ISC Secure Operations Change Management And Disposal — 20 Questions

Question 1

An administrator needs to wipe a decommissioned laptop hard drive. Which method meets the NIST 800-88 'Purge' standard for magnetic media?

Accepted Answer

Degaussing. Degaussing is the only method listed that specifically aligns with the Purge standard for magnetic media by exposing the drive to a strong magnetic field.

Answer

Deleting partitions

Answer

OS reinstallation

Answer

File system encryption

Question 2

You are utilizing Terraform to manage infrastructure as code. To ensure security-critical changes are not committed to production without authorization, which feature should you implement?

Accepted Answer

Sentinel Policy-as-Code. Sentinel policies in Terraform Enterprise allow for Policy-as-Code, enabling automated enforcement of security rules before infrastructure is provisioned.

Answer

Terraform Refresh

Answer

Provider Aliases

Answer

State Locking

Question 3

You are configuring a CI/CD pipeline in GitLab to ensure security-critical changes are verified. Which mechanism ensures that only authorized engineers can merge changes to the master branch?

Accepted Answer

Protected Branches with Merge Request approvals. GitLab protected branches allow for granular permissions to restrict who can push or merge, which is a standard security control for change management.

Answer

Global Runner tags

Answer

Pipeline schedules for automated auditing

Answer

Webhook integration with Jira

Question 4

In a Kubernetes environment, you are updating a security sidecar container. Which deployment strategy ensures zero downtime while maintaining security posture?

Accepted Answer

RollingUpdate. Rolling updates allow for updating pods incrementally, ensuring the security sidecar is active throughout the transition.

Answer

Recreate

Answer

Canary Release

Answer

Blue/Green Deployment

Question 5

What is the first step when preparing a system for secure disposal?

Accepted Answer

Inventory the assets. Creating an inventory ensures that all components, including peripherals and secondary storage, are accounted for prior to sanitization.

Answer

Run a virus scan

Answer

Physically destroy the hardware

Answer

Send it to recycling

Question 6

You are decommissioning an AWS EBS volume containing sensitive data. To comply with NIST SP 800-88, which action is required after logical deletion?

Accepted Answer

Schedule the deletion of the associated KMS CMK. AWS performs physical destruction of the underlying storage media when a volume is deleted; however, the cryptographic erasure via AWS KMS key deletion is the standard for secure disposal in the cloud.

Answer

Perform a bit-level wipe using dd

Answer

Run an Amazon Inspector scan

Answer

Reformat the filesystem using mkfs

Question 7

You are managing a change request in ServiceNow. To ensure compliance with the RFC process for a security patch, which state transition is mandatory before implementation?

Accepted Answer

Transition to Assess. The 'Assess' state in ServiceNow involves the Change Advisory Board (CAB) review, which is a mandatory control gate for security-critical changes.

Answer

Transition to Standard

Answer

Transition to Closed

Answer

Transition to New

Question 8

When conducting a security impact analysis for a system change in a Federal environment, what is the primary purpose of reviewing the FIPS 199 categorization?

Accepted Answer

To determine if the security controls need re-evaluation. FIPS 199 defines the impact level (Low, Moderate, High), which dictates the rigor of the change management testing requirements.

Answer

To calculate the budget

Answer

To verify physical location

Answer

To update the system inventory

Question 9

You are reviewing a Change Management plan for an ICS (Industrial Control System). What is the most critical risk during the 'Implement' phase?

Accepted Answer

Operational system disruption. In ICS/SCADA environments, system availability is paramount; uncoordinated changes can cause catastrophic operational failure.

Answer

Data leakage

Answer

Loss of audit logs

Answer

Unauthorized access

Question 10

When disposing of SSDs that contain PII, why is traditional degaussing ineffective?

Accepted Answer

SSDs are not magnetic media. SSDs store data using floating gate transistors (NAND flash), which are not susceptible to magnetic fields, unlike traditional spinning disks.

Answer

SSDs have internal encryption

Answer

SSDs are too thin

Answer

SSDs have wear leveling algorithms

Question 11

Which command line utility is used on Linux to verify the integrity of binary files during a maintenance patch update?

Accepted Answer

sha256sum. sha256sum calculates a cryptographic hash that can be compared against a known good value to verify binary integrity.

Answer

chown

Answer

dd

Answer

chmod

Question 12

What is the primary function of a Change Advisory Board (CAB) in an ITIL-based environment?

Accepted Answer

To authorize and prioritize changes. The CAB is responsible for assessing, prioritizing, and authorizing changes to prevent unauthorized or risky changes from impacting the environment.

Answer

To perform technical code reviews

Answer

To manage hardware procurement

Answer

To conduct system testing

Question 13

When managing decommissioning of a cloud-native application, which document must be updated to reflect the removal of security controls?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) is the authoritative document describing a system's security controls; removing a system requires updating this document to reflect the change in boundary.

Answer

User access manual

Answer

Help desk FAQ

Answer

Network topology diagram

Question 14

You are managing the lifecycle of an enterprise-level cryptographic key. What is the most critical step prior to key decommissioning?

Accepted Answer

Archiving the key. Archiving the key is necessary to decrypt legacy data that was encrypted with the old key, otherwise, that data becomes permanently inaccessible.

Answer

Sending a notification email

Answer

Updating the firewall rules

Answer

Overwriting the key in RAM

Question 15

Which type of change is typically excluded from a formal Change Advisory Board review process?

Accepted Answer

Standard changes. Standard changes are pre-authorized, low-risk, and routine, allowing them to bypass the full CAB review for efficiency.

Answer

Emergency changes

Answer

Security patches

Answer

Significant changes

Question 16

You are configuring a secure baseline for a server migration. Which NIST SP 800-53 control category covers 'System and Services Acquisition' regarding the maintenance of security-critical configurations?

Accepted Answer

SA-10 Developer Configuration Management. NIST SP 800-53 SA controls (System and Services Acquisition) specifically cover the lifecycle management, including initial configuration and security baseline maintenance.

Answer

AU-2 Audit Events

Answer

SC-8 Transmission Confidentiality

Answer

AC-3 Access Enforcement

Question 17

You are performing a 'Sanitization' of a drive according to NIST 800-88. If the drive is 'Clear' status, what does this imply?

Accepted Answer

Logical sanitization. The 'Clear' method uses logical techniques (like overwriting) to sanitize data in user-addressable storage locations, ensuring it cannot be recovered through simple file recovery tools.

Answer

Hardware degaussing

Answer

Cryptographic erasure

Answer

Physical destruction

Question 18

When managing a security-sensitive change in a regulated environment, why is 'Separation of Duties' applied to the 'Build' and 'Deploy' roles?

Accepted Answer

To prevent unauthorized code injection. Separation of duties prevents a single individual from introducing malicious code and deploying it into production, a critical control for integrity.

Answer

To simplify the audit process

Answer

To reduce operational costs

Answer

To increase server performance

Question 19

A legacy database must be decommissioned. You need to ensure the data is retrievable for 7 years for regulatory compliance. Which strategy is most secure?

Accepted Answer

Move to WORM media. Moving data to offline, immutable storage (WORM) ensures compliance with retention policies while protecting against unauthorized modification or deletion.

Answer

Copy to an unencrypted thumb drive

Answer

Delete the database server

Answer

Store on a public cloud share

Question 20

Which TWO actions should be included in a secure decommissioning process for a physical server?

Accepted Answer

Sanitizing all storage media according to NIST 800-88. Inventory management and secure media sanitization are critical to preventing data leakage during decommissioning.

Answer

Exporting the full system logs to a public folder

Answer

Changing the BIOS password

Answer

Reformatting the drive with FAT32