Discuss ISC2 CISSP Exam Topic 1 Question 113

Which of the following is considered the FIRST step when designing an internal security control assessment?

ACreate a plan based on recent vulnerability scans of the systems in question.

BCreate a plan based on comprehensive knowledge of known breaches.

CCreate a plan based on a recognized framework of known controls.

DCreate a plan based on reconnaissance of the organization's infrastructure.

Suggested Answer: C

An internal security control assessment is a process of evaluating the effectiveness and compliance of the security controls implemented within an organization. The first step when designing an internal security control assessment is to create a plan based on a recognized framework of known controls, such as the NIST SP 800-53, ISO/IEC 27002, or COBIT. A framework of known controls provides a comprehensive and consistent set of security objectives, requirements, and best practices that can be used as a reference and a benchmark for the assessment. The other options are not considered the first step when designing an internal security control assessment, as they may not cover all the relevant aspects of security, may not be aligned with the organization's goals and risks, or may not be feasible or reliable.Reference:CISSP - Certified Information Systems Security Professional, Domain 1. Security and Risk Management, 1.4 Understand and apply risk management concepts, 1.4.5 Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements, 1.4.5.1 Internal security assessments;CISSP Exam Outline, Domain 1. Security and Risk Management, 1.4 Understand and apply risk management concepts, 1.4.5 Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements, 1.4.5.1 Internal security assessments

Get Premium CISSP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

26 comments · newest first

Rory 1 month ago

I lean towards A. Recent scans show current vulnerabilities directly.

Sonia 1 month ago

Option B makes sense too. Knowing past breaches can guide us.

Berry 2 months ago

I prefer option D. Understanding the infrastructure is crucial first.

Bulah 2 months ago

I think option C is the best. Frameworks help structure the assessment.

Luisa 2 months ago

B makes sense. Learning from past breaches is crucial.

Tarra 2 months ago

A is solid too. Recent scans show current vulnerabilities.

Dante 2 months ago

I prefer D. Knowing the infrastructure first is key.

Odelia 2 months ago

I think option C is the best. Frameworks are essential.

Corazon 3 months ago

B makes sense. Learning from past breaches is crucial.

Cassandra 3 months ago

A is solid too. Recent scans show current vulnerabilities.

Mireya 3 months ago

I prefer D. Knowing the infrastructure first is key.

Hollis 3 months ago

I think option C is the best. Frameworks are essential.

Elise 3 months ago

C is the standard approach, can't go wrong with that!

Dierdre 4 months ago

Wait, is D really a first step? Sounds a bit off to me.

Novella 5 months ago

A is a solid choice too, but it feels a bit reactive.

Hildred 5 months ago

I disagree, B makes more sense since we learn from past breaches.

Toi 5 months ago

I think it's definitely C, frameworks are key!

Melinda 6 months ago

I disagree, C is the standard approach in most cases.

Marica 6 months ago

Surprised that B is even an option, breaches are so varied!

Rose 6 months ago

I’m leaning towards D, you need to know your infrastructure first.

Yvette 6 months ago

A seems more practical to me, recent scans are crucial.

Minna 6 months ago

I think it’s definitely C, frameworks are key!

Anabel 6 months ago

I practiced a question similar to this, and I think reconnaissance of the organization's infrastructure is crucial, but it might not be the very first step.

Ellen 7 months ago

I feel like creating a plan based on known breaches could be a good starting point, but it might not cover everything we need to assess.

Antonio 7 months ago

I'm not entirely sure, but I remember something about using recent vulnerability scans to inform the assessment. Maybe that's important too?

Paola 7 months ago

I think the first step should be based on a recognized framework of known controls, like NIST or ISO. That seems foundational.

ISC2 CISSP Exam - Topic 1 Question 113 Discussion