Study. uk . com
  1. Home
  2. All questions
  3. Question 365

CISM study material · question 365 of 1000

An estate has tens of thousands of individual vulnerabilities and cataloguing each would exhaust the assessment budget. Which approach does SP 800-30 permit?

  1. Assessing only those vulnerabilities the scanner has rated as critical, since those are the ones an adversary would reach for first
  2. Characterising the general nature, scope and type of vulnerabilities and mapping only the relevant ones to threat events
  3. Deferring vulnerability analysis to the next annual cycle, when the budget will carry the full catalogue of the scanner's findings
  4. Excluding vulnerability analysis from the assessment
Show the answer

Answer: B. Characterising the general nature, scope and type of vulnerabilities and mapping only the relevant ones to threat events

SP 800-30 gives organisations the option of using the identification task to understand the general nature of vulnerabilities including scope, number and type, cataloguing specific ones only as necessary, and determining which are relevant to which threat events.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 2-3 Identify Vulnerabilities

Challenge yourself on this topic → Study as cards