Domain 6 Practice Test: Security Assessment and Testing

How to take this test

This test covers the whole of Domain 6, and Domain 6 has a single spine: everything in it is a claim about what is true, and the craft is deciding which claims to buy, which instruments produce them, and what the output is worth. Chapter 22 built the strategy layer: the vocabulary that separates assessment, test, and audit, the five decisions that shape any program, the test types and what each one proves, the seven penetration test phases, the rules of engagement that make testing legal, the teams, and the cadence the standards impose. Chapter 23 built the bench: the instruments from network discovery to wireless testing, and the evidence habits that turn tool output into decisions. The 25 questions below are drawn from both chapters, and they are written to be reasoned, not recalled.

Two skills carry this domain, and both are on display here. The first is naming: given a scenario, you must name the activity correctly. Audit or test, verification or validation, red team or penetration test, credentialed or uncredentialed scan, SAST or DAST or RASP, the exam tests the boundaries between these pairs with lawyer-like care, and the wrong option in a question is almost always the correct name for a different activity. The second skill is weighing claims: a scan result is a claim, a capture is a claim, a fuzzer crash is a claim, and the correct answer is usually the one that knows what the claim can and cannot support. When you read a stem, run both checks before you look at the options. What is this activity called, and what would the output actually prove?

A handful of questions name standards and controls, and they are deliberate: the exam does name RA-5 and CVSS and Requirement 11, and the book names the ones that matter. But notice what those questions ask. They do not ask for a mnemonic. They describe the property, the control that owns routine scanning, the official band that a score falls in, the clause that forbids auditors from auditing their own work, and they ask which name belongs to that property. Learn the properties and the names follow.

Set the clock for thirty minutes before you read the first stem: a minute and a quarter per item, the same pace this book assumes for the full 150-item session. Answer every question, even the ones you would rather skip, because a blank is wrong and the real engine never asks why you left it empty. Do not open the answer key early, and do not return to a question once you have moved past it. The adaptive exam gives you no item review, and the practice that transfers is the practice that reproduces that constraint. When a question forces a guess, guess cleanly and keep moving. The score sheet is where the analysis happens, not the test session.

When the clock stops, score yourself honestly and read the score interpretation before you touch anything else. The number is a triage instrument, not a verdict. It tells you which part of Domain 6 deserves your next study hours, and the specific questions you missed tell you which exact ideas to rebuild.

The 25 questions

1. A compliance officer wants to know whether the way engineers actually change production configuration matches the procedure the change-management policy documents. She collects records, interviews engineers, and compares what she finds to the stated requirements. Which word best describes this activity?

   A. An audit B. A vulnerability assessment C. A penetration test D. A social engineering test

2. A security engineer tunes an intrusion prevention system to block traffic matching a specific attack signature. A controlled test confirms the sensor blocks that signature on the wire. Months later, the organization is breached through an encoded variant of the same attack that the signature never matched. Which statement about this situation is correct?

   A. The control is validated but not verified B. The control is verified, but the security objective it served is not validated C. Verification and validation are the same thing, so no distinction applies D. The control fails verification because the breach occurred

3. An internal scan identifies a server facing the internet running an outdated protocol stack. Management wants to know whether an outside attacker could actually turn that weakness into access. Which activity answers that question?

   A. A configuration review against the hardening baseline B. An internal audit of the change-management process C. A penetration test of the affected service D. A phishing simulation

4. An organization’s leadership asks: if a motivated adversary gained a foothold inside the network today, would the security operations team notice and stop them before material damage? Which engagement is designed to answer exactly that question?

   A. An annual internal audit B. A weekly vulnerability scan C. A source code review of the main application D. A red team exercise that operates against objectives using realistic adversary techniques

5. Which statement about a vulnerability assessment is correct?

   A. It identifies weaknesses but does not attempt to exploit them B. It proves whether a discovered weakness is exploitable C. It measures whether the response team would detect an intruder D. It collects evidence of conformance against a documented standard

6. A penetration test proposal covers systems owned by the client and one application hosted by a business partner. The client’s management has signed an authorization letter for the engagement. What is required for the partner-hosted application to be tested legally?

