Study. uk . com
  1. Home
  2. All questions
  3. Question 185

CISM study material · question 185 of 1000

A manager assumes every vulnerability results from an omission at build time. Which two origins does SP 800-30 identify? Choose two.

  1. A control that was never applied, or applied but left weak
  2. Deliberate insertion by the system owner
  3. Emergent weakness as missions, environments and technologies change
  4. Publication of the vulnerability by an outside researcher before the vendor has issued a fix for it
Show the answer

Answer: A. A control that was never applied, or applied but left weak
C. Emergent weakness as missions, environments and technologies change

SP 800-30 says most vulnerabilities can be associated with controls not applied or applied but retaining weakness, while also allowing for emergent vulnerabilities arising as missions, environments, technologies and threats evolve.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3.1 Risk Models — Vulnerabilities

Challenge yourself on this topic → Study as cards