Study. uk . com
  1. Home
  2. All questions
  3. Question 371

CISSP study material · question 371 of 500

A team assumes examinations never affect the environment. Which exception does SP 800-115 identify, and why?

  1. Network sniffing, because connecting to a tap or span port may require reconfiguring a network device and disrupt operations.
  2. File integrity checking, because it rewrites file metadata as it hashes.
  3. Log review, because retrieving logs consumes the device's storage.
  4. Ruleset review, because reading the ruleset locks the configuration.
Show the answer

Answer: A. Network sniffing, because connecting to a tap or span port may require reconfiguring a network device and disrupt operations.

SP 800-115 notes examinations typically have no impact aside from accessing documentation, with network sniffing the passive technique that can affect networks because connection may require reconfiguring a device.

Source: NIST SP 800-115 (NIST) — SP 800-115 > 2.3 Comparing Tests and Examinations

Challenge yourself on this topic → Study as cards