CGRC · Question #434
Security Test and Evaluation (ST&E) is a component of risk assessment. It is useful in discovering system vulnerabilities. For what purposes is ST&E used? Each correct answer represents a complete…
The correct answer is B. To determine the adequacy of security mechanisms, assurances, and other properties to enforce C. To assess the degree of consistency between the system documentation and its implement ation D. To uncover design, implementation, and operational flaws that may allow the violation of security. Security Test and Evaluation (ST&E) is crucial for validating the effectiveness of security controls and identifying weaknesses. It determines control adequacy, assesses consistency with documentation, and uncovers flaws that could lead to security violations.
Question
Security Test and Evaluation (ST&E) is a component of risk assessment. It is useful in discovering system vulnerabilities. For what purposes is ST&E used? Each correct answer represents a complete solution. Choose all that apply. Response:
Options
- ATo implement the design of system architecture
- BTo determine the adequacy of security mechanisms, assurances, and other properties to enforce
- CTo assess the degree of consistency between the system documentation and its implement ation
- DTo uncover design, implementation, and operational flaws that may allow the violation of security
How the community answered
(46 responses)- A9% (4)
- B91% (42)
Why each option
Security Test and Evaluation (ST&E) is crucial for validating the effectiveness of security controls and identifying weaknesses. It determines control adequacy, assesses consistency with documentation, and uncovers flaws that could lead to security violations.
ST&E is an assessment and evaluation activity, not a design or implementation activity; it evaluates an existing design and implementation, rather than implementing the design itself.
ST&E helps determine if security mechanisms, assurances, and other properties of an information system are adequate to enforce the security policy and requirements.
ST&E verifies that the implemented system's security features and configurations are consistent with its documented design and security requirements.
ST&E actively seeks out and uncovers design, implementation, and operational flaws or vulnerabilities that could potentially be exploited to violate the system's security policy.
Concept tested: Purposes of Security Test and Evaluation (ST&E)
Source: https://csrc.nist.gov/publications/detail/sp/800-115/final
Topics
Community Discussion
No community discussion yet for this question.