Security Assessment Flashcards

Which assessment method involves evaluating security controls by reviewing documentation, interviewing personnel, and observing system behavior?

Answer: Security control assessment

Security control assessments use three methods—examine, interview, and test—to determine if controls are implemented correctly and operating as intended.

What is the primary risk associated with conducting a penetration test without a signed rules of engagement (ROE) document?

Answer: The assessor may face legal liability for activities that would otherwise be authorized

Without a signed ROE, penetration testing activities lack explicit authorization, which could expose assessors to criminal liability under computer fraud laws.

During continuous monitoring, an organization detects a significant change to a critical system. What is the most appropriate immediate action?

Answer: Assess the impact of the change on the system's security posture and update authorization documents

Significant changes trigger impact analysis to determine whether existing security controls remain adequate and whether reauthorization is needed.

Which FedRAMP security assessment concept requires cloud service providers to maintain a continuously updated inventory of their security posture?

Answer: Continuous Monitoring (ConMon)

FedRAMP Continuous Monitoring (ConMon) requires CSPs to maintain ongoing visibility into their security posture through regular vulnerability scanning and reporting.

An assessor is evaluating network segmentation controls. Which technique would best validate that segments are properly isolated?

Answer: Conducting network traffic analysis and attempting cross-segment connections

Actively testing network segments by attempting cross-segment connections provides empirical evidence that segmentation controls are functioning as intended.

What distinguishes a red team exercise from a standard penetration test?

Answer: Red team exercises simulate full adversary campaigns including physical and social engineering over an extended period

Red team exercises emulate realistic adversary campaigns using multiple attack vectors including physical intrusion and social engineering over extended timeframes, unlike focused penetration tests.

Which control assessment method would be most appropriate to verify that an organization's incident response procedures are effective?

Answer: Conducting a tabletop exercise or simulation

Tabletop exercises and simulations test incident response procedures in practice, revealing gaps that documentation review or interviews cannot identify.