CISSP Resources · Domain 6 — 12% of the exam
CISSP Domain 6 Guide: Security Assessment and Testing
Domain 6 is 12% of the exam and the most commonly under-studied. It is about proving that controls work — who tests, how independently, and what management does with the result.
What Domain 6 covers
- Designing assessment, test, and audit strategies
- Vulnerability assessment and penetration testing
- Code review, static and dynamic testing, fuzzing
- Log review, synthetic transactions, and misuse case testing
- Account management reviews and control effectiveness
- Security metrics, KPIs and KRIs, and management reporting
- Internal, external and third-party audits
Assessment vs testing vs audit
| Activity | Question it answers | Who performs it |
|---|---|---|
| Test | Does this control operate as designed? | Operational team |
| Assessment | Are our controls appropriate to the risk? | Security team or consultant |
| Audit | Can an independent party attest to this? | Independent auditor |
Independence is the differentiator. If a question stresses objectivity, regulator confidence, or attestation, the answer is an independent or third-party audit — not a self-assessment.
Testing techniques
- Vulnerability scan — broad, automated, finds known weaknesses. Produces false positives.
- Penetration test — narrow, goal-driven, demonstrates exploitability. Requires written authorisation and defined rules of engagement.
- SAST — static analysis of source; finds issues early, higher false positives.
- DAST — dynamic testing of a running application; finds runtime and configuration issues.
- Fuzzing — malformed input to find input-handling failures.
- Synthetic transactions — scripted checks confirming availability and behaviour.
- Misuse case testing — testing what an attacker would try, not what a user should do.
Written authorisation and an agreed scope. The correct FIRST answer in a pen-test scenario is almost never technical.
Penetration testing knowledge levels
| Type | Tester knowledge | Simulates |
|---|---|---|
| Black box / zero knowledge | None | External attacker |
| Grey box / partial | Some internal detail | Compromised user or contractor |
| White box / full | Full documentation and source | Efficient, thorough review |
Metrics that management can act on
- A metric no one makes a decision from is noise. Report on trend, exposure, and time-to-remediate.
- KPIs measure performance already achieved; KRIs give forward warning of rising risk.
- Report to the level of the audience — boards want risk and cost, not scanner counts.
Study checklist
- Distinguish test, assessment and audit, and identify who must be independent.
- Match each technique to what it can and cannot find.
- State the prerequisites for a penetration test.
- Explain the difference between a KPI and a KRI with an example of each.
Frequently asked questions
What is the difference between a vulnerability scan and a penetration test?
A scan identifies known weaknesses broadly and automatically. A penetration test attempts to exploit them to prove real-world impact, within an authorised scope.
Why does the CISSP stress auditor independence?
Because an assessment performed by the team that owns the control cannot provide objective assurance to management or regulators.
Cover the domain most candidates skip
Domain 6 is small enough to master quickly and often decides borderline results. Drill it deliberately rather than leaving it to random practice.
Related guides
- Domain 7: Security OperationsInvestigations, incident response, monitoring, recovery and disaster recovery.
- Domain 8: Software Development SecuritySDLC models, secure coding, testing, third-party risk and database security.
- Data Owner vs Data ControllerWho classifies, who implements, who is legally accountable — the four roles the exam confuses on purpose.
- CISSP Study GuideWhat to study, in what order, with a realistic week-by-week schedule across all eight domains.
More CISSP study material from Domain Eight: browse all resources.