   A. Nothing, because the client’s authorization letter covers the whole engagement B. Written authorization from the partner organization, which owns the application C. An exemption notice filed with the hosting provider D. Verbal confirmation from the partner’s help desk

7. A security team runs an exercise in which the red team explains its techniques as it goes, the blue team checks whether its sensors and procedures actually detect them, and both sides revise their playbooks together in real time. What is this mode called?

   A. Gray-box testing B. Continuous monitoring C. Purple teaming D. Dual control

8. A retailer’s cardholder data environment is subject to PCI DSS. Which testing rhythm does PCI DSS v4.0 Requirement 11 require?

   A. External scans quarterly, internal scans annually, and penetration testing after every release B. Penetration testing quarterly and vulnerability scanning whenever a breach is suspected C. A single annual assessment covering all systems D. Internal and external vulnerability scans quarterly, with external scans performed through an Approved Scanning Vendor, and penetration testing at least annually and after significant change

9. An information security manager wants to schedule internal audits under ISO/IEC 27001:2022. Which statement about what the standard actually requires is correct?

   A. The standard requires internal audits at planned intervals under clause 9.2, leaves the frequency to the organization, and requires in clause 9.2.2 that auditors be objective and not audit their own work B. The standard requires exactly one internal audit per calendar year C. The standard requires all internal audits to be conducted by an external certification body D. The standard sets no audit requirement, only a monitoring one

10. A scanner assigns a CVSS v3.1 base score of 8.7 to a finding. How should the finding be labeled on the official severity scale?

A. Medium B. High C. Critical D. Severe

11. A manager wants one metric that best shows whether the vulnerability management program is improving. Which metric should she track?

A. The number of scanning tools deployed B. The number of CVE records published each month C. The trend of open critical and high findings over time and the mean time to remediate D. The page count of the latest assessment report

12. A penetration test report arrives with 40 findings and a 60-page appendix. The manager must make the report useful. What should happen first?

A. The entire report is forwarded to the board unchanged B. The report is filed until the next quarterly scan C. Every finding is accepted as fact and patched immediately D. Each finding is checked for reproducible evidence, prioritized by business impact, and assigned an owner and a due date, with the executive summary written for decision-makers

13. A team deploys a patch for a critical vulnerability, verifies the deployment on the server, and closes the work order. Which step is missing?

A. A re-scan or retest of the affected system to confirm the vulnerability is actually gone B. A new CVSS score for the patched software version C. A second work order to the scanner vendor D. Nothing is missing, because verifying the deployment closes the loop

14. An assessor scans a network segment with two different scan variants. One variant sends only SYN packets and treats a SYN-ACK as proof that the port is open. The other completes the full three-way handshake. Which statement about the two variants is correct?

A. The SYN variant completes the handshake, and the full variant does not B. The SYN variant is faster and less likely to be logged, while the full variant completes the handshake and is easier to detect C. The full variant sends no traffic the target can see D. Both variants leave identical evidence at the target

15. An incident responder analyzes a packet capture of a session that used TLS 1.3 end to end. Which statement about what the capture can show is correct?

A. The capture shows the application payload, because TLS records travel in plaintext B. The capture shows nothing at all, because TLS sessions cannot be captured C. The capture shows only metadata: addresses, ports, packet sizes, timing, and protocol negotiation, because the payload is encrypted D. The capture shows the decrypted content, because the server certificate carries it

16. A scanner logs into target systems with a service account and collects patch levels, registry values, and file versions before reporting its findings. What kind of scan is this?

A. An uncredentialed scan B. A passive scan C. A port scan D. A credentialed scan

17. A quarterly scan of a network returns a clean report, and management is pleased. The scanner’s plugin database was last updated nine months ago, and the network runs software released since then. What is the most accurate assessment of the clean report?

A. The report is unreliable, because a scanner cannot detect weaknesses its plugin database does not know about; update the database and re-scan B. The network is clean, because the plugin database was vetted by the vendor C. The report is still valid, because plugin age does not affect matching D. The report proves the network was clean at scan time and at no other time

18. Which NIST SP 800-53 Rev 5 control is the home of routine vulnerability monitoring and scanning of systems and hosted applications?

