Discuss ISC2 CCSP Exam Topic 1 Question 23

Which of the following best describes the Organizational Normative Framework (ONF)?

AA set of application security, and best practices, catalogued and leveraged by the organization

BA container for components of an application's security, best practices catalogued and leveraged by the organization

CA framework of containers for some of the components of application security, best practices, catalogued and leveraged by the organization

DA framework of containers for all components of application security, best practices, catalogued and leveraged by the organization.

Suggested Answer: D

Option B is incorrect, because it refers to a specific applications security elements, meaning it is about an ANF, not the ONF. C is true, but not as complete as D, making D the better choice. C suggests that the framework contains only ''some'' of the components, which is why B (which describes ''all'' components) is better

Get Premium CCSP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

11 comments · newest first

Dorthy 11 months ago

Not sure if "all components" is accurate, feels a bit too broad.

Lea 12 months ago

Option D seems the most comprehensive to me!

Amber 12 months ago

Surprised there's no mention of specific security measures in the options.

Paris 12 months ago

I agree, but isn't it more about all components?

Jolanda 1 year ago

I think it's definitely about application security best practices.

Nichelle 1 year ago

I’m a bit confused; I thought the ONF was more about best practices rather than being a framework of containers. Maybe it’s A?

Oretha 1 year ago

I feel like I studied that the ONF is a comprehensive framework, which makes me think option D could be the right choice.

Elvera 1 year ago

I remember a practice question that mentioned "containers" in relation to application security, so I might lean towards option C.

Deane 1 year ago

I think the ONF is about organizing security practices, but I'm not sure if it includes all components or just some.

Verona 1 year ago

This seems like a tricky question, but I think I can figure it out. I'll need to carefully read through the options and think about the requirements.

Lauran 1 year ago

I'll start by eliminating the options that don't seem relevant, then focus in on the most likely locations for the local Traps logs. Gotta love these tricky forensics questions!

ISC2 CCSP Exam - Topic 1 Question 23 Discussion