Security Assessment and Testing practice questions

Answer: A) Showing trends in control effectiveness and risk exposure to inform management decisions

KPIs and KRIs are ongoing, measurable indicators. Their main value is showing trends in security performance and risk exposure so leadership can make informed decisions. They complement audits and technical testing rather than replacing them.

• AKPIs and KRIs are tracked repeatedly so leadership can see whether performance and risk are improving or getting worse, and can direct resources accordingly.
• BInternally reported metrics support assurance activities but are not independent and don't replace audits or direct testing.
• COngoing indicators are valuable for trend analysis. A one-time snapshot for an attestation misses their main purpose.
• DFinding specific vulnerabilities is the job of vulnerability assessment and penetration testing. KPIs/KRIs summarize program performance and risk.

Answer: A) Examine, interview, and test

NIST SP 800-53A (also reflected in ISC2's CGRC outline) defines three methods for gathering control-assessment evidence: examine, interview, and test. The other triads come from audit, risk assessment, and penetration testing.

• ASP 800-53A defines three methods. Examine means reviewing documents, configurations, and records. Interview means talking with responsible personnel. Test means exercising the control under defined conditions and comparing actual behavior with expected behavior. ISC2's CGRC outline lists the same three: interview, examine, test.
• BThese sound like financial-audit evidence procedures, which makes them a tempting choice. They aren't the three methods SP 800-53A defines.
• CThese are steps in a risk assessment process. They aren't SP 800-53A's evidence-gathering methods for control assessments.
• DThese describe phases of a penetration test. In SP 800-53A, penetration testing is just one technique that falls under the Test method; it isn't the set of methods itself.

Answer: A) The objectivity and competence of the internal audit function

Before relying on another auditor's work, the external auditor must first confirm that the internal audit function is objective (independent of what it audits) and competent. Sampling details, reported results and remediation status come later or don't establish reliability.

• ACorrect. The external auditor can rely on internal audit's work only if the function is independent of the areas it audits and its staff are competent. This has to be settled first. If either condition fails, none of the function's work can be used as reliable evidence, so later checks don't matter.
• BIncorrect. Sampling is checked when the external auditor reviews specific pieces of internal audit's work. That happens after the function itself has been found objective and competent. Sound sampling can't make up for a team that isn't independent.
• CIncorrect. Reported results don't show whether the work is reliable. A low exception count could reflect weak testing or pressure from management just as easily as strong controls.
• DIncorrect. Remediation status shows how management responds to findings. It says nothing about whether internal audit's testing was independent and competent enough to use as audit evidence.

Answer: A) A vulnerability assessment finds and ranks weaknesses without exploiting them; a penetration test tries to exploit them to show real impact

A vulnerability assessment identifies and prioritizes weaknesses without exploiting them. A penetration test actively exploits weaknesses to prove impact. Red teaming goes further and tests detection and response.

• ACorrect. A vulnerability assessment covers a wide range of systems: it uses mostly automated scanning and review to list and prioritize weaknesses. A penetration test goes deeper by using ethical hacking techniques to exploit weaknesses, proving they can be exploited and showing chained attack paths.
• BThis reverses the two roles. Exploiting a weakness to show impact is what defines a penetration test. An assessment identifies and prioritizes weaknesses without exploiting them.
• CWho does the testing doesn't separate the two. Internal or external staff can do either, and penetration tests are often done by outside experts. The real difference is whether weaknesses are exploited.
• DLong-running adversary emulation that tests detection and response describes a red-team exercise. A one-time automated scan for known CVEs is closer to a vulnerability scan than to a penetration test.

Answer: A) Load test data that was statically masked or synthetically generated, keeping formats and cross-table relationships consistent

Keep real PII out of test environments by using statically masked or synthetic data that preserves format and referential integrity. Access controls, dynamic masking and encryption on a production copy all leave the real data in place.

