ISC Secure Operations Change Management And Disposal Practice Test 3 — 15 Questions

Question 1

Which THREE elements are essential in a Change Management policy?

Accepted Answer

Requirements for audit logging and evidence collection. A robust policy requires defined roles, a clear process flow, and mandatory audit logging to ensure accountability and compliance.

Answer

Hardware shipping methods

Answer

Instructions on how to write code

Question 2

Which THREE strategies are used to mitigate risk during a production software change?

Accepted Answer

Phased rollout (canary deployment). Phased rollouts, automated rollback, and canary testing are standard industry practices to limit the blast radius of a failed change.

Answer

Increasing the system clock speed

Answer

Sending a company-wide email notification

Question 3

Which TWO aspects of a system's lifecycle must be documented in the decommission plan?

Accepted Answer

Data sanitization method applied. Option C is correct because a decommission plan must document the data sanitization method applied (e.g., NIST SP 800-88 purge/clear, cryptographic erase, or physical destruction) to prove that residual data was securely removed before disposal or reuse, satisfying data remanence and privacy requirements. Option E is correct because the plan must record removal from the hardware and software inventory so that CMDB/asset records, monitoring, licensing, and support entitlements are updated and no orphaned or phantom assets remain. Option A is not required, since original purchase price is a financial/accounting detail rather than a lifecycle decommissioning control. Option B is irrelevant, as the vendor CEO's name has no bearing on secure retirement of the system. Option D is irrelevant, since server casing color is a cosmetic attribute with no decommissioning significance.

Answer

The original purchase price of the equipment

Answer

The name of the vendor's CEO

Answer

The color of the server casing

Question 4

A defense contractor is preparing to decommission a classified file server that used self-encrypting drives (SEDs). The drives must be reused in a lower-classification environment. Which action satisfies the media sanitization requirements while preserving the drives' usability?

Accepted Answer

Perform a cryptographic erase by regenerating the internal media encryption key.. Cryptographic erase is the correct sanitization method for self-encrypting drives because it invalidates the encryption key, making the data instantly unrecoverable while keeping the drive functional. Overwriting, degaussing, and physical destruction either fail to sanitize properly, render the drive unusable, or exceed the necessary assurance level for reuse.

Answer

Degauss the drive using a NSA-listed Type II degausser.

Answer

Overwrite the entire drive three times using a software-based pattern-write utility.

Answer

Remove the drive platters and physically shred them into particles smaller than 2 mm.

Question 5

A security engineer is drafting a change management procedure for a financial institution's production environment. The procedure must ensure that changes are approved before implementation and that emergency changes are handled without bypassing security controls. Which element is essential to include in the procedure?

Accepted Answer

A defined emergency change process that allows retrospective approval within a specified timeframe.. A formal emergency change process with retrospective approval allows critical changes to be implemented swiftly while maintaining security governance through post-implementation review. This ensures that emergency actions do not bypass controls entirely and that all changes are eventually documented and approved by authorized personnel.

Answer

A requirement that all changes be approved by the Chief Information Security Officer (CISO) personally.

Answer

A rule that changes can only be deployed during a monthly maintenance window.

Answer

A policy that all changes must be tested in a staging environment that mirrors production exactly.

Question 6

A government agency is decommissioning a legacy mainframe that processes sensitive but unclassified data. The agency must ensure that all data is irretrievably destroyed and that the destruction is verifiable for audit purposes. Which disposal method best meets these requirements?

Accepted Answer

Incineration at a licensed facility with a certificate of destruction.. Incineration is a physical destruction method that ensures data cannot be recovered and produces a certificate of destruction, which is essential for audit verification. Other methods like overwriting, degaussing, or reformatting either leave the media intact or do not provide verifiable proof of destruction.

Answer

Overwriting each disk with a random pattern using a certified wiping tool.

Answer

Degaussing the mainframe's tape reels and disk packs.

Answer

Deleting all files and reformatting the storage volumes.

Question 7

You are the ISSE responsible for a change to an accredited system that will replace the cryptographic module used for data-at-rest encryption. The system is in the Operations phase and processes Controlled Unclassified Information. The change has been approved by the Configuration Control Board. Before implementation, which action BEST ensures the change does not invalidate the existing authorization?

Accepted Answer

Perform a security impact analysis and update the system security plan, then obtain approval from the Authorizing Official if the risk posture changes.. A cryptographic module replacement changes the implemented controls and may affect the system's risk level. The ISSE must perform a security impact analysis, update the system security plan, and involve the Authorizing Official when risk changes. Only this sequence maintains the authorization's validity and ensures the change is properly assessed before implementation.

Answer

Submit the change to the Change Advisory Board for approval before notifying the Authorizing Official.

Answer

Test the new cryptographic module in a lab environment and document the results in the configuration management database.

Answer

Implement the change and then conduct a vulnerability assessment within 30 days to verify that no new weaknesses were introduced.

