repeatable. This is the correct answer.

• A. Define rules of engagement before active testing affects production systems or third-party environments
• B. Skip RoE documentation because the test is performed internally
• C. Start a pen test without defined scope or success criteria
• D. Test every system at the same depth, ignoring risk differences

Rules of engagement prevent testing from causing unauthorized disruption or legal exposure. This is the correct answer.

• A. Let control owners select all evidence with no assessor review
• B. Align test and audit strategy with business risk, legal obligations, control frameworks, and stakeholder assurance needs
• C. Equate a readiness check with an independent third-party audit
• D. Forgo formal RoE because the testing team works for the same employer

Assessment work should focus on controls and systems that matter to the organization's obligations and risk posture. This is the correct answer.

• A. Use an internal readiness review as the only audit basis
• B. Use sampling methods that are documented and appropriate to the population and control being tested
• C. Run active testing without rules of engagement on the basis of internal trust
• D. Begin assessment activities without first agreeing scope and acceptance criteria

Sampling must support defensible conclusions about control performance. This is the correct answer.

• A. Forgo rules of engagement because the team is in-house
• B. Integrate security assessment activities into system lifecycle gates and change management
• C. Start a security assessment with no defined success criteria
• D. Apply uniform testing depth across systems with very different risks

Controls should be assessed before major changes introduce unacceptable risk. This is the correct answer.

• A. Apply the same test depth to every system regardless of risk
• B. Allow auditees to choose evidence without independent assessor review
• C. Use a risk-based assessment plan that gives higher-risk systems more frequent and deeper testing
• D. Treat readiness reviews as substitutes for independent external assessments

Risk-based planning helps assurance resources focus where failure would have the greatest impact. This is the correct answer.

• A. Allow control owners to choose all evidence with no assessor review
• B. Treat a self-administered readiness check as an external audit
• C. Validate that test plans include success criteria, expected evidence, responsible parties, and escalation paths
• D. Skip RoE for a pen test because the testers are employees

A test plan should make it clear how results will be judged and what happens if testing fails. This is the correct answer.

• A. Kick off testing without first defining scope, objectives, or success criteria
• B. Use uniform test depth across systems regardless of risk classification
• C. Let control owners cherry-pick evidence with no assessor oversight
• D. Select internal assessment, external audit, automated testing, manual review, or technical testing based on the assurance objective

Different assessment methods provide different evidence and levels of independence. This is the correct answer.