ISC Secure Operations Change Management And Disposal — 30 Questions

Question 1

In a Kubernetes environment, you are updating a security sidecar container. Which deployment strategy ensures zero downtime while maintaining security posture?

Accepted Answer

RollingUpdate. While RollingUpdate is a standard strategy, Blue/Green and Canary deployments also support zero-downtime updates. The question is ambiguous because 'RollingUpdate' is the default Kubernetes strategy, but it does not inherently guarantee a better security posture than Blue/Green. The explanation should clarify that RollingUpdate is the native Kubernetes mechanism for incremental pod replacement without downtime.

Answer

Recreate

Answer

Canary Release

Answer

Blue/Green Deployment

Question 2

You are decommissioning an AWS EBS volume containing sensitive data. To comply with NIST SP 800-88, which action is required after logical deletion?

Accepted Answer

Schedule the deletion of the associated KMS CMK. According to NIST SP 800-88 Rev. 1 (Guidelines for Media Sanitization) for cloud environments, and AWS best practices, deleting an EBS volume immediately releases the blocks, and AWS overwrites them before the storage is allocated to another customer. However, for sensitive data encrypted with AWS KMS, the most direct and compliant method of cryptographic erasure (Clear/Purge) under NIST standards is to delete or disable the KMS key (CMK) used to encrypt the volume, rendering the ciphertext unrecoverable. Alternatively, for unencrypted volumes or as part of standard deletion, simply terminating/deleting the EBS volume triggers underlying block sanitization. Wait, let's re-evaluate: AWS EBS volumes are automatically zeroed out upon deletion before reuse. However, option B (deleting the KMS CMK) is commonly cited for cryptographic erasure of encrypted data. But is scheduling the *deletion* of the CMK required after logical deletion of an EBS volume? Actually, deleting an EBS volume itself deletes the data pointer, but AWS physically destroys or overwrites it. If the volume was encrypted with KMS, the data remains encrypted on disk. To ensure cryptographic erasure (NIST SP 800-88 Clear/Purge), destroying the KMS key prevents decryption. Let's look at AWS documentation: AWS states that deleting an EBS volume and relying on AWS's underlying media sanitization complies with NIST. Wait, if the volume is deleted, the data is already gone. Scheduling KMS key deletion renders any lingering snapshots or encrypted blocks unrecoverable. But wait, `dd` or `mkfs` are guest-level and ineffective for SSDs/cloud block storage. Let's verify if option B is indeed standard. Yes, cryptographic erasure via KMS is the correct AWS answer for compliance with NIST 800-88 when dealing with encrypted sensitive data.

Answer

Perform a bit-level wipe using dd

Answer

Run an Amazon Inspector scan

Answer

Reformat the filesystem using mkfs

Question 3

You are managing a change request in ServiceNow. To ensure compliance with the RFC process for a security patch, which state transition is mandatory before implementation?

Accepted Answer

Transition to Assess. The 'Assess' state in ServiceNow involves the Change Advisory Board (CAB) review, which is a mandatory control gate for security-critical changes.

Answer

Transition to Standard

Answer

Transition to Closed

Answer

Transition to New

Question 4

You are managing the lifecycle of an enterprise-level cryptographic key. What is the most critical step prior to key decommissioning?

Accepted Answer

Archiving the key. Before a cryptographic key is decommissioned (destroyed), it must be backed up or archived to ensure historical data can still be decrypted if needed. Wait, decommissioning usually implies destruction. However, prior to complete destruction/deletion, the most critical step to prevent permanent data loss of encrypted archives is ensuring that the key (or its corresponding data) is properly archived so ciphertext can still be decrypted, or alternatively, that all data encrypted by the key has been re-encrypted under a new key (cryptographic erasure vs archival). Let's review standard NIST key lifecycle: creation, pre-activation, active, deactivated, compromised, destroyed. Prior to destruction, the key enters the deactivated state. Archiving is the correct procedural safeguard for legacy decryption.

Answer

Sending a notification email

Answer

Updating the firewall rules

Answer

Overwriting the key in RAM

Question 5

You are performing a 'Sanitization' of a drive according to NIST 800-88. If the drive is 'Clear' status, what does this imply?

Accepted Answer

Logical sanitization. In NIST SP 800-88, 'Clear' applies logical sanitization techniques — overwriting, block erase, or cryptographic erase — that render data unrecoverable through normal system access, but the media remains usable. This is why C is correct.

