Study. uk . com
  1. Home
  2. All questions
  3. Question 364

CISSP study material · question 364 of 500

An assessor asks whether a documented procedure or an individual employee can be an assessment object. What does SP 800-115 say?

  1. Only for interviewing; testing and examination apply to technology alone.
  2. Only where the procedure is implemented in software.
  3. Yes: an object may be a host, a system, a network, a procedure or a person.
  4. No: objects are limited to hosts, systems and networks.
Show the answer

Answer: C. Yes: an object may be a host, a system, a network, a procedure or a person.

SP 800-115 defines the assessment object as the entity being assessed, giving host, system, network, procedure and person as examples.

Source: NIST SP 800-115 (NIST) — SP 800-115 > Executive Summary

Challenge yourself on this topic → Study as cards