Security Assessment and Testing: Scoping, Evidence, and Interpreting Results
What this domain tests
Domain 6 asks how you prove a control works. The exam distinguishes assessment types, tests whether you can read scanner and scoring output critically, and checks that you can design tests with valid scope, sampling, and authorization.
Core rules
- A vulnerability assessment enumerates and scores weaknesses; a penetration test chains exploitation to demonstrate business impact; an audit compares evidence to a defined standard. A clean scan is not proof of security, and a successful penetration test does not prove the absence of flaws.
- Credentialed scans see patch levels and configuration; uncredentialed scans see what an attacker sees. Neither replaces manual validation: triage false positives and false negatives before reporting.
- CVSS base metrics describe intrinsic severity. Temporal metrics reflect exploit maturity and remediation availability; environmental metrics adjust for the specific deployment. A 9.8 on an isolated lab host is not the same risk as a 7.5 on an internet-facing payment server.
- Coverage comes from sampling, log review, configuration review, code review, SAST, DAST, IAST, and fuzzing. Synthetic transactions and real-user monitoring validate availability and business flows.
- Continuity testing escalates: tabletop or read-through, walkthrough, simulation, parallel processing, and full interruption. Full interruption is the most disruptive and is used last, with management approval.
- Assurance reporting: SOC 1 covers financial reporting controls, SOC 2 covers trust services criteria, SOC 3 is a public seal. Type I is a point-in-time design opinion; Type II covers a period of operating effectiveness.
Worked example
An uncredentialed scan reports 200 critical findings on legacy servers. The right response is not to patch in report order. Validate a sample manually, re-scan with credentials to confirm versions, and combine asset criticality with known exploit availability. Internet-facing, exploitable findings are remediated first within a short defined window; internal legacy systems get documented compensating controls and time-bound risk acceptance. The reasoning: severity scoring feeds prioritization, but asset context and exploitability determine what is actually urgent.
Traps that cost marks
- Equating a CVSS score with business risk without environmental context.
- Citing a SOC 2 Type I report as evidence of effectiveness over a year.
- Running full interruption testing before lower-impact exercises.
- Scanning or testing production without written authorization and defined rules of engagement.