Question 410
A scanner finds a critical package version on a host but the vulnerable feature is disabled and the host is isolated. Which response best addresses the central security requirement with a defensible, risk-based design?
- Validate affected component configuration, compensating controls and exploit path before setting treatment priority
- Automatically mark every version match exploited
- Run authorized penetration testing with realistic objectives and bounded exploit paths
- Mark the finding false forever without review
Explanation
Correct Answer
A:Version detection is a starting point; real exposure changes risk.
Incorrect Answers
B:Presence does not prove exploitation.
C:Pen tests assess exploitability and attack chains beyond inventory-based scanning. Validate affected component configuration, compensating controls and exploit path before setting treatment priority.
D:Future configuration changes may make it exploitable.
Question 411
External testers can run exploits in a sandbox but the product owner wants no customer data in test outputs. Which response best addresses the central security requirement with a defensible, risk-based design?
- Permit testers to export all production data as proof
- Combine static analysis with dynamic testing of live behavior as appropriate
- Copy all live customer accounts into the sandbox
- Define realistic scoped test fixtures and evidence handling before performing exploitation
Explanation
Correct Answer
D:Authorized penetration testing must respect data boundaries and safety.
Incorrect Answers
A:Excessive evidence collection can violate obligations.
B:Static code review and runtime DAST cover different evidence surfaces. Define realistic scoped test fixtures and evidence handling before performing exploitation.
C:Uncontrolled sensitive copies create new risk.
Question 412
A red team repeatedly gets domain-administrator access but the blue team learns nothing because exercises remain secret after completion. Which response best addresses the central security requirement with a defensible, risk-based design?
- Treat scan findings as candidates and validate applicability, exposure and remediation urgency
- Use a debriefed purple-team process that correlates attack technique, detections and mitigation improvements
- Prohibit defender access to exercise telemetry permanently
- Measure success only by whether red team won
Explanation
Correct Answer
B:Cooperative learning can convert offensive findings into defensive capability.
Incorrect Answers
A:Scanners detect possible weakness; they do not always prove an exploitable path. Use a debriefed purple-team process that correlates attack technique, detections and mitigation improvements.
C:Defenders cannot improve unknown gaps.
D:A win/loss score does not show detection improvement.
Question 413
A release includes dynamic code paths constructed through reflection that the static analyzer does not see clearly. Which response best addresses the central security requirement with a defensible, risk-based design?
- Supplement source scanning with appropriately scoped runtime and instrumentation-assisted tests
- Declare static analysis complete security proof
- Turn off scans because dynamic tests exist
- Treat scan findings as candidates and validate applicability, exposure and remediation urgency
Explanation
Correct Answer
A:No single testing method covers every runtime branch.
Incorrect Answers
B:Static scans have blind spots.
C:Multiple methods cover different weaknesses.
D:Scanners detect possible weakness; they do not always prove an exploitable path. Supplement source scanning with appropriately scoped runtime and instrumentation-assisted tests.
Question 414
A payment API correctly authenticates individual endpoints but allows unauthorized state transitions when calls occur in a particular sequence. Which response best addresses the central security requirement with a defensible, risk-based design?
- Test interaction and business-workflow state transitions including negative authorization sequences
- Perform authorized breach-and-attack simulation with safe technique emulation and defender telemetry verification
- Validate only JSON syntax and skip state checks
- Check that each endpoint returns HTTP 200
Explanation
Correct Answer
A:Interface tests must cover how components behave together rather than only endpoint schemas.
Incorrect Answers
B:Controlled emulation measures detection coverage without requiring real compromise. Test interaction and business-workflow state transitions including negative authorization sequences.
C:Schema compliance does not enforce business process rules.
D:Successful status does not prove workflow authorization.
Question 415
Operations claims that an API is healthy because a load balancer responds, although a user checkout fails. Which response best addresses the central security requirement with a defensible, risk-based design?
- Conduct coordinated purple-team testing to improve detection against exercised adversary techniques
- Count only successful TCP handshakes
- Deploy bounded synthetic user journeys from representative locations including authenticated business transactions
- Measure only gateway CPU
Explanation
Correct Answer
C:Synthetic monitoring can detect broken critical paths that low-level availability misses.
Incorrect Answers
A:Purple teaming joins offensive emulation and defensive feedback. Deploy bounded synthetic user journeys from representative locations including authenticated business transactions.
B:Connectivity is weaker than checkout correctness.
D:CPU does not show application success.
