CISSP Domain 6 practice questions
Security Assessment and Testing
Domain 6 is about proving controls work. You will be asked to choose the right assessment for a goal — vulnerability scan, penetration test, audit, code review — and to handle results responsibly. Rules of engagement and management approval come before any active testing.
Sample Domain 6 questions
Before beginning an external penetration test, what is the MOST important item to obtain?
A company wants assurance about a cloud provider's security controls operating effectively over a period of time. Which report should it request?
Which testing technique feeds malformed or random input to an application to discover unexpected failures?
Common Domain 6 traps
- Starting a penetration test without written authorisation and defined scope.
- Treating a vulnerability scan as equivalent to a penetration test.
- Mixing up SOC 1 (financial reporting) and SOC 2 (security, availability and related trust criteria).
Key concepts to master
- Vulnerability assessment vs penetration testing
- Test types: black, grey, white box; internal vs external
- Audits: internal, external, third-party; SOC reports
- Code review, SAST, DAST, fuzzing
- Security metrics, KPIs, KRIs and reporting
Need the theory first? Read the CISSP Domain 6 study guide.
Find out where you stand
Start with the free 10-question CISSP practice test — no signup. Then create a free account for Practice Mode, or go Pro for Domain Quick-Fire, CAT-style adaptive exams and readiness analytics.