OFFICIAL (ISC)² CISSP - DOMAIN 6: SECURITY
ASSESSMENT AND TESTING EXAM QUESTIONS WITH
COMPLETE SOLUTIONS VERIFIED 2024
Attack surface
Different security testing methods find different vulnerability types.
Black-box testing
Testing where no internal details of the system implementation are used.
Condition coverage
This criteria requires sufficient test cases for each condition in a program decision to
take on all possible outcomes at least once. It differs from branch coverage only when
multiple conditions must be evaluated to reach a decision.
Covert security testing
Performed to simulate the threats that are associated with external adversaries. While
the security staff has no knowledge of the covert test, the organization management is
fully aware and consents to the test.
Data flow coverage
This criteria requires sufficient test cases for each feasible data flow to be executed at
least once.
Decision (Branch) coverage
Considered to be a minimum level of coverage for most software products, but decision
coverage alone is insufficient for high-integrity applications.
Dynamic testing
When the system under test is executed and its behavior is observed.
Loop coverage
This criteria requires sufficient test cases for all program loops to be executed for zero,
one, two, and many iterations covering initialization, typical running, and termination
(boundary) conditions.
ASSESSMENT AND TESTING EXAM QUESTIONS WITH
COMPLETE SOLUTIONS VERIFIED 2024
Attack surface
Different security testing methods find different vulnerability types.
Black-box testing
Testing where no internal details of the system implementation are used.
Condition coverage
This criteria requires sufficient test cases for each condition in a program decision to
take on all possible outcomes at least once. It differs from branch coverage only when
multiple conditions must be evaluated to reach a decision.
Covert security testing
Performed to simulate the threats that are associated with external adversaries. While
the security staff has no knowledge of the covert test, the organization management is
fully aware and consents to the test.
Data flow coverage
This criteria requires sufficient test cases for each feasible data flow to be executed at
least once.
Decision (Branch) coverage
Considered to be a minimum level of coverage for most software products, but decision
coverage alone is insufficient for high-integrity applications.
Dynamic testing
When the system under test is executed and its behavior is observed.
Loop coverage
This criteria requires sufficient test cases for all program loops to be executed for zero,
one, two, and many iterations covering initialization, typical running, and termination
(boundary) conditions.
