Study. uk . com
  1. Home
  2. All questions
  3. Question 373

CISSP study material · question 373 of 500

An organisation replaces its document and configuration reviews with an expanded programme of technical testing. Which weakness does SP 800-115 say it will now miss?

  1. Weaknesses in externally facing services, which only examinations reveal.
  2. Weaknesses related to security policy and configuration, which testing is less likely to identify.
  3. Weaknesses caused by missing patches, which testing cannot detect.
  4. Weaknesses in physical access controls, which testing cannot reach.
Show the answer

Answer: B. Weaknesses related to security policy and configuration, which testing is less likely to identify.

SP 800-115 states testing is less likely than examination to identify weaknesses related to security policy and configuration, and that combining the two gives a more accurate view.

Source: NIST SP 800-115 (NIST) — SP 800-115 > 2.3 Comparing Tests and Examinations

Challenge yourself on this topic → Study as cards