Study. uk . com
  1. Home
  2. All questions
  3. Question 294

CISM study material · question 294 of 1000

An organisation relies wholly on automated scanning to find weaknesses. Which limitation does IR 8286 note?

  1. Automated techniques are prohibited during a formal assessment of the production estate
  2. Automated techniques cannot be run on production systems
  3. Automated techniques may be insufficient to fully address targeted attacks
  4. Automated techniques cannot detect missing patches
Show the answer

Answer: C. Automated techniques may be insufficient to fully address targeted attacks

IR 8286 says weaknesses such as software flaws, missing patches, misconfigurations and malware can be identified using automated scanners, while noting these techniques may be insufficient to fully address targeted attacks.

Source: NIST IR 8286 (NIST) — Sec. 3.2.3 Determination of Exploitable Conditions

Challenge yourself on this topic → Study as cards