ISC Secure Operations Change Management And Disposal Practice Test 2 — 15 Questions

Question 1

When conducting a security impact analysis for a system change in a Federal environment, what is the primary purpose of reviewing the FIPS 199 categorization?

Accepted Answer

To determine if the security controls need re-evaluation. FIPS 199 defines the impact level (Low, Moderate, High), which dictates the rigor of the change management testing requirements.

Answer

To calculate the budget

Answer

To verify physical location

Answer

To update the system inventory

Question 2

You are reviewing a Change Management plan for an ICS (Industrial Control System). What is the most critical risk during the 'Implement' phase?

Accepted Answer

Operational system disruption. In ICS/SCADA environments, system availability is paramount; uncoordinated changes can cause catastrophic operational failure.

Answer

Data leakage

Answer

Loss of audit logs

Answer

Unauthorized access

Question 3

When disposing of SSDs that contain PII, why is traditional degaussing ineffective?

Accepted Answer

SSDs are not magnetic media. Degaussing works by applying a strong magnetic field to erase data on magnetic media such as HDDs and tapes. SSDs store data in NAND flash cells using electrical charge, not magnetic domains, so a degausser has no effect on the stored data. This makes degaussing fundamentally inapplicable to SSDs.

Answer

SSDs have internal encryption

Answer

SSDs are too thin

Answer

SSDs have wear leveling algorithms

Question 4

Which command line utility is used on Linux to verify the integrity of binary files during a maintenance patch update?

Accepted Answer

sha256sum. sha256sum is the Linux utility that computes and verifies SHA-256 cryptographic hashes of files, making it the standard tool for verifying binary integrity after a patch download. By comparing the computed hash against the vendor-published hash, administrators confirm the file was not corrupted or tampered with during transfer.

Answer

chown

Answer

dd

Answer

chmod

Question 5

What is the primary function of a Change Advisory Board (CAB) in an ITIL-based environment?

Accepted Answer

To authorize and prioritize changes. The CAB is responsible for assessing, prioritizing, and authorizing changes to prevent unauthorized or risky changes from impacting the environment.

Answer

To perform technical code reviews

Answer

To manage hardware procurement

Answer

To conduct system testing

Question 6

When managing decommissioning of a cloud-native application, which document must be updated to reflect the removal of security controls?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) is the authoritative document describing a system's security controls; removing a system requires updating this document to reflect the change in boundary.

Answer

User access manual

Answer

Help desk FAQ

Answer

Network topology diagram

Question 7

Which type of change is typically excluded from a formal Change Advisory Board review process?

Accepted Answer

Standard changes. Standard changes are pre-authorized, low-risk, and routine, allowing them to bypass the full CAB review for efficiency.

Answer

Emergency changes

Answer

Security patches

Answer

Significant changes

Question 8

You are configuring a secure baseline for a server migration. Which NIST SP 800-53 control category covers 'System and Services Acquisition' regarding the maintenance of security-critical configurations?

Accepted Answer

SA-10 Developer Configuration Management. SA-10 Developer Configuration Management is part of the System and Services Acquisition family in NIST SP 800-53. It specifically addresses managing security-critical configuration changes during development and acquisition, ensuring that configurations are maintained and controlled.

Answer

AU-2 Audit Events

Answer

SC-8 Transmission Confidentiality

Answer

AC-3 Access Enforcement

Question 9

When managing a security-sensitive change in a regulated environment, why is 'Separation of Duties' applied to the 'Build' and 'Deploy' roles?

Accepted Answer

To prevent unauthorized code injection. Separation of duties prevents a single individual from introducing malicious code and deploying it into production, a critical control for integrity.

Answer

To simplify the audit process

Answer

To reduce operational costs

Answer

To increase server performance

Question 10

A legacy database must be decommissioned. You need to ensure the data is retrievable for 7 years for regulatory compliance. Which strategy is most secure?

Accepted Answer

Move to WORM media. WORM (Write Once Read Many) media ensures data cannot be altered or deleted for a defined retention period, satisfying both the 7-year retrievability requirement and the security need for tamper-evident, immutable storage. This is the standard approach for regulatory retention of decommissioned data because it prevents modification or premature deletion. It is the most secure option among those listed.

Answer

Copy to an unencrypted thumb drive

Answer

Delete the database server

Answer

Store on a public cloud share

Question 11

Which TWO actions should be included in a secure decommissioning process for a physical server?

Accepted Answer

Sanitizing all storage media according to NIST 800-88. Inventory management and secure media sanitization are critical to preventing data leakage during decommissioning.

Answer

Exporting the full system logs to a public folder

Answer

Changing the BIOS password

Answer

Reformatting the drive with FAT32

Question 12

Which document outlines the specific security steps to be taken when a workstation reaches its end-of-life?

Accepted Answer

Data Sanitization Policy. The System Disposal Plan or Data Sanitization Policy outlines the specific requirements for decommissioning equipment to ensure no sensitive data remains.

Answer

Password Policy

Answer

Incident Response Plan

Answer

Acceptable Use Policy

Question 13

Which TWO factors must be assessed when determining if a change is 'Emergency' versus 'Standard'?

Accepted Answer

Pre-authorization status of the change procedure. Emergency changes are driven by urgent threats or failures, while standard changes follow a pre-approved, well-understood process.

Answer

The cost of the hardware

Answer

The number of users affected

Answer

The vendor of the software

Question 14

Which THREE items should be included in a Post-Implementation Review (PIR) for a security change?

Accepted Answer

Confirmation that no new vulnerabilities were introduced. A PIR ensures the change achieved its goal, did not introduce new vulnerabilities, and met compliance requirements.

Answer

The total budget spent on the project

Answer

List of employees who didn't like the change

Question 15

Which TWO criteria are used to determine if a change request must be reviewed by the Change Advisory Board (CAB)?

Accepted Answer

Potential impact on system availability. Changes that have a significant risk or potential for wide-reaching impact must undergo CAB review to ensure proper oversight.

Answer

The time of day the change is performed

Answer

The color of the hardware

Answer

The name of the lead technician