Study. uk . com
  1. Home
  2. All questions
  3. Question 99

CISSP study material · question 99 of 500

An assessor is criticised for writing narratives that chain several events together instead of listing weaknesses individually. Why does NIST SP 800-30 favour the narrative form?

  1. Narratives are required by FISMA for systems categorised at high impact.
  2. Some vulnerabilities are only exposed once others have been exploited, so chains reveal more than single weaknesses.
  3. Chains allow likelihood to be expressed quantitatively where single weaknesses cannot.
  4. Narratives remove the need to record impact separately for each event.
Show the answer

Answer: B. Some vulnerabilities are only exposed once others have been exploited, so chains reveal more than single weaknesses.

A scenario orders events from one or more sources over time. Some weaknesses only become reachable after others fall, so chains reveal more than single items.

Source: NIST SP 800-30 Rev. 1 (NIST) — SP 800-30 Rev. 1 > 2.3.1 footnote 24

Challenge yourself on this topic → Study as cards