Back to Domain 5 · Identity & Access Management

CISSP Mastery

CISSP Mastery · Module 6 / 8

Domain 6: Security Assessment & Testing

Trust, but verify: Mastering vulnerability management, audits, and security assessments.

Your progress

Domain 6 of 8 75%

Module 6

12%

Exam weight

CVSS

Prioritize

6 / 8

Domain focus

PDCA

Continuous test

Open preview · Domain overview

Why Domain 6 is where policy meets evidence

Assessments produce signal; audits produce attestation; penetration tests simulate adversaries. Domain 6 trains you to pick the right instrument, run a defensible vulnerability lifecycle, and translate technical risk into decisions executives can fund.

Domain 6 is where assurance becomes evidence: assessments widen visibility, audits prove control design and operation, and penetration tests stress realism. Pair it with Domain 5 (who gets access) and Domain 7 (how incidents are run) for a complete operational story.

Three different lenses

Assessment = breadth and posture. Audit = criteria and evidence. Pen test = depth and exploitation under rules of engagement.
Vulnerability management is a loop

Identify, analyze, prioritize, remediate, verify — skip verification and you only moved the risk to next quarter.
Testing depth is a dial

Black, gray, and white-box trade attacker realism for source visibility — the exam loves scenario fit, not buzzwords.
Reporting closes the sale

A perfect finding without a business narrative does not get patched. Learn the executive storyline: impact, likelihood, cost of delay.

Module 1 · Assessment frameworks

Assessments, audits & penetration testing — same discipline, different contracts

If you blur these three on the exam, you will pick the wrong answer. Anchor on objective (find weaknesses vs prove compliance vs emulate attacker) and evidence style (findings vs criteria mapping vs exploit chain).

Security assessment

Structured evaluation of controls, architecture, and posture — vulnerability scans, configuration review, gap analysis. Goal: breadth and prioritized remediation backlog, not necessarily exploitation.
Formal audit

Evidence collection against a defined criteria set (ISO 27001, SOC 2, internal policy). Independence and sampling matter; output is attestation / opinion, not a list of shells.
Penetration testing

Authorized simulation of adversary tactics under RoE — validates exploitability and lateral paths. Depth over coverage; still needs safe reporting and fix verification.

SOC 2 attestation — Type I vs Type II

Report	What it attests	Time scope	Exam cue
SOC 2 Type I	Control design is suitably described	Point in time	Design only — no operating effectiveness period
SOC 2 Type II	Controls operated effectively over an observation period	Typically 6–12 months	Preferred vendor evidence — design + effectiveness

Module 1b · Exercise taxonomy

Pen test vs red team vs purple team vs tabletop

These names blur easily on the exam. Anchor on objective (find vulns vs emulate adversary vs improve detection vs validate plans), defender awareness, and collaboration model.

Penetration test

Scoped, cooperative simulation under RoE — finds exploitable weaknesses and validates fix paths. Blue team is usually informed.
Red team exercise

Objective-based adversary emulation (e.g., reach crown-jewel DB). Defenders often uninformed — tests detection and response realism, not just shells found.
Purple team exercise

Offense and defense collaborate in real time — attack techniques shared as executed so detection gaps close immediately. Trades blind realism for rapid improvement.
Tabletop exercise

Discussion-based walkthrough with stakeholders — validates plans, roles, and decision trees without touching production systems. Common for BCP/IR readiness.

Module 2 · Vulnerability management

The lifecycle: identify, analyze, prioritize, remediate — then prove it

Modern programs treat vulnerabilities like incidents-in-waiting: SLAs, exception governance, and metrics that leadership can read. The fifth step verify closes the loop so regressions do not reopen silently.

Identification

Asset inventory, authenticated scanning, bug bounty intakes, threat intel feeds, and misconfiguration checks. You cannot patch what you do not see.
Analysis

Validate true positives, reproduce, map to CWE/CVE, understand blast radius and compensating controls. Noise reduction is a security function.
Prioritization

Blend CVSS / EPSS with business context: internet exposure, data classification, exploit maturity, and compensating detective controls.
Remediation

Patch, re-architect, segment, or accept with documented risk owner and expiry. Track SLAs by severity tier — not by whoever shouts loudest.

The diagram below compresses the operational rhythm into a single rotating loop — the same cadence SOC and engineering teams defend in production.

Premium diagram

Security testing loop

Scan → analyze → prioritize → remediate → verify. Hover, tap, or Tab each step for vuln-program detail and exam cues; the dashed orbit still animates unless reduced motion is enabled.

Continuous loop

Loop

Hover, tap, or Tab on a step for vuln-program focus and an exam cue.

Each pass tightens signal: scan widens visibility, prioritize aligns CVSS with business context, verify proves the fix held — use the panel for exam-ready wording.

Module 3 · Testing techniques

Black-box, white-box & gray-box — choose depth deliberately

Exam vignettes describe what the tester knows. Map that sentence to the box color: zero internal knowledge → black. Full transparency → white. Partial hints → gray.

Black-box testing

No internal knowledge of implementation — mirrors an external attacker. Strong for realism; may miss logic flaws only visible with design knowledge.
White-box testing

Full source and architecture visibility — SAST, code review, threat modeling support. Finds deep defects; can drift away from realistic exploit paths without discipline.
Gray-box testing

Limited insider context (accounts, diagrams, partial code) — balances speed and realism. Common in agile release gates and targeted pen-test scopes.

Module 4 · Reporting & documentation

The business case for technical risk

CISSP expects you to speak boardroom and server room. A strong report converts CVSS + exploitability into dollars, downtime, and defensibility — then assigns accountability.

Executive storyline

Lead with business impact and likelihood — not CVE numbers. Tie each risk to revenue, regulatory exposure, or recovery time objectives.
Evidence without overwhelm

Appendix holds packet captures and command output; the main body carries screenshots, affected systems, and clear reproduction steps a non-specialist can follow.
Actionable recommendations

Every finding ends with owner, due date, and verification method. "Consider improving security" is not a recommendation — it is wallpaper.

Exam-grade takeaways

CISSP Exam Pro-Tip — CVSS vs business context

A “critical” CVSS on an internal system with no route from the Internet, strong detective controls, and no sensitive data may lose to a “medium” on your customer-facing payment tier. The exam rewards risk-based prioritization, not score worship. When two answers cite different CVSS numbers, ask: exposure, asset value, compensating controls, and exploit maturity — then pick the scenario that matches the narrative.

Exam cue

Patch Tuesday vs continuous loop

Monthly cadences still exist, but the defensible answer is usually continuous identification + prioritized remediation + verification aligned to change windows — not a single annual scan checkbox.

Exam cue

Red team vs purple team

Red team keeps defenders blind to test realistic detection. Purple team pairs offense and defense in real time to close gaps faster — less realism, more immediate improvement.

Quick check

Domain 6 quiz

One question at a time — instant feedback. Pair it with the diagrams and Pro-Tip callouts above.

Quiz progress

Question 1 of 5 · 20%

Q 1

Question 1 of 5

1.SOC 2 Type I differs from SOC 2 Type II mainly because Type II:

Ready for Domain 7?

Module 6 frames assessment, testing, and vulnerability management as one continuous loop — not a checkbox exercise. Proceed to Domain 7 when you are ready. All eight domain guides remain free; save the Final Mock Exam for your capstone run.

Back to Domain 5 · Identity & Access Management Final Mock Exam Continue · Domain 7 · Security Operations