Read each question and choose an answer before opening its explanation. The rationale explains why the keyed response best meets the scenario and why attractive alternatives fall short.
Question 1·Objective 6.1: Internal, external, third-party, on-premises, cloud, and hybrid assessment/test/audit strategies
A consultant is scheduled to begin penetration testing a production payment environment. The technical scope was agreed to in a meeting, but no written authorization or rules of engagement exist. What should the assessment lead do FIRST?
- A.Begin passive reconnaissance because it is unlikely to affect production
- B.Obtain written authorization and approved rules of engagement before testing begins
- C.Run a vulnerability scanner first and document authorization afterward
- D.Ask the consultant to avoid systems believed to contain payment data
Show answer and explanation
Best answer: B. Obtain written authorization and approved rules of engagement before testing begins
Written authorization and rules of engagement establish permission, scope, timing, contacts, constraints, data handling, and stop conditions. Testing a production environment before those controls exist creates legal and operational risk.
A: Passive activity can still exceed authorization, collect sensitive data, or violate agreed boundaries.
B: Written authorization and rules of engagement establish permission, scope, timing, contacts, constraints, data handling, and stop conditions. Testing a production environment before those controls exist creates legal and operational risk.
C: A vulnerability scan is still testing and should not precede authorization.
D: An informal avoidance request does not establish scope, permission, safety controls, or accountability.
Question 2·Objective 6.2: Vulnerability assessment, penetration/red-blue-purple testing, logs, synthetic transactions, code/misuse/coverage/interface testing, breach simulation, and compliance checks
Management wants to know whether an attacker can combine several weaknesses to reach a sensitive application, rather than merely receive a list of suspected vulnerabilities. Which assessment is MOST appropriate?
- A.Authenticated vulnerability scan only
- B.Penetration test with approved exploitation and defined rules of engagement
- C.Configuration inventory export
- D.Policy acknowledgment review
Show answer and explanation
Best answer: B. Penetration test with approved exploitation and defined rules of engagement
An authorized penetration test can validate exploitability and attack paths, including chaining weaknesses, within controlled rules of engagement.
A: A scan identifies potential weaknesses but ordinarily does not demonstrate a complete attack path.
B: An authorized penetration test can validate exploitability and attack paths, including chaining weaknesses, within controlled rules of engagement.
C: Inventory does not validate exploitation.
D: Acknowledgment records do not test technical reachability.
Question 3·Objective 6.3: Process evidence and metrics for accounts, approvals, KPIs/KRIs, backups, awareness, DR, and BC
A dashboard reports that 98 percent of critical vulnerabilities are closed within policy deadlines, yet two internet-facing exceptions have remained open for six months. Which metric would BEST reveal the residual exposure hidden by the aggregate percentage?
- A.Total number of scanners deployed
- B.Age and business exposure of overdue exceptions by asset criticality
- C.Number of pages in the patching procedure
- D.Average length of vulnerability titles
Show answer and explanation
Best answer: B. Age and business exposure of overdue exceptions by asset criticality
Aging, exposure, and asset criticality show concentrated residual risk that a high aggregate closure rate can conceal.
A: Tool count does not measure unresolved risk.
B: Aging, exposure, and asset criticality show concentrated residual risk that a high aggregate closure rate can conceal.
C: Procedure length is unrelated to control effectiveness.
D: Title length has no risk meaning.
Question 4·Objective 6.4: Analysis, reporting, remediation, exceptions, and ethical disclosure
A security assessment produces 400 technical findings. Executives need to decide remediation funding at tomorrow's meeting. What should the assessment lead present FIRST?
- A.An alphabetical list of every affected hostname
- B.Risk-prioritized findings tied to business impact, recommended treatment, accountable owners, and required decisions
- C.Raw scanner output with no interpretation
- D.Only the findings that can be fixed without funding
Show answer and explanation
Best answer: B. Risk-prioritized findings tied to business impact, recommended treatment, accountable owners, and required decisions
Decision-makers need prioritized business risk, treatment choices, ownership, and explicit decisions; technical evidence can remain available as supporting detail.
A: Alphabetical assets do not establish priority.
B: Decision-makers need prioritized business risk, treatment choices, ownership, and explicit decisions; technical evidence can remain available as supporting detail.
C: Raw output does not translate findings into decisions.
D: Excluding funded work hides material risk from budget owners.
Question 5·Objective 6.5: Internal, external, and third-party audits across deployment locations
The manager who designed and operates a privileged-access process is assigned to lead the formal audit of that same process. What is the PRIMARY concern?
- A.The manager may lack sufficient storage capacity
- B.The audit may lack independence and objectivity
- C.The process will automatically fail every control
- D.The audit evidence will necessarily be encrypted
Show answer and explanation
Best answer: B. The audit may lack independence and objectivity
Auditing one's own design and operation creates a self-review threat that undermines independence and confidence in the conclusions.
