Minimum security controls can only be determined after___________.

The correct answer is B. The aggregate CIA score has been computed. You must compute the CIA (Confidentiality. Integrity, and Availability) requirements of the system before you can determine the required minimum controls. Answer option D is incorrect. A vulnerability assessment is a good practice, but is not necessary to determine minimal…

Research and Analysis

Question

Options

AA penetration test.
BThe aggregate CIA score has been computed.
CSystem security policies are put in place.
DA vulnerability assessment.

How the community answered

(44 responses)

A
14% (6)
B
75% (33)
C
7% (3)
D
5% (2)

Explanation

You must compute the CIA (Confidentiality. Integrity, and Availability) requirements of the system before you can determine the required minimum controls. Answer option D is incorrect. A vulnerability assessment is a good practice, but is not necessary to determine minimal security controls. Answer option A is incorrect. A penetration test is a good practice, but is not necessary to determine minimal security controls. Answer option C is incorrect. The system security policies should be developed after the CIA score has been computed.

Topics

#CIA triad#security baseline#aggregate scoring#minimum security controls

Community Discussion

No community discussion yet for this question.

Full CAS-002 Practice