Study. uk . com
  1. Home
  2. All questions
  3. Question 377

CISSP study material · question 377 of 500

Which two benefits does SP 800-115 attribute to overt testing performed with the knowledge of the organisation's technology staff? Choose two.

  1. A realistic measure of how staff detect and respond to an unexpected attack.
  2. An assessment that requires no management approval, since staff are informed.
  3. A training opportunity, as staff observe how assessors evaluate and circumvent controls.
  4. A more comprehensive evaluation, since staff can be involved and can limit impact.
Show the answer

Answer: D. A more comprehensive evaluation, since staff can be involved and can limit impact.
C. A training opportunity, as staff observe how assessors evaluate and circumvent controls.

Overt testing allows fuller evaluation with staff limiting impact, and doubles as training. Measuring how staff detect an unexpected attack is the aim of covert testing.

Source: NIST SP 800-115 (NIST) — SP 800-115 > 2.4.2 Overt and Covert

Challenge yourself on this topic → Study as cards