A: Storage is unrelated to the governance conflict.
B: Auditing one's own design and operation creates a self-review threat that undermines independence and confidence in the conclusions.
C: Lack of independence does not prove every control failed.
D: Evidence encryption is not the central issue.
Question 6·Objective 6.5: Internal, external, and third-party audits across deployment locations
Management asks internal audit to design the controls it will later evaluate. What is the PRIMARY concern?
- A.The controls will necessarily be too strong
- B.The auditor's independence and objectivity may be impaired
- C.External audits become illegal
- D.Evidence retention is unnecessary
Show answer and explanation
Best answer: B. The auditor's independence and objectivity may be impaired
Design ownership can create self-review threats and weaken assurance.
A: This option may be useful in another context, but it does not provide the evidence, scope, or assurance required here.
B: Design ownership can create self-review threats and weaken assurance.
C: This option may be useful in another context, but it does not provide the evidence, scope, or assurance required here.
D: This option may be useful in another context, but it does not provide the evidence, scope, or assurance required here.
Question 7·Objective 6.2: Vulnerability assessment, penetration/red-blue-purple testing, logs, synthetic transactions, code/misuse/coverage/interface testing, breach simulation, and compliance checks
A production assessment has approved scope but no emergency contacts or stop conditions. What must be completed before testing begins?
- A.Begin scanning during the least busy period and notify teams afterward
- B.Ask the tester to decide when operational risk is unacceptable
- C.Document escalation contacts, stop-work criteria, and incident-handling procedures in the rules of engagement
- D.Limit the report to findings that do not affect production
Show answer and explanation
Best answer: C. Document escalation contacts, stop-work criteria, and incident-handling procedures in the rules of engagement
This response best supplies the evidence or governance control required by the scenario.
A: This option does not provide sufficient assurance for the stated decision.
B: This option does not provide sufficient assurance for the stated decision.
C: This response best supplies the evidence or governance control required by the scenario.
D: This option does not provide sufficient assurance for the stated decision.
Question 8·Objective 6.3: Process evidence and metrics for accounts, approvals, KPIs/KRIs, backups, awareness, DR, and BC
A backup dashboard reports successful jobs but restorations routinely fail. Which metric is MORE meaningful?
- A.Number of backup jobs started
- B.Amount of storage purchased
- C.Age of the backup product
- D.Verified restore success against recovery requirements
Show answer and explanation
Best answer: D. Verified restore success against recovery requirements
Recovery capability is demonstrated through successful, requirement-based restoration.
A: This option may be useful in another context, but it does not provide the evidence, scope, or assurance required here.
B: This option may be useful in another context, but it does not provide the evidence, scope, or assurance required here.
C: This option may be useful in another context, but it does not provide the evidence, scope, or assurance required here.
D: Recovery capability is demonstrated through successful, requirement-based restoration.
Question 9·Objective 6.4: Analysis, reporting, remediation, exceptions, and ethical disclosure
A scanner reports a critical vulnerability on an isolated test host. What should occur NEXT?
- A.Validate the finding and prioritize it using exposure and business context
- B.Report it publicly immediately
- C.Delete the scan evidence
- D.Assign severity solely from the scanner label
Show answer and explanation
Best answer: A. Validate the finding and prioritize it using exposure and business context
Validation and contextual risk analysis guide appropriate remediation.
A: Validation and contextual risk analysis guide appropriate remediation.
B: This option may be useful in another context, but it does not provide the evidence, scope, or assurance required here.
C: This option may be useful in another context, but it does not provide the evidence, scope, or assurance required here.
D: This option may be useful in another context, but it does not provide the evidence, scope, or assurance required here.
Question 10·Objective 6.5: Internal, external, and third-party audits across deployment locations
A service organization provides an assurance report whose scope excludes a critical subservice. What should the customer do?
- A.Treat the report as coverage of every dependency
- B.Assess the exclusion and obtain sufficient complementary assurance
- C.Ignore the subservice because it is outsourced
- D.Replace internal controls with the report
Show answer and explanation
Best answer: B. Assess the exclusion and obtain sufficient complementary assurance
Assurance is useful only within its stated scope and dependencies.
A: This option may be useful in another context, but it does not provide the evidence, scope, or assurance required here.
B: Assurance is useful only within its stated scope and dependencies.
C: This option may be useful in another context, but it does not provide the evidence, scope, or assurance required here.
D: This option may be useful in another context, but it does not provide the evidence, scope, or assurance required here.
Continue studying Security Assessment and Testing
Review the complete Domain 6 guide, then mix this material with the other seven domains in an adaptive mock exam.