CRISC: Certified in Risk and Information Systems ControlDemo

Question

Which of the following provides the MOST reliable evidence that security controls implemented for a web application are effective?

A Penetration testing
B Fault tree analysis
C Vulnerability assessment
D IT general controls audit

Explanation

Penetration testing uses controlled attempts to exploit a web application and bypass its security features. It therefore directly tests whether implemented controls prevent or withstand realistic attack techniques, whereas a vulnerability assessment identifies possible weaknesses without necessarily validating exploitability or control performance.

Learn more

NIST SP 800-115: Technical Guide to Information Security Testing and Assessment

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ1852

Community Discussion