Study. uk . com
  1. Home
  2. All questions
  3. Question 675

CISM study material · question 675 of 1000

NIST describes a simulated phishing test as an example of which data collection method?

  1. Benchmarking, since results are compared against peers
  2. Experimentation, since messages are sent and the response rate judged against set criteria
  3. Sampling, since only a subset of users receives the message
  4. Observation, since the users' behaviour is watched without any direct involvement from the tester at all
Show the answer

Answer: B. Experimentation, since messages are sent and the response rate judged against set criteria

SP 800-55v1 gives a phishing test as a recognisable use of experimentation to collect security data, describing it as internal security testing where fake emails determine which users respond, with rates judged against set criteria.

Source: NIST SP 800-55 Vol. 1 (NIST) — Sec. 2.1 Measurement and Quantitative Assessment

Challenge yourself on this topic → Study as cards