• AStatic masking or synthetic generation replaces real values with realistic but false ones before the data reaches the test environment. Keeping semantic and referential integrity means the tests still behave realistically, and no real PII ever leaves production.
• BThe real PII still sits in a less-protected environment. Administrators and anyone else with access can see it, so the requirement that real data not be present is not met.
• CDynamic masking only hides values in query results for non-privileged users. The real data is still stored in the test database, and privileged users or inference attacks can expose it.
• DEncryption at rest protects stolen media. Testers who query the database through the application still see the real customer records in plaintext.

Answer: A) Record a formal exception approved by the risk owner, with compensating controls and a remediation deadline

When a finding can't be fixed in time, it should go through formal exception handling: the risk owner documents and approves the risk acceptance, with compensating controls and a remediation deadline, and the finding is not hidden, downgraded or closed early.

• ACorrect. Exception handling documents the accepted risk, who approved it and the compensating controls, and sets a date to revisit and fix the issue, so the finding stays visible and someone stays accountable for it.
• BIncorrect. Changing the rating to fit the schedule misrepresents the risk and weakens the report's integrity. The rating should reflect the actual risk.
• CIncorrect. A planned fix isn't remediation. Closing the finding early removes it from tracking while the vulnerability is still exploitable.
• DIncorrect. The testers report the risk, but accepting it is the job of the business risk owner who has the authority and accountability to make that call.

Answer: A) A SOC 3 report on the Trust Services Criteria

SOC 3 is the public, general-use summary version of a SOC 2 Trust Services Criteria engagement. SOC 1 and SOC 2 reports (Type 1 or Type 2) are detailed and restricted, usually shared under an NDA.

• ACorrect. A SOC 3 is a general-use summary report against the Trust Services Criteria. It leaves out the detailed control descriptions and test results found in a SOC 2, so it can be published without restriction.
• BIncorrect. A SOC 2 Type 2 includes detailed control descriptions and the auditor's test results. Distribution is restricted, typically to customers under an NDA, so it is not meant for public posting.
• CIncorrect. A SOC 1 covers controls relevant to customers' financial reporting, not a general security trust assurance. It is also a detailed, restricted-distribution report.
• DIncorrect. A Type 1 looks only at control design at a single point in time, but it is still a detailed SOC 2 report with restricted distribution. It is not suitable for public posting.

Answer: A) Code coverage

• ACode coverage indicates how much of the code was exercised by tests, though high coverage alone does not guarantee the tests check for security issues.
• BMTTD measures detection speed for incidents, unrelated to test execution coverage of code.
• CALE is a risk-quantification metric, not a testing coverage measure.
• DRPO defines acceptable data loss in a disaster scenario, unrelated to test coverage.

Answer: A) Cloud security posture management (CSPM) platform

CSPM tools keep checking cloud infrastructure configurations against security standards and flag misconfigurations such as publicly readable storage. CWPP protects running workloads, SAST analyzes code, and CASB controls how users access cloud services.

• ACSPM continuously checks cloud account and resource configurations against security standards. It flags misconfigurations such as public storage or overly permissive network rules and recommends fixes.
• BCWPP protects the workloads themselves, such as VMs, containers and serverless functions. It covers runtime threats and vulnerabilities inside those workloads, not benchmark checks of account-level configuration like bucket access settings.
• CSAST looks for coding flaws in application source code. It doesn't check the live configuration of deployed cloud accounts and resources.
• DA CASB sits between users and cloud services to give visibility into SaaS use and enforce usage policy, such as finding shadow IT or applying DLP. Its main purpose is not continuous benchmark checks of IaaS infrastructure configuration.

Answer: A) Fuzz testing (fuzzing)

• AFuzzing automatically generates large volumes of invalid or random input to find input-handling flaws (crashes, memory errors, hangs) that structured test cases miss; mutation and generation-based variants exist.
• BRegression testing re-runs known test cases to confirm changes didn't break existing functionality; it isn't random-input probing.
• CUAT validates that the system meets business needs with realistic scenarios, not malformed input storms.
• DStatic analysis inspects source without executing it; fuzzing is a dynamic, runtime technique.