Domain 6 covers how organizations verify their controls actually work: audit strategies, vulnerability assessments, penetration testing, log review, and control assessment methodologies. At 12% weight, it's a mid-sized domain where the exam leans heavily on precisely distinguishing testing methodologies that sound similar but represent very different levels of assurance and intrusiveness.
Vulnerability assessment vs. penetration test
A vulnerability assessment identifies and catalogs weaknesses (breadth). A penetration test actively attempts to exploit them to demonstrate real-world impact (depth). Pen tests are a subset of what a full assessment might include, not a replacement for one.
Testing knowledge levels
Black box (no internal knowledge), white box (full internal knowledge, e.g., source code and network diagrams), and gray box (partial knowledge): know these map to how "realistic vs. thorough" a given test needs to be.
Static vs. dynamic application testing (SAST/DAST)
SAST analyzes source code without executing it (finds issues early, before compilation). DAST tests a running application from the outside, black-box style (finds issues that only manifest at runtime).
Audit types
Internal audits (self-assessment), external audits (independent third party, e.g., for SOC 2), and third-party/regulatory audits (compliance-driven, e.g., PCI DSS assessments) each carry different independence and assurance implications.
Key Performance Indicators vs. Key Risk Indicators
KPIs measure how well a process is performing against its goals; KRIs are leading indicators that signal rising risk before it becomes an actual incident.
SAST vs. DAST
SAST is "white box," examining code before runtime and catching issues like SQL injection patterns in source. DAST is "black box," examining the running application and catching issues that only appear during execution, like misconfigurations exposed at runtime.
SOC 1 vs. SOC 2
SOC 1 covers controls relevant to a client's financial reporting. SOC 2 covers controls relevant to security, availability, processing integrity, confidentiality, and privacy: the one most relevant to a typical vendor security review.
Practice D6 questions with instant feedback, free to start, no card required.
Start Free