Answer

Hardware degaussing

Answer

Cryptographic erasure

Answer

Physical destruction

Question 6

Which THREE technologies are acceptable for the secure disposal of solid-state drives (SSDs)?

Accepted Answer

Physical shredding. NIST SP 800-88 Rev. 1 specifies that magnetic degaussing is ineffective on solid-state drives because SSDs store data using electrical charges in semiconductor memory rather than magnetic media. The acceptable methods for SSD disposal are Clear (Cryptographic Erase), Purge (Sanitize command / Block Erase), and Destroy (Physical destruction such as shredding or incineration).

Answer

Formatting the partition

Answer

Degaussing

Question 7

A security engineer is reviewing the change management process for a cloud-hosted application. The process must ensure that changes to security groups are authorized and logged. Which control is most effective for detecting unauthorized changes to security groups?

Accepted Answer

Enabling AWS CloudTrail logging for all API calls and configuring alerts for security group modifications.. CloudTrail logging with alerts provides continuous monitoring and immediate notification of security group modifications, enabling rapid detection of unauthorized changes. The other options are either preventive controls or periodic reviews that do not offer real-time detection.

Answer

Implementing a change approval workflow that requires manager sign-off before security group changes.

Answer

Requiring multi-factor authentication (MFA) for all users who can modify security groups.

Answer

Conducting quarterly access reviews of IAM policies and security group rules.

Question 8

You are the ISSE for a defense contractor that must dispose of a failed solid-state drive (SSD) containing controlled unclassified information (CUI). The drive is not functional and cannot be powered on, so software sanitization is impossible. Per NIST SP 800-88 Rev. 1 and ISSEP secure disposal guidance, which TWO actions are appropriate to achieve media sanitization before physical destruction? (Choose two.)

Accepted Answer

Shred the SSD using a NSA EPL-listed disintegrator that reduces particle size to 2 mm or less.. When an SSD containing CUI is non-functional, electronic sanitization methods such as cryptographic erase or overwriting cannot be performed. NIST SP 800-88 Rev. 1 specifies physical destruction as an acceptable sanitization method for flash media. NSA EPL-listed disintegrators and incinerators are approved for reducing SSDs to a state where data recovery is infeasible. These methods ensure the CUI is irrecoverable and meet regulatory requirements for secure disposal.

Answer

Perform a cryptographic erase using the drive's built-in ATA Secure Erase command.

Answer

Overwrite the SSD with a single pass of random data using a software tool.

Answer

Degauss the SSD with a NSA EPL-listed Type II degausser.

Question 9

A security engineer is updating the change management procedure for a cloud-based SaaS application that handles protected health information (PHI) under HIPAA. The procedure must ensure that changes to the application are properly authorized, tested, and documented. Which two controls are MOST critical to include in the procedure? (Choose two.)

Accepted Answer

Require a rollback plan for every change before approval.. For a HIPAA-regulated SaaS application, change management must include formal approval to ensure authorization and a rollback plan to mitigate failures. These controls directly support the security and availability of PHI. Other controls like training or vulnerability scanning are valuable but are not the most critical for the change procedure itself.

Answer

Enforce mandatory security awareness training for all employees annually.

Answer

Conduct a vulnerability scan after every change is deployed.

Answer

Use a dedicated change advisory board (CAB) to review all changes.

Question 10

A security engineer is updating the change management policy for an organization that follows ITIL. The policy must define the role responsible for authorizing a change that affects multiple critical systems. According to ITIL, which role has the authority to approve such a change?

Accepted Answer

Change Advisory Board (CAB). In ITIL, the Change Advisory Board (CAB) is responsible for assessing and authorizing changes, particularly those with high impact or risk. For a change affecting multiple critical systems, the CAB's collective expertise ensures that all implications are considered. The Change Manager facilitates the process but does not typically approve such changes alone.

Answer

Change Manager

Answer

Configuration Manager

Answer

Service Desk Manager

Question 11

A defense contractor must dispose of a retired file server that processed Controlled Unclassified Information (CUI). The organization follows NIST SP 800-88 Rev. 1 and needs to verify that the storage media is sanitized to the Purge level before it leaves the secure facility. The server contains a hardware RAID controller with three magnetic hard disk drives (HDDs) and one solid-state drive (SSD) used as a cache. Which action correctly applies the required sanitization technique to ALL media in this server?

