CGRC · Question #689
Which of the following assessment methods is used to review, inspect, and analyze assessment objects? Response:
The correct answer is B. Examination. Examination is an assessment method that involves reviewing, inspecting, and analyzing assessment objects, such as documentation, system configurations, and logs, to determine if security controls are implemented correctly.
Question
Which of the following assessment methods is used to review, inspect, and analyze assessment objects? Response:
Options
- ATesting
- BExamination
- CInterview
- DDebugging
How the community answered
(32 responses)- A3% (1)
- B88% (28)
- C3% (1)
- D6% (2)
Why each option
Examination is an assessment method that involves reviewing, inspecting, and analyzing assessment objects, such as documentation, system configurations, and logs, to determine if security controls are implemented correctly.
Testing is an assessment method that involves exercising system components or processes under specific conditions to observe their behavior and evaluate the effectiveness of security controls, often involving active interaction.
Examination is a security assessment method that specifically involves reviewing, inspecting, and analyzing assessment objects, such as documentation (policies, procedures), system configurations, audit logs, and other artifacts. This method aims to determine the adequacy of security controls based on documented evidence and observed conditions without active interaction.
Interviewing is an assessment method that involves discussing security controls with personnel to gather information and clarify understanding, relying on verbal communication rather than direct review of objects.
Debugging is a software development process used to find and fix errors in code, not a standard assessment method for security controls.
Concept tested: Security Assessment Methods (NIST SP 800-53A)
Source: https://csrc.nist.gov/publications/detail/sp/800-53a/rev5/final
Topics
Community Discussion
No community discussion yet for this question.