Study. uk . com
  1. Home
  2. All questions
  3. Question 212

CISM study material · question 212 of 1000

SP 800-30 names three analysis orientations. Which set is correct?

  1. Strategic, tactical and operational, matching the three tiers of the risk model
  2. Inherent, residual and target
  3. Threat-oriented, asset or impact oriented, and vulnerability-oriented
  4. Qualitative, quantitative and semi-quantitative, which are the three ways of expressing a result
Show the answer

Answer: C. Threat-oriented, asset or impact oriented, and vulnerability-oriented

SP 800-30 names three analysis approaches — threat-oriented, asset or impact oriented, and vulnerability-oriented — which consider the same risk factors but differ in their starting point.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3.3 Analysis Approaches

Challenge yourself on this topic → Study as cards