Accepted Answer

Perform a cryptographic erase on the HDDs and use the SSD vendor's sanitization utility to issue a Purge command, then verify both.. The scenario requires Purge-level sanitization for mixed media containing CUI. Cryptographic erase is a valid Purge technique for self-encrypting magnetic drives, while SSDs require the vendor-specific sanitization command to clear flash cells and over-provisioned space. Verifying both processes produces the audit evidence needed before the server leaves the facility. Overwriting, degaussing, or generic ATA Secure Erase cannot reliably achieve Purge across both media types.

Answer

Degauss all four drives to disrupt the magnetic domains, then release the server for disposal.

Answer

Use the ATA Secure Erase command on the HDDs and the SSD, then verify the sanitization result.

Answer

Overwrite every drive with a single pass of random data using a software wiping tool, then confirm the tool's success log.

Question 12

An administrator needs to wipe a decommissioned laptop hard drive. Which method meets the NIST 800-88 'Purge' standard for magnetic media?

Accepted Answer

Degaussing. Degaussing is the only method listed that specifically aligns with the Purge standard for magnetic media by exposing the drive to a strong magnetic field.

Answer

Deleting partitions

Answer

OS reinstallation

Answer

File system encryption

Question 13

You are utilizing Terraform to manage infrastructure as code. To ensure security-critical changes are not committed to production without authorization, which feature should you implement?

Accepted Answer

Sentinel Policy-as-Code. Sentinel policies in Terraform Enterprise allow for Policy-as-Code, enabling automated enforcement of security rules before infrastructure is provisioned.

Answer

Terraform Refresh

Answer

Provider Aliases

Answer

State Locking

Question 14

You are configuring a CI/CD pipeline in GitLab to ensure security-critical changes are verified. Which mechanism ensures that only authorized engineers can merge changes to the master branch?

Accepted Answer

Protected Branches with Merge Request approvals. Protected Branches in GitLab restrict who can push and merge to a branch like master/main, and when combined with Merge Request approvals, they enforce that changes must go through an approved MR by authorized engineers before merging. This directly ensures only authorized personnel can merge security-critical changes. It is the native GitLab access-control mechanism for branch protection.

Answer

Global Runner tags

Answer

Pipeline schedules for automated auditing

Answer

Webhook integration with Jira

Question 15

What is the first step when preparing a system for secure disposal?

Accepted Answer

Inventory the assets. Creating an inventory ensures that all components, including peripherals and secondary storage, are accounted for prior to sanitization.

Answer

Run a virus scan

Answer

Physically destroy the hardware

Answer

Send it to recycling

Question 16

When conducting a security impact analysis for a system change in a Federal environment, what is the primary purpose of reviewing the FIPS 199 categorization?

Accepted Answer

To determine if the security controls need re-evaluation. FIPS 199 defines the impact level (Low, Moderate, High), which dictates the rigor of the change management testing requirements.

Answer

To calculate the budget

Answer

To verify physical location

Answer

To update the system inventory

Question 17

You are reviewing a Change Management plan for an ICS (Industrial Control System). What is the most critical risk during the 'Implement' phase?

Accepted Answer

Operational system disruption. In ICS/SCADA environments, system availability is paramount; uncoordinated changes can cause catastrophic operational failure.

Answer

Data leakage

Answer

Loss of audit logs

Answer

Unauthorized access

Question 18

When disposing of SSDs that contain PII, why is traditional degaussing ineffective?

Accepted Answer

SSDs are not magnetic media. Degaussing works by applying a strong magnetic field to erase data on magnetic media such as HDDs and tapes. SSDs store data in NAND flash cells using electrical charge, not magnetic domains, so a degausser has no effect on the stored data. This makes degaussing fundamentally inapplicable to SSDs.

Answer

SSDs have internal encryption

Answer

SSDs are too thin

Answer

SSDs have wear leveling algorithms

Question 19

Which command line utility is used on Linux to verify the integrity of binary files during a maintenance patch update?

Accepted Answer

sha256sum. sha256sum is the Linux utility that computes and verifies SHA-256 cryptographic hashes of files, making it the standard tool for verifying binary integrity after a patch download. By comparing the computed hash against the vendor-published hash, administrators confirm the file was not corrupted or tampered with during transfer.

Answer

chown

Answer

dd

Answer

chmod

Question 20

What is the primary function of a Change Advisory Board (CAB) in an ITIL-based environment?

Accepted Answer

To authorize and prioritize changes. The CAB is responsible for assessing, prioritizing, and authorizing changes to prevent unauthorized or risky changes from impacting the environment.

Answer

To perform technical code reviews

Answer

To manage hardware procurement

Answer

To conduct system testing