A. CA-2 B. RA-5 C. CA-7 D. CA-8

19. An organization must demonstrate that 400 identical servers each match the same hardening baseline, and the proof must be machine-checkable and repeatable. Which approach fits?

A. A manual review of one server, generalized to the fleet B. A social engineering test of the administrators C. SCAP-based configuration checking, with the checks expressed in XCCDF and OVAL and executed on every server D. A red team exercise against the fleet

20. A development team wants a tool that analyzes the application’s source code for weaknesses at the commit stage, before anything is built or run. Which instrument class fits?

A. DAST B. RASP C. A packet capture D. SAST

21. A vendor offers an agent that installs inside the application and blocks malicious requests in flight, before they reach the business logic. How should this product be classified?

A. A runtime control, not an assessment instrument B. A test instrument that reports findings C. A vulnerability scanner D. A fuzzer

22. A coverage-guided fuzzer runs against a parser library and produces a crash: a saved input, the build it crashed on, and a stack trace. Which statement about what has been proven is correct?

A. The crash proves the parser can be exploited by an attacker B. The crash demonstrates a robustness defect, while exploitability remains a separate question C. The crash proves the parser is free of memory errors D. The crash proves the parser handles unexpected input safely

23. An authentication database is stolen, and the attacker runs offline cracking against the password hashes with unlimited attempts and no lockout. Which policy change does the most to defend the accounts?

A. Require eight characters with one uppercase letter, one digit, and one symbol, rotated every 60 days B. Store the password database with a reversible encryption algorithm for recovery C. Screen new secrets against lists of known breached passwords, allow long passphrases, and forbid reuse across systems D. Display a warning on the login page that passwords should be unique

24. An attacker tries the same common password against every employee account at a company, then moves to the next common password and repeats. Why does this pattern make sense?

A. It maximizes the chance of matching a single targeted account B. It removes the need for password hashes entirely C. It defeats multifactor authentication D. It stays under lockout and rate-limiting thresholds that make many guesses against one account impractical

25. A wireless tester captures the four-way handshake of a WPA2-protected network during an assessment. What does the capture enable?

A. Direct decryption of all network traffic without knowing the passphrase B. A denial-of-service against the access point C. An offline dictionary attack against the passphrase, with unlimited attempts and no lockout D. Nothing, because the handshake contains no secret material

Answer key and rationales

1. A. An audit collects evidence against defined criteria to determine conformance, and comparing practiced behavior to a documented procedure is exactly that. A vulnerability assessment scans for weaknesses, a penetration test attempts to exploit them, and a social engineering test probes the human layer; none of them answers whether a process matches its documented requirements.

2. B. Verification asks whether the control does what it was designed to do, and the sensor demonstrably blocks the configured signature. Validation asks whether the control serves the objective that justified it, and the program fails that test, because the actual attack arrived in a form the signature never covered. The control works and the security objective is still unmet, which is the verification and validation distinction in its purest form.

3. C. Exploitability is a penetration test question: can this weakness be turned into access, and how far does the access go. A configuration review proves conformance to a baseline, an audit proves conformance to requirements, and a phishing simulation measures the human layer; none of them demonstrates whether the outdated protocol stack can actually be exploited.

4. D. The red team measures the whole detection and response system by operating against objectives with realistic adversary behavior, which is precisely the question leadership is asking. An audit verifies conformance, a scan names weaknesses, and a code review finds code defects; none of them tests whether an intruder already inside would be caught.

5. A. The defining property of a vulnerability assessment is that it identifies and prioritizes weaknesses without attempting to exploit them; exploitability is left open, which is a feature, because assessments are cheap, safe, and repeatable. Proving exploitability belongs to the penetration test, measuring detection belongs to the red team, and conformance evidence belongs to the audit.

6. B. The client’s authorization letter authorizes the client’s systems, and a scope that crosses an ownership boundary requires the owner’s own permission. An application hosted by a partner is the partner’s to authorize, and testing it on the strength of the client’s letter alone converts an authorized engagement into an unauthorized access. Provider exemption notices and help-desk confirmations are neither a substitute nor the point.

