nerdexam
(ISC)2

CGRC · Question #399

You have newly joined the assessment team that will be carrying out an independent, focused level of coverage, control assessment at Colvine Tech. What is a focused level of assessment? Response:

The correct answer is C. When the assessor assesses a representative sample but may also focus on assessing more. A focused assessment involves evaluating a representative sample of assessment objects while also allowing for deeper investigation into specific critical or high-risk areas.

Assessment/Audit of Security and Privacy Controls

Question

You have newly joined the assessment team that will be carrying out an independent, focused level of coverage, control assessment at Colvine Tech. What is a focused level of assessment? Response:

Options

  • AWhen the assessor assesses all the assessment objects in the system
  • BWhen the assessor assesses a representative sample of assessment objects
  • CWhen the assessor assesses a representative sample but may also focus on assessing more
  • DAll of the above

How the community answered

(35 responses)
  • A
    9% (3)
  • B
    3% (1)
  • C
    86% (30)
  • D
    3% (1)

Why each option

A focused assessment involves evaluating a representative sample of assessment objects while also allowing for deeper investigation into specific critical or high-risk areas.

AWhen the assessor assesses all the assessment objects in the system

Assessing all assessment objects describes a comprehensive or exhaustive assessment, not a focused one, as a focused assessment implies selectivity.

BWhen the assessor assesses a representative sample of assessment objects

Assessing only a representative sample is a standard sampling approach, but a 'focused' assessment implies an additional layer of targeted investigation beyond just sampling.

CWhen the assessor assesses a representative sample but may also focus on assessing moreCorrect

A focused level of assessment typically begins with assessing a representative sample of assessment objects to gain an overall understanding. However, it also allows the assessor to strategically focus on specific areas or objects that are deemed higher risk or more critical, leading to a deeper examination in those particular areas.

DAll of the above

This is incorrect because options A and B alone do not fully describe a 'focused' assessment as implied by the combination of sampling and targeted deep dives.

Concept tested: Focused control assessment scope

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar5.pdf

Topics

#Focused assessment#Assessment methodology#Control assessment#Sampling

Community Discussion

No community discussion yet for this question.

Full CGRC Practice