Study. uk . com
  1. Home
  2. All questions
  3. Question 393

CISSP study material · question 393 of 500

Which activities does SP 800-115 give as examples of non-technical assessment techniques? Choose two.

  1. Identifying assets from inventories and physical walkthroughs rather than by scanning.
  2. Running a credentialed vulnerability scan against every host.
  3. Attempting to circumvent locks and badge readers to reach specific hosts.
  4. Reviewing firewall rulesets against the organisation's internet usage policy.
Show the answer

Answer: C. Attempting to circumvent locks and badge readers to reach specific hosts.
A. Identifying assets from inventories and physical walkthroughs rather than by scanning.

SP 800-115 gives physical security testing, which tries to circumvent locks and badge readers, and manual asset identification from inventories and walkthroughs, as non-technical techniques.

Source: NIST SP 800-115 (NIST) — SP 800-115 > 2.2 Technical Assessment Techniques

Challenge yourself on this topic → Study as cards