7. C. Purple teaming is the working mode where red and blue share goals and exchange information during the exercise so that both sides improve their playbooks, exactly what the scenario describes. Gray-box testing is a knowledge-level label, continuous monitoring is a cadence, and dual control is a two-person rule; none of them names the red-and-blue working mode.

8. D. PCI DSS v4.0 Requirement 11 requires quarterly internal and external vulnerability scans, with the external scans performed by an Approved Scanning Vendor, plus internal and external penetration testing at least annually and after significant change, and testing of segmentation controls. The other options misplace the frequencies: scans are quarterly on both sides, pen tests are not quarterly, and the requirement is not a single annual assessment.

9. A. ISO/IEC 27001:2022 clause 9.2 requires internal audits at planned intervals, deliberately leaving the frequency to the organization, and clause 9.2.2 requires auditors to be objective and impartial and not to audit their own work. The standard does not fix an annual cadence, it does not demand an external certification body for internal audits, and it mandates both monitoring under clause 9.1 and auditing under clause 9.2.

10. B. The CVSS v3.1 severity scale runs None at 0.0, Low from 0.1 to 3.9, Medium from 4.0 to 6.9, High from 7.0 to 8.9, and Critical from 9.0 to 10.0, so 8.7 is High. It is not Critical, not Medium, and Severe is not a band on the official scale.

11. C. The trend of open critical and high findings and the mean time to remediate measure the outcome, a shrinking, fast, verified backlog. Scanner count measures tooling, CVE publication measures the external threat landscape, and report length measures paperwork; none of them shows whether the program itself is improving.

12. D. The manager’s first disciplines are demanding reproducible evidence, weighing business impact rather than severity alone, and routing each finding to an owner with a due date, while the executive summary speaks in risk language for decision-makers. Handing a raw technical report to the board skips the audience ladder, filing it wastes the purchase, and accepting every finding as fact skips the validation every report deserves.

13. A. Deployment verification says the patch was installed; a re-scan or retest says the vulnerability is gone, and the two are not the same claim. This is the verification step the exam expects: the fix loop is not closed by a work order, it is closed by evidence from the affected system. A new CVSS score and a vendor work order do not confirm the fix.

14. B. The SYN variant never completes the handshake and is faster and stealthier, while the TCP connect variant completes the full three-way handshake and is easier to detect and log. Neither variant is invisible, a sensor watching for the SYN pattern can catch even the stealthier scan, but the two leave different evidence at the target.

15. C. A capture sees the wire, not the content: with TLS end to end, the analyst gets addresses, ports, sizes, timing, and protocol negotiation, while the application payload stays encrypted. That limitation is the definition of traffic analysis. The certificate does not carry the payload, and TLS sessions are captured routinely, just not read.

16. D. A credentialed scan logs in with a legitimate account and reads configuration truth: patch levels, registry values, file versions, service settings, the things a banner can never reveal. An uncredentialed scan sees only what the network reveals from outside the trust boundary, a passive scan sends no traffic, and a port scan maps services without reading configuration.

17. A. A scanner can only match what its database knows, so a plugin set nine months older than the software on the network cannot report weaknesses that were only discovered after its last update. The currency of the plugin database is the scanner’s most important operational requirement. The report is not evidence of a clean network, it is evidence that the checks were stale.

18. B. RA-5, vulnerability monitoring and scanning, requires the organization to scan its systems and hosted applications, keep the scanning tools interoperable and their updates automated, and act on findings. CA-2 covers security assessments, CA-7 covers continuous monitoring, and CA-8 covers penetration testing; RA-5 is the control that owns routine scanning.

19. C. SCAP, the Security Content Automation Protocol of NIST SP 800-126 Rev 3, turns a security requirement into a machine-checkable statement, with XCCDF for the checklist language and OVAL for the low-level tests, so the baseline is expressed once and executed on every server with comparable output. A single manual review does not scale to 400 systems, and the social engineering and red team options answer different questions entirely.

