1. Home
2. All questions
3. Question 394

CISSP study material · question 394 of 500

A manager suggests that a thorough testing programme can substitute for implementing several costly controls. How does SP 800-115 frame the purpose of testing and examination?

• Security assessment

1. They replace controls only for systems categorised below moderate impact.
2. They are an audit obligation with no bearing on the control set.
3. They replace continuous monitoring but not preventive controls.
4. They do not replace implementing and maintaining controls; they confirm systems are properly secured and surface unmet requirements.

Challenge yourself on this topic → Study as cards