CISSP GLOSSARY · SECURITY OPERATIONS

Synthetic transactions

Scripted, pre-built transactions run against live systems to verify functionality, availability, and response times proactively, catching failures before real users hit them.

Synthetic transactions are scripted, pre-built actions run against live systems to verify behaviour, availability, and performance without waiting for a real user. A monitoring tool logs in, searches, adds an item to a basket, or calls an API on a schedule, then compares the response and its timing against expected results. Because the transactions are artificial, they can exercise critical paths continuously, including at three in the morning when no genuine traffic would reveal an outage.

The distinction that matters is proactive versus passive. Synthetic monitoring detects failures and degradation before users experience them, while real user monitoring passively measures the sessions of actual visitors and can only report problems users have already hit. Synthetic results are also consistent and comparable over time, which is why they underpin service level reporting. The technique verifies expected behaviour; it does not probe for forbidden behaviour, which is the province of misuse case testing.

Exam relevance: if a scenario mentions scripted transactions, proactively verifying a service before users complain, or measuring performance against an SLA, the answer is synthetic transactions. If the scenario measures the experience of actual visitors from their own browsers, the answer is real user monitoring. Do not confuse synthetic transactions with replayed attack traffic either: a replay attack maliciously reuses captured legitimate traffic, whereas synthetic transactions are authorised scripts run by the operations team itself.