20. D. SAST analyzes source code or bytecode without running it, which is exactly what makes it fit for the commit stage, where a fix is cheapest, at the price of noise and no runtime view. DAST probes a running application as an outside caller, RASP is a runtime control rather than a test, and a packet capture records traffic; none of them reads the source before it is built.

21. A. A product that sits inside the application and blocks attacks in flight is runtime application self-protection, and RASP is a control, not a test. It does not report findings the way a scanner or an analyzer does, and it is not an assessment instrument at all; the exam will make you tell the difference between measuring an application and defending it.

22. B. A fuzzer crash is evidence of a robustness defect: the code failed on input it was not designed for, and the saved input, build, and stack trace reproduce that failure. Whether the defect can be exploited, and what an attacker could do with it, is a separate question for the exploitation bench. A crash proves neither exploitability nor safety.

23. C. Offline cracking is unbounded, so the defense is making each secret hard to crack and unhelpful if cracked: long passphrases, screening against lists of known breached values per NIST SP 800-63B, and no reuse across systems. Composition rules with forced rotation push users into predictable patterns and do nothing against a stolen hash, reversible storage turns a breach into plaintext, and a warning changes nothing.

24. D. Password spraying trades volume for breadth: one common password against every account stays under lockout and rate-limiting thresholds, so the service never triggers the controls that would throttle a concentrated attack on a single account. That is why the pattern makes sense. It does not target one account, it does not remove the need for hashes, and it has nothing to do with multifactor authentication.

25. C. The four-way handshake proves a client knows the passphrase, and a captured handshake turns the passphrase into an offline dictionary problem: unlimited attempts, no lockout, try candidates until one fits. A weak, short, or dictionary-word passphrase falls quickly, which is why the wireless finding matters. The handshake does not decrypt traffic directly and does not enable denial of service.

Reading your Domain 6 score

Score yourself against the bands this book set in Chapter 1 for every domain test:

The single number hides the information you need, so break the misses down by area. Domain 6 is two disciplines under one label, buying the right test and running the right instrument, and the triage that matters is at the topic level:

Two habits make the score useful. First, log the result and the area misses on your score sheet, because the full practice exam in Chapter 33 will re-test this domain and you want the comparison. Second, treat a miss pattern as a question about process, not just facts. If your misses cluster on the vocabulary and selection questions, 1 through 9, your problem is classification speed, and the fix is to name the activity and the claim before you look at the options. If your misses cluster on the instrument questions, 14 through 25, your problem is knowing what each tool measures and what it cannot see, and the fix is to redraw the instrument table from Chapter 23 cold: tool, question it answers, evidence it produces, and its blind spot.

What the score means for your plan

Domain 6 carries 12 percent of the current outline’s weight, and it is the domain where the manager’s perspective and the engineer’s bench meet. The strategy questions reward the buyer’s discipline: the correct answer is the one that names the activity precisely, picks the test that answers the question asked, and demands evidence strong enough to survive contact with the people who will question it. The instrument questions reward the analyst’s honesty: every tool produces a claim, and the correct answer is the one that knows what the claim supports and where it could be wrong. Both habits transfer directly to the rest of the exam, because every other domain hands you evidence and asks what it proves.

Domain 6 also builds the bridge to the next part. Part VIII, Security Operations, runs the other side of the same machines: the SOC and SIEM consume the logs and captures this domain taught you to read, incident response and forensics formalize the evidence discipline that started with reproducibility, provenance, integrity, and completeness, and NIST SP 800-86 and SP 800-92 return as the authoritative references for handling the artifacts an investigation depends on. A candidate who passes this test knows what an instrument’s output is worth, which is the prerequisite for trusting an alert, a finding, or a piece of evidence when a real incident is on the line.

One more thing worth noticing as you close Part VII: six of the eight domains are now behind you. The next part moves from measuring systems to defending them hour by hour, and the score sheet you just produced is the authority on where your Domain 6 hours go. Pass this test at the level your score band demands and move to Domain 7 with the instruments named and the evidence habits set. Fail it, and you have earned something rarer: a precise list of what to re-read, organized by the discipline that matters.