Study. uk . com
  1. Home
  2. All questions
  3. Question 363

CISSP study material · question 363 of 500

An assessment plan proposes only automated scanning. Which three assessment methods does SP 800-115 recognise, and what distinguishes them? Choose three.

  1. Examination, which checks, inspects, reviews or analyses objects to obtain evidence.
  2. Interviewing, which holds discussions with people to gain understanding or locate evidence.
  3. Auditing, which certifies conformance against an external standard.
  4. Testing, which exercises objects under specified conditions and compares actual with expected behaviour.
Show the answer

Answer: A. Examination, which checks, inspects, reviews or analyses objects to obtain evidence.
B. Interviewing, which holds discussions with people to gain understanding or locate evidence.
D. Testing, which exercises objects under specified conditions and compares actual with expected behaviour.

SP 800-115 names testing, examination and interviewing as the three assessment methods; certification against an external standard is not among them.

Source: NIST SP 800-115 (NIST) — SP 800-115 > Executive Summary

Challenge yourself on this topic → Study as cards