Security Assessment Flashcards

Which NIST publication provides guidance on conducting security and privacy control assessments?

Answer: NIST SP 800-53A

NIST SP 800-53A provides assessment procedures for evaluating the effectiveness of security and privacy controls documented in NIST SP 800-53.

What is the concept of 'assessment objectivity' in the context of security control assessments?

Answer: Ensuring assessors are independent from the system owners they are evaluating

Assessment objectivity requires that assessors maintain independence from system owners to prevent conflicts of interest that could bias findings.

During a vulnerability scan, a system returns a 'false positive' result. What does this mean?

Answer: The scanner reported a vulnerability that does not actually exist on the system

A false positive occurs when a vulnerability scanner incorrectly reports a vulnerability that does not exist, requiring manual validation to confirm findings.

Which of the following best describes the 'examine' assessment method defined in NIST SP 800-53A?

Answer: Reviewing, inspecting, and analyzing specifications, documentation, and mechanisms

The examine method involves reviewing and analyzing documents, specifications, mechanisms, and activities to understand or clarify security control implementation.

A security assessor finds that an organization's risk register lists a high-severity vulnerability as 'accepted.' What is the assessor's appropriate response?

Answer: Document the finding, verify the acceptance is formally approved, and include it in the report with the acceptance status

Accepted risks must still be documented in assessment reports with evidence of formal approval, allowing leadership to make informed authorization decisions.

Which metric in the CVSS scoring system accounts for the level of access an attacker requires before exploiting a vulnerability?

Answer: Privileges Required

The 'Privileges Required' CVSS metric reflects the level of authentication or authorization privileges an attacker must possess before successfully exploiting a vulnerability.

What is the primary purpose of threat modeling in the context of security assessments?

Answer: To systematically identify and prioritize potential threats and attack vectors against a system

Threat modeling systematically identifies potential threats, attack vectors, and vulnerabilities to prioritize security controls and assessment activities.