Study. uk . com
  1. Home
  2. All questions
  3. Question 379

CISSP study material · question 379 of 500

During a covert test the organisation's operations team detects unusual activity. What arrangement does SP 800-115 describe to keep that from escalating into a real incident response?

  1. The technology staff are told in advance which addresses to ignore.
  2. Management publishes the test window to all staff at the outset.
  3. A trusted third party mediates, so the organisation verifies whether the activity is the test before responding.
  4. The assessors halt the test as soon as they are detected.
Show the answer

Answer: C. A trusted third party mediates, so the organisation verifies whether the activity is the test before responding.

Some organisations designate a trusted third party to ensure the target does not initiate response measures without first verifying that the activity does not originate from the test.

Source: NIST SP 800-115 (NIST) — SP 800-115 > 2.4.2 Overt and Covert

Challenge yourself on this topic → Study as cards