CISSP cheat sheet · Domain 6 · 12% of exam
Security Assessment and Testing
Proving that controls work: assessment strategy, vulnerability scanning and penetration testing, code testing, audits and SOC reports, and the metrics that tell management the truth.
Rule cards
| Audit vs review | Audit = formal, independent, against documented standards, reports deviations · Review = informal check. Formal comparison to a standard → audit. |
|---|---|
| SOC reports | SOC 1 = financial reporting controls · SOC 2 = security/availability/etc. (customers, under NDA) · SOC 3 = public summary · Type I = design at a point in time · Type II = operating effectiveness over a period (stronger). |
| Pen tests | White box (full knowledge) · gray · black box (none) · blind / double-blind · ALWAYS written authorisation and rules of engagement first · scan finds, pen test exploits. |
| Pen test phases | Planning → Discovery (recon, scanning) → Attack (exploit, escalate) → Reporting. |
| Application testing | SAST = source code · DAST = running app, no code · IAST = agent inside the running app · RASP = protects (not a test) · SCA = third-party libraries · fuzzing = random/malformed input · regression = old features still work. |
| V&V | Verification = built right (to spec) · Validation = right product (meets user needs, UAT). |
| Monitoring | Synthetic transactions = scripted fake users (proactive) · RUM = real users (passive) · NTP for log correlation · BAS = continuous automated attack simulation. |
| Metrics | KPI = performance now · KRI = early warning · report to management in business terms. |
| DR test types | Read-through / checklist → walkthrough / tabletop → simulation → parallel (alongside production) → full interruption (riskiest; needs senior approval). |
| Vulnerability scoring | CVE = the ID · CVSS = severity score · prioritise by severity + exploitability + asset value. |
Hard words made simple
| Term | Simple meaning | Example / analogy | Exam hook |
|---|---|---|---|
| Synthetic transaction | Scripted fake user actions on a schedule | A bot logs in and buys every 5 min | “simulate users” → synthetic |
| RUM | Real User Monitoring: watch real visitors | Page-load times from real customers | Passive |
| Fuzzing | Throw random/malformed input to crash the program | Huge strange strings in a form | Finds unexpected behaviour |
| Regression testing | Re-test old features after a change | Re-run tests after a patch | “still works after change” |
| Misuse case | Test how an attacker could abuse a feature | Negative quantity at checkout | Abuse scenarios |
| Code coverage | % of code exercised by tests | 80% of lines executed | Test completeness |
| Interface testing | Test connections between components | Front end ↔ API | Integration points |
| IAST vs RASP | Agent inside the app for testing vs for protecting | — | Read the verb: test or protect |
| Attestation | Formal statement by an auditor | SOC 2 report | Third-party assurance |
| BAS | Breach & Attack Simulation tools | ATT&CK techniques replayed nightly | Continuous control validation |