Study. uk . com
  1. Home
  2. All questions
  3. Question 741

CISM study material · question 741 of 1000

Why does the Community Profile recommend maintaining representations of authorised network data flows?

  1. Because it is a prerequisite for the network segmentation work that follows it, which cannot be designed at all without it in place
  2. Because it establishes the authorisation boundary within which the system's own selected controls are actually able to apply at all
  3. Because knowing what normal traffic looks like improves the accuracy of detecting malicious data flows and communication
  4. Because the regulators require a current network diagram to be held on file and to be produced by the organisation on any request that is made of it
Show the answer

Answer: C. Because knowing what normal traffic looks like improves the accuracy of detecting malicious data flows and communication

SP 800-61r3 says holding a picture of authorised flows sharpens detection of malicious traffic and communication, and suggests automation and zero trust architectures to build and keep that picture.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 2 ID.AM-03

Challenge yourself on this topic → Study as cards