nerdexam
(ISC)2

CGRC · Question #282

A type of assessment method that is characterized by the process of conducting discussions with individuals or groups within an organization to facilitate understanding, achieve clarification, or…

The correct answer is A. Interview. Conducting discussions with individuals or groups to gather information, clarify understanding, or locate evidence about security control effectiveness is known as an interview.

Assessment/Audit of Security and Privacy Controls

Question

A type of assessment method that is characterized by the process of conducting discussions with individuals or groups within an organization to facilitate understanding, achieve clarification, or lead to the location of evidence, the results of which are used to support the determination of security control effectiveness over time. Response:

Options

  • AInterview
  • BFormative
  • CSummative
  • DInterim

How the community answered

(59 responses)
  • A
    93% (55)
  • B
    3% (2)
  • C
    2% (1)
  • D
    2% (1)

Why each option

Conducting discussions with individuals or groups to gather information, clarify understanding, or locate evidence about security control effectiveness is known as an interview.

AInterviewCorrect

An interview is a direct assessment method where an assessor engages in verbal communication with personnel to obtain information, verify facts, and gain insights into security practices and control implementation. This method explicitly involves discussions to facilitate understanding and clarify information, matching the description.

BFormative

Formative assessments are conducted during the development or implementation process to provide feedback for improvement, not primarily through discussions for evidence gathering.

CSummative

Summative assessments are conducted at the end of a process to evaluate overall effectiveness or achievement, not specifically through ongoing discussions.

DInterim

Interim refers to a temporary or provisional state or assessment, not a specific method characterized by discussions.

Concept tested: Security assessment methods - interview

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar5.pdf

Topics

#Assessment methods#Interviewing#Control effectiveness#Evidence collection

Community Discussion

No community discussion yet for this question.

Full CGRC Practice