Question 416
After a prior breach simulation finding, a global logistics firm reports that the approved safeguard is implemented: “Perform authorized breach-and-attack simulation with safe technique emulation and defender telemetry verification.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run the specific approved technique and confirm alert, triage and containment signals
- Run this adjacent but different test as the sole proof: Replay the technique and confirm the defender now detects and responds
- Use the completion of this alternative as proof: Assume installing the rule proves effectiveness
- Accept a signed change ticket saying: Perform authorized breach-and-attack simulation with safe technique emulation and defender telemetry verification
Explanation
Correct Answer
A:Observed detections establish coverage.
Incorrect Answers
B:The feedback loop is the intended outcome. It tests red/blue/purple, while this case requires evidence about breach simulation.
C:Unexecuted policy does not show detector response. Run the specific approved technique and confirm alert, triage and containment signals.
D:Run the specific approved technique and confirm alert, triage and containment signals. Observed detections establish coverage.
Question 417
After a prior vulnerability scan finding, a regional hospital network reports that the approved safeguard is implemented: “Treat scan findings as candidates and validate applicability, exposure and remediation urgency.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Retest a remediated version and confirm detection and closure
- Use the completion of this alternative as proof: Call every finding a confirmed breach
- Accept a signed change ticket saying: Treat scan findings as candidates and validate applicability, exposure and remediation urgency
- Run this adjacent but different test as the sole proof: Send contract-conformant and malformed requests across the real interface
Explanation
Correct Answer
A:Follow-up scanning validates remediation.
Incorrect Answers
B:A vulnerability is not evidence of successful exploitation. Retest a remediated version and confirm detection and closure.
C:Retest a remediated version and confirm detection and closure. Follow-up scanning validates remediation.
D:Boundary testing validates integration. It tests interface, while this case requires evidence about vulnerability scan.
Question 418
After a prior pen test finding, a payment-services company reports that the approved safeguard is implemented: “Run authorized penetration testing with realistic objectives and bounded exploit paths.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Treat a clean scan as proof no attack path exists
- Demonstrate the attack path in a safe scope and retest controls after fixes
- Accept a signed change ticket saying: Run authorized penetration testing with realistic objectives and bounded exploit paths
- Run this adjacent but different test as the sole proof: Send contract-conformant and malformed requests across the real interface
Explanation
Correct Answer
B:Evidence of exploitability and remediation matters.
Incorrect Answers
A:Unknown and chained vulnerabilities can evade scanners. Demonstrate the attack path in a safe scope and retest controls after fixes.
C:Demonstrate the attack path in a safe scope and retest controls after fixes. Evidence of exploitability and remediation matters.
D:Boundary testing validates integration. It tests interface, while this case requires evidence about pen test.
Question 419
After a prior red/blue/purple finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Conduct coordinated purple-team testing to improve detection against exercised adversary techniques.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Rehearse a transaction and verify all dependent steps under expected latency
- Use the completion of this alternative as proof: Celebrate only that red team achieved access
- Replay the technique and confirm the defender now detects and responds
- Accept a signed change ticket saying: Conduct coordinated purple-team testing to improve detection against exercised adversary techniques
Explanation
Correct Answer
C:The feedback loop is the intended outcome.
Incorrect Answers
A:End-to-end synthetic results show availability from user perspective. It tests synthetic, while this case requires evidence about red/blue/purple.
B:The security value includes defensive detection lessons. Replay the technique and confirm the defender now detects and responds.
D:Replay the technique and confirm the defender now detects and responds. The feedback loop is the intended outcome.
Question 420
After a prior static/dynamic tests finding, an international retailer reports that the approved safeguard is implemented: “Combine static analysis with dynamic testing of live behavior as appropriate.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Combine static analysis with dynamic testing of live behavior as appropriate
- Run this adjacent but different test as the sole proof: Demonstrate the attack path in a safe scope and retest controls after fixes
- Compare a controlled vulnerability seeded in code to both static and runtime detection
- Use the completion of this alternative as proof: Assume a SAST pass proves every runtime configuration is safe
Explanation
Correct Answer
C:Complementary testing demonstrates coverage.
Incorrect Answers
A:Compare a controlled vulnerability seeded in code to both static and runtime detection. Complementary testing demonstrates coverage.
B:Evidence of exploitability and remediation matters. It tests pen test, while this case requires evidence about static/dynamic tests.
D:Deployment dependencies can alter behavior. Compare a controlled vulnerability seeded in code to both static and runtime detection.
Certified Information Systems Security Professional (CISSP) Practice Tests