Study. uk . com
  1. Home
  2. All questions
  3. Question 378

CISSP study material · question 378 of 500

A team plans covert testing and asks whose approval is required. What does SP 800-115 specify?

  1. It proceeds without the technology staff's knowledge but with senior management's full knowledge and permission.
  2. It proceeds with no approval at all, since any approval would compromise realism.
  3. It requires approval from an external regulator before proceeding.
  4. It requires approval from the technology staff's line manager only.
Show the answer

Answer: A. It proceeds without the technology staff's knowledge but with senior management's full knowledge and permission.

Covert testing takes an adversarial approach, performed without the knowledge of the organisation's technology staff but with the full knowledge and permission of upper management.

Source: NIST SP 800-115 (NIST) — SP 800-115 > 2.4.2 Overt and Covert

Challenge yourself on this topic → Study as cards