Exam CISSP topic 1 question 102 discussion

Answer B) Keyword in question is "plan" and the only sentence that refers to a plan is "The objectives for the control assessments and a detailed roadmap of how to conduct such assessments."

The MAIN purpose of a security assessment plan is: B. Provide the objectives for the security and privacy control assessments and a detailed roadmap of how to conduct such assessments. A security assessment plan outlines the objectives, scope, methodology, and approach for conducting security and privacy control assessments within an organization. Its primary purpose is to provide a clear roadmap and guidance on how to assess and evaluate the effectiveness of security controls in place.

B: "The objectives for the control assessments and a detailed roadmap of how to conduct such assessments." https://csrc.nist.gov/glossary/term/assessment_plan

Def B: https://csrc.nist.gov/glossary/term/assessment_plan

Clearly the answer is B here. Before conducting a security assessment, you need to know the objectives of that assessment, and all objectives must be SMART (Specific, Measurable, Attainable/Achievable, Relevant, Time-bound).

the key here is "plan": security assessment plan => objectives

B could be right, but D sounds right too I have been engaged with a few initiatives where executives want to conduct security assessments and see if it's financially viable to kick off the project or not.

Answer is correct

A is correct