CGRC Security Assessment 5 — Questions and Answers
Question 1: Which NIST publication provides guidance on conducting security and privacy control assessments?
- NIST SP 800-37
- NIST SP 800-53A (Correct answer)
- NIST SP 800-171
- NIST SP 800-61
Correct answer: NIST SP 800-53A
NIST SP 800-53A provides assessment procedures for evaluating the effectiveness of security and privacy controls documented in NIST SP 800-53.
Question 2: What is the concept of 'assessment objectivity' in the context of security control assessments?
- Using only automated tools to eliminate human bias
- Ensuring assessors are independent from the system owners they are evaluating (Correct answer)
- Limiting assessment scope to objective, measurable controls only
- Requiring assessors to be certified by a government agency
Correct answer: Ensuring assessors are independent from the system owners they are evaluating
Assessment objectivity requires that assessors maintain independence from system owners to prevent conflicts of interest that could bias findings.
Question 3: During a vulnerability scan, a system returns a 'false positive' result. What does this mean?
- A real vulnerability was detected and confirmed through manual testing
- The scanner reported a vulnerability that does not actually exist on the system (Correct answer)
- The system correctly identified and blocked a scanning attempt
- A vulnerability was missed because the scanner lacked updated signatures
Correct answer: The scanner reported a vulnerability that does not actually exist on the system
A false positive occurs when a vulnerability scanner incorrectly reports a vulnerability that does not exist, requiring manual validation to confirm findings.
Question 4: Which of the following best describes the 'examine' assessment method defined in NIST SP 800-53A?
- Running automated vulnerability scanners against target systems
- Reviewing, inspecting, and analyzing specifications, documentation, and mechanisms (Correct answer)
- Conducting formal interviews with system administrators
- Performing manual penetration testing of system components
Correct answer: Reviewing, inspecting, and analyzing specifications, documentation, and mechanisms
The examine method involves reviewing and analyzing documents, specifications, mechanisms, and activities to understand or clarify security control implementation.
Question 5: A security assessor finds that an organization's risk register lists a high-severity vulnerability as 'accepted.' What is the assessor's appropriate response?
- Remove the finding from the assessment report since it has been formally accepted
- Document the finding, verify the acceptance is formally approved, and include it in the report with the acceptance status (Correct answer)
- Escalate the finding to regulators regardless of the organization's decision
- Require the organization to remediate the vulnerability before completing the assessment
Correct answer: Document the finding, verify the acceptance is formally approved, and include it in the report with the acceptance status
Accepted risks must still be documented in assessment reports with evidence of formal approval, allowing leadership to make informed authorization decisions.
Question 6: Which metric in the CVSS scoring system accounts for the level of access an attacker requires before exploiting a vulnerability?
- Attack Complexity
- Privileges Required (Correct answer)
- User Interaction
- Scope
Correct answer: Privileges Required
The 'Privileges Required' CVSS metric reflects the level of authentication or authorization privileges an attacker must possess before successfully exploiting a vulnerability.
Question 7: What is the primary purpose of threat modeling in the context of security assessments?
- To calculate the quantitative financial loss from potential security incidents
- To systematically identify and prioritize potential threats and attack vectors against a system (Correct answer)
- To document all known vulnerabilities in third-party software components
- To assign responsibility for security controls to specific team members
Correct answer: To systematically identify and prioritize potential threats and attack vectors against a system
Threat modeling systematically identifies potential threats, attack vectors, and vulnerabilities to prioritize security controls and assessment activities.
CGRC Security Assessment 5
Which NIST publication provides guidance on conducting security and privacy control assessments?