Proving that controls work: assessment strategy, vulnerability scanning and penetration testing, code testing, audits and SOC reports, and the metrics that tell management the truth.
Audit = formal, independent, against documented standards, reports deviations · Review = informal check. Formal comparison to a standard → audit.
SOC reports
SOC 1 = financial reporting controls · SOC 2 = security/availability/etc. (customers, under NDA) · SOC 3 = public summary · Type I = design at a point in time · Type II = operating effectiveness over a period (stronger).
Pen tests
White box (full knowledge) · gray · black box (none) · blind / double-blind · ALWAYS written authorisation and rules of engagement first · scan finds, pen test exploits.
Try each question before opening the answer. The full bank has many more Domain 6 questions with filters and progress tracking.
Question 1 · FIRST
A CISO wants to start an internal audit programme for security controls. What should be established FIRST?
The list of tools auditors will use to scan systems
The schedule of surprise audits for each department
The audit charter, scope and the standards the controls will be audited against
The disciplinary process for control owners who fail audits
Show answer & explanation
Answer: C — The audit charter, scope and the standards the controls will be audited against
Audits measure against defined criteria under a mandate. Without a charter (authority, independence) and agreed standards there is nothing to audit against; tools, schedules and consequences come later.
Question 2 · NEXT
A vulnerability scan has just reported a critical finding on a database server. What should the team do NEXT?
Close the finding because the server is internal
Validate the finding to rule out a false positive and confirm exposure
Patch the server immediately during business hours
Report the vulnerability to the regulator
Show answer & explanation
Answer: B — Validate the finding to rule out a false positive and confirm exposure
Vulnerability management flow: detect → validate → prioritise → remediate → verify. Patching without validation and change control risks outages; regulators are not notified of unexploited findings; internal does not mean safe.
Question 3 · LEAST
Which test type is LEAST likely to find a SQL injection flaw in custom web application code?
Dynamic application security testing of the running site
Manual code review by a trained security reviewer
Static application security testing of the source code
User acceptance testing by business users
Show answer & explanation
Answer: D — User acceptance testing by business users
UAT checks that the application meets business needs using normal inputs. SAST, DAST and security-focused code review are designed to find injection flaws.
Question 4 · NOT
Which of the following is NOT a characteristic of a SOC 2 Type II report?
It is intended for unrestricted public distribution
It tests the operating effectiveness of controls
It addresses trust services criteria such as security and availability
It covers controls over a period of time
Show answer & explanation
Answer: A — It is intended for unrestricted public distribution
SOC 2 reports are restricted-use (shared with customers, usually under NDA). The public, general-use summary is SOC 3. Type II covers effectiveness over a period against the trust services criteria.
Question 5 · BEST
A company wants AUTOMATED, continuous validation that its security controls actually detect and block realistic attack techniques. Which solution fits BEST?
A vulnerability scanner
An annual manual penetration test
A tabletop exercise
Breach and attack simulation (BAS)
Show answer & explanation
Answer: D — Breach and attack simulation (BAS)
✅ BAS continuously simulates real attack techniques (e.g. MITRE ATT&CK) to test controls. ❌ Annual pen test: point-in-time and manual. ❌ Vulnerability scanner: finds weaknesses, doesn't test detection. ❌ Tabletop: discussion only.
Question 6 · PRIMARY
Following a comprehensive security assessment, a lead auditor prepares the final deliverable for the client. What is the PRIMARY purpose of this security assessment report?
To replace the need for ongoing monitoring
To blame the IT team for vulnerabilities
To satisfy regulatory requirements only
To document findings and provide remediation recommendations
Show answer & explanation
Answer: D — To document findings and provide remediation recommendations
The primary purpose is to document findings, assess risk levels, and provide actionable remediation recommendations to improve the organization's security posture. This choice is correct because it directly satisfies the primary security objective. The alternative options are incorrect because they either represent incomplete secondary steps, incorrect terminology, or inappropriate control measures for this specific scenario.
Question 7 · MOST
An organization performs a business impact analysis. This is MOST closely related to which security assessment activity?
Penetration testing
Risk assessment
Code review
Vulnerability scanning
Show answer & explanation
Answer: B — Risk assessment
A BIA identifies critical business functions and the impact of disruption, which is a key component of risk assessment that helps prioritize security efforts. This choice is correct because it directly satisfies the primary security objective. The alternative options are incorrect because they either represent incomplete secondary steps, incorrect terminology, or inappropriate control measures for this specific scenario.
Question 8
A DevSecOps engineer is configuring automated security testing within a continuous integration pipeline. Which of the following is a key operational characteristic of static application security testing (SAST)?
It tests the application while it is running
It analyzes source code without executing the program
It simulates real-world attacks
It requires a fully deployed application
Show answer & explanation
Answer: B — It analyzes source code without executing the program
SAST analyzes source code, bytecode, or binary code without executing the application, identifying potential vulnerabilities through code pattern analysis. This choice is correct because it directly satisfies the primary security objective. The alternative options are incorrect because they either represent incomplete secondary steps, incorrect terminology, or inappropriate control measures for this specific scenario.
Question 9 · FIRST
An organization wants to identify vulnerabilities in its network before an attacker does. Which of the following is the MOST appropriate FIRST step?
Perform a vulnerability assessment
Review firewall logs
Implement an intrusion detection system
Conduct a penetration test
Show answer & explanation
Answer: A — Perform a vulnerability assessment
A vulnerability assessment is the appropriate first step to identify known vulnerabilities systematically before moving to more invasive testing like penetration testing. This choice is correct because it directly satisfies the primary security objective. The alternative options are incorrect because they either represent incomplete secondary steps, incorrect terminology, or inappropriate control measures for this specific scenario.
Question 10 · NEXT
A penetration testing firm has signed the contract and agreed the scope and rules of engagement with management. What is the NEXT phase?
Discovery and reconnaissance of the in-scope systems
Writing the final report for management
Exploitation of identified vulnerabilities
Remediation of the vulnerabilities found
Show answer & explanation
Answer: A — Discovery and reconnaissance of the in-scope systems
Pen test phases: planning (authorisation, scope, rules of engagement) → discovery → attack → reporting. Remediation is the client's job after the report.
Ready for the full bank?
2,000+ explained questions, timed mocks and a CAT simulator that behaves like the real exam.
