ISC Secure Operations Change Management And Disposal — 10 Questions

Question 1

In a Kubernetes environment, you are updating a security sidecar container. Which deployment strategy ensures zero downtime while maintaining security posture?

Accepted Answer

RollingUpdate. While RollingUpdate is a standard strategy, Blue/Green and Canary deployments also support zero-downtime updates. The question is ambiguous because 'RollingUpdate' is the default Kubernetes strategy, but it does not inherently guarantee a better security posture than Blue/Green. The explanation should clarify that RollingUpdate is the native Kubernetes mechanism for incremental pod replacement without downtime.

Answer

Recreate

Answer

Canary Release

Answer

Blue/Green Deployment

Question 2

You are decommissioning an AWS EBS volume containing sensitive data. To comply with NIST SP 800-88, which action is required after logical deletion?

Accepted Answer

Schedule the deletion of the associated KMS CMK. According to NIST SP 800-88 Rev. 1 (Guidelines for Media Sanitization) for cloud environments, and AWS best practices, deleting an EBS volume immediately releases the blocks, and AWS overwrites them before the storage is allocated to another customer. However, for sensitive data encrypted with AWS KMS, the most direct and compliant method of cryptographic erasure (Clear/Purge) under NIST standards is to delete or disable the KMS key (CMK) used to encrypt the volume, rendering the ciphertext unrecoverable. Alternatively, for unencrypted volumes or as part of standard deletion, simply terminating/deleting the EBS volume triggers underlying block sanitization. Wait, let's re-evaluate: AWS EBS volumes are automatically zeroed out upon deletion before reuse. However, option B (deleting the KMS CMK) is commonly cited for cryptographic erasure of encrypted data. But is scheduling the *deletion* of the CMK required after logical deletion of an EBS volume? Actually, deleting an EBS volume itself deletes the data pointer, but AWS physically destroys or overwrites it. If the volume was encrypted with KMS, the data remains encrypted on disk. To ensure cryptographic erasure (NIST SP 800-88 Clear/Purge), destroying the KMS key prevents decryption. Let's look at AWS documentation: AWS states that deleting an EBS volume and relying on AWS's underlying media sanitization complies with NIST. Wait, if the volume is deleted, the data is already gone. Scheduling KMS key deletion renders any lingering snapshots or encrypted blocks unrecoverable. But wait, `dd` or `mkfs` are guest-level and ineffective for SSDs/cloud block storage. Let's verify if option B is indeed standard. Yes, cryptographic erasure via KMS is the correct AWS answer for compliance with NIST 800-88 when dealing with encrypted sensitive data.

Answer

Perform a bit-level wipe using dd

Answer

Run an Amazon Inspector scan

Answer

Reformat the filesystem using mkfs

Question 3

You are managing a change request in ServiceNow. To ensure compliance with the RFC process for a security patch, which state transition is mandatory before implementation?

Accepted Answer

Transition to Assess. The 'Assess' state in ServiceNow involves the Change Advisory Board (CAB) review, which is a mandatory control gate for security-critical changes.

Answer

Transition to Standard

Answer

Transition to Closed

Answer

Transition to New

Question 4

You are managing the lifecycle of an enterprise-level cryptographic key. What is the most critical step prior to key decommissioning?

Accepted Answer

Archiving the key. Before a cryptographic key is decommissioned (destroyed), it must be backed up or archived to ensure historical data can still be decrypted if needed. Wait, decommissioning usually implies destruction. However, prior to complete destruction/deletion, the most critical step to prevent permanent data loss of encrypted archives is ensuring that the key (or its corresponding data) is properly archived so ciphertext can still be decrypted, or alternatively, that all data encrypted by the key has been re-encrypted under a new key (cryptographic erasure vs archival). Let's review standard NIST key lifecycle: creation, pre-activation, active, deactivated, compromised, destroyed. Prior to destruction, the key enters the deactivated state. Archiving is the correct procedural safeguard for legacy decryption.

Answer

Sending a notification email

Answer

Updating the firewall rules

Answer

Overwriting the key in RAM

Question 5

You are performing a 'Sanitization' of a drive according to NIST 800-88. If the drive is 'Clear' status, what does this imply?

