7. Domain 6 — Security Assessment and Testing (12%)

Security controls are only valuable if they work. Domain 6 closes the feedback loop: assessment and testing verify that controls actually perform as intended, identify gaps before attackers do, and produce evidence for management, auditors, and regulators. Without this feedback loop, the security program operates on assumption rather than evidence.

At 12% weight, Domain 6 spans from highly technical (penetration testing, vulnerability assessment) to process-oriented (audit, metrics, software testing). The common thread is verification — every activity produces evidence about the current security posture that feeds back into the risk management and governance cycles.

⚠️ Domain Trap: Domain 6 questions test what each assessment type finds and what it does not. A vulnerability scan finds known CVEs — not business logic flaws. A penetration test finds exploitable chains — not comprehensive vulnerability coverage. An audit finds compliance gaps — not zero-day vulnerabilities. Each has a specific scope and output; choosing the wrong tool for the objective is a common exam distractor.