Study. uk . com
  1. Home
  2. All questions
  3. Question 178

CISM study material · question 178 of 1000

A provisioning server goes offline and the team assumes an attack. Which point does SP 800-30 make about attributing a threat event to a single cause?

  1. Threat events caused by error are excluded from risk assessment
  2. Multiple threat sources can cause the same threat event — an attack, a malicious administrator, an error, a hardware fault or a power failure
  3. Attribution must be settled before the event can be recorded
  4. Each threat event has exactly one possible threat source
Show the answer

Answer: B. Multiple threat sources can cause the same threat event — an attack, a malicious administrator, an error, a hardware fault or a power failure

SP 800-30 gives exactly this case: one provisioning server taken offline by denial of service, by a malicious administrator, by simple error, by failed hardware, or by lost power. One event, many possible sources.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3.1 Risk Models — Threats

Challenge yourself on this topic → Study as cards