CISSP Domain 6 study guide
What Security Assessment and Testing tests
Domain 6 verifies that controls are designed correctly, operate as intended, and produce evidence management can use. Testing must be authorized, scoped, repeatable, and appropriate to the business risk.
Domain 6 objectives
Use these official objective areas as a coverage checklist, then combine them in scenario practice.
Assessment strategy
Design and validate assessment, testing, and audit strategies that meet business and compliance needs.
Security control testing
Conduct vulnerability assessments, penetration tests, code reviews, interface tests, misuse-case tests, and simulations.
Security process data
Collect account-management, management-review, training, disaster-recovery, and continuity evidence.
Analyze and report results
Interpret findings, validate evidence, prioritize risk, and communicate to the correct audience.
Conduct or facilitate audits
Support internal, external, and third-party audits while preserving independence and evidence quality.
High-yield distinctions
Vulnerability assessment
Identifies and prioritizes weaknesses, generally without proving exploitation.
Penetration test
Uses authorized exploitation to validate attack paths and impact.
SAST
Analyzes source or compiled code without executing the application.
DAST
Tests a running application from the outside.
Internal audit
Provides organizational assurance while maintaining appropriate independence.
External audit
Uses an independent outside party for assurance or attestation.
Common exam trap
Obtain authorization, scope, rules of engagement, and handling requirements before testing. Finding a vulnerability does not authorize uncontrolled exploitation.
How to study Domain 6
Step 1: Match each assessment to its purpose.
Step 2: Learn test authorization and rules of engagement.
Step 3: Compare code and application testing methods.
Step 4: Practice evidence analysis and risk reporting.
Step 5: Distinguish audit roles and independence.