Accepted Answer

Logical sanitization. In NIST SP 800-88, 'Clear' applies logical sanitization techniques — overwriting, block erase, or cryptographic erase — that render data unrecoverable through normal system access, but the media remains usable. This is why C is correct.

Answer

Hardware degaussing

Answer

Cryptographic erasure

Answer

Physical destruction

Question 6

Which THREE technologies are acceptable for the secure disposal of solid-state drives (SSDs)?

Accepted Answer

Physical shredding. NIST SP 800-88 Rev. 1 specifies that magnetic degaussing is ineffective on solid-state drives because SSDs store data using electrical charges in semiconductor memory rather than magnetic media. The acceptable methods for SSD disposal are Clear (Cryptographic Erase), Purge (Sanitize command / Block Erase), and Destroy (Physical destruction such as shredding or incineration).

Answer

Formatting the partition

Answer

Degaussing

Question 7

A security engineer is reviewing the change management process for a cloud-hosted application. The process must ensure that changes to security groups are authorized and logged. Which control is most effective for detecting unauthorized changes to security groups?

Accepted Answer

Enabling AWS CloudTrail logging for all API calls and configuring alerts for security group modifications.. CloudTrail logging with alerts provides continuous monitoring and immediate notification of security group modifications, enabling rapid detection of unauthorized changes. The other options are either preventive controls or periodic reviews that do not offer real-time detection.

Answer

Implementing a change approval workflow that requires manager sign-off before security group changes.

Answer

Requiring multi-factor authentication (MFA) for all users who can modify security groups.

Answer

Conducting quarterly access reviews of IAM policies and security group rules.

Question 8

You are the ISSE for a defense contractor that must dispose of a failed solid-state drive (SSD) containing controlled unclassified information (CUI). The drive is not functional and cannot be powered on, so software sanitization is impossible. Per NIST SP 800-88 Rev. 1 and ISSEP secure disposal guidance, which TWO actions are appropriate to achieve media sanitization before physical destruction? (Choose two.)

Accepted Answer

Shred the SSD using a NSA EPL-listed disintegrator that reduces particle size to 2 mm or less.. When an SSD containing CUI is non-functional, electronic sanitization methods such as cryptographic erase or overwriting cannot be performed. NIST SP 800-88 Rev. 1 specifies physical destruction as an acceptable sanitization method for flash media. NSA EPL-listed disintegrators and incinerators are approved for reducing SSDs to a state where data recovery is infeasible. These methods ensure the CUI is irrecoverable and meet regulatory requirements for secure disposal.

Answer

Perform a cryptographic erase using the drive's built-in ATA Secure Erase command.

Answer

Overwrite the SSD with a single pass of random data using a software tool.

Answer

Degauss the SSD with a NSA EPL-listed Type II degausser.

Question 9

A security engineer is updating the change management procedure for a cloud-based SaaS application that handles protected health information (PHI) under HIPAA. The procedure must ensure that changes to the application are properly authorized, tested, and documented. Which two controls are MOST critical to include in the procedure? (Choose two.)

Accepted Answer

Require a rollback plan for every change before approval.. For a HIPAA-regulated SaaS application, change management must include formal approval to ensure authorization and a rollback plan to mitigate failures. These controls directly support the security and availability of PHI. Other controls like training or vulnerability scanning are valuable but are not the most critical for the change procedure itself.

Answer

Enforce mandatory security awareness training for all employees annually.

Answer

Conduct a vulnerability scan after every change is deployed.

Answer

Use a dedicated change advisory board (CAB) to review all changes.

Question 10

A security engineer is updating the change management policy for an organization that follows ITIL. The policy must define the role responsible for authorizing a change that affects multiple critical systems. According to ITIL, which role has the authority to approve such a change?

Accepted Answer

Change Advisory Board (CAB). In ITIL, the Change Advisory Board (CAB) is responsible for assessing and authorizing changes, particularly those with high impact or risk. For a change affecting multiple critical systems, the CAB's collective expertise ensures that all implications are considered. The Change Manager facilitates the process but does not typically approve such changes alone.

Answer

Change Manager

Answer

Configuration Manager

Answer

Service Desk Manager