Question 8

You are engineering the disposal process for a system that stores Top Secret information on magnetic tape. The tapes are at end-of-life and will be transported to an offsite facility for destruction. Which combination of activities BEST ensures the media cannot be reconstructed and that the disposal is auditable?

Accepted Answer

Degauss the tapes onsite, then transport them to the offsite facility for incineration, and retain the degausser certification and destruction certificates.. For Top Secret magnetic media, degaussing followed by incineration provides both logical and physical destruction. Retaining the degausser certification and the destruction certificate creates the audit trail required for accountability. This combination ensures the data cannot be reconstructed and that the disposal process can be verified by auditors.

Answer

Transport the tapes to the offsite facility and have them shredded, then record the serial numbers in the disposal log.

Answer

Store the tapes in a secure container until they can be incinerated onsite, and have the container custodian sign a hand receipt.

Answer

Overwrite the tapes with a single pass of random data, then transport them for incineration and keep the overwrite log.

Question 9

You are the ISSE for a system that processes Controlled Unclassified Information. An engineer submits a change request to upgrade the operating system, and the change will alter the cryptographic module boundary described in the system security plan. Before the change is approved, what must occur?

Accepted Answer

Perform a security impact analysis and update the system security plan and associated security documentation before the change is approved.. When a change alters a security-relevant boundary such as the cryptographic module, the ISSE must ensure a security impact analysis is performed and the system security plan and related documentation are updated before approval. This maintains the accuracy and validity of the authorization package and ensures controls remain appropriate for the modified system.

Answer

Submit the change to the Change Advisory Board for a vote without performing a security impact analysis, since the CAB represents all stakeholders.

Answer

Approve the change immediately because operating system upgrades are routine maintenance and fall under the existing authorization.

Answer

Defer the change until the next annual security assessment so the impact can be evaluated together with other findings.

Question 10

You are the ISSE for a system that has just been decommissioned. The system security plan included a contingency plan that referenced a failover site. Which action is MOST important to perform during the disposal phase to prevent unauthorized access to sensitive data that may remain at the failover site?

Accepted Answer

Verify that all media and backup copies at the failover site are sanitized or destroyed according to the approved disposal plan.. Decommissioning a primary system does not automatically sanitize data replicated to a failover site. The ISSE must verify that all media and backups at the failover site are sanitized or destroyed per the disposal plan. This prevents unauthorized access to residual sensitive data that could be overlooked if only the primary site is addressed.

Answer

Conduct a vulnerability scan of the failover site to identify any open ports that could expose data.

Answer

Notify the failover site administrator that the system is decommissioned and request confirmation that no data remains.

Answer

Update the contingency plan to remove references to the failover site and archive the plan.

Question 11

A defense contractor is decommissioning a system that processed classified information. The media sanitization records must demonstrate compliance with the Committee on National Security Systems policy for clearing, purging, and destroying media. Which action best satisfies the sanitization requirement for magnetic hard drives that will leave the controlled area?

Accepted Answer

Degauss the drives and document the model, serial number, and degausser field strength used.. For classified magnetic media leaving a controlled area, CNSS Policy No. 26 requires an approved purge method. Degaussing is an approved purge technique for magnetic media, and documenting the drive identifiers and degausser field strength provides the audit evidence needed to demonstrate compliance.

Answer

Overwrite each drive with a single pass of zeros using approved software and retain the software log.

Answer

Delete the partition table and format the drives, then store them in a locked cabinet until reuse.

Answer

Encrypt the drives with full-disk encryption and discard the keys before transferring the drives.

Question 12

A security engineer is developing a media disposal plan for a data center that is being decommissioned. The plan must address the secure disposal of various media types, including hard disk drives (HDDs), solid-state drives (SSDs), and magnetic tapes. Which two actions should be included in the plan to ensure compliance with NIST SP 800-88 Rev. 1? (Choose two.)

Accepted Answer

For magnetic tapes, degauss the tapes to render data unrecoverable.. For SSDs, ATA Secure Erase or cryptographic erase is the recommended Purge method, and for magnetic tapes, degaussing is effective. These actions align with NIST SP 800-88 Rev. 1 for secure disposal. Single-pass overwrite on HDDs is only Clear, file deletion is insufficient, and degaussing SSDs is ineffective.

Answer

For all media types, use a software-based file deletion utility to remove files.

Answer

For HDDs, perform a single-pass overwrite with a fixed pattern to achieve Purge.

Answer

For SSDs, degauss the drives to purge data.

Question 13

You are advising a program on the disposal of a system that processes Sensitive But Unclassified information. The system uses solid-state drives. The program wants to reuse the drives in a lower-security environment. Which sanitization method is MOST appropriate to allow reuse while ensuring the data cannot be recovered?

Accepted Answer

Use the drive manufacturer's sanitization command to perform a cryptographic erase, and verify the drive's sanitization status.. Cryptographic erase destroys the encryption key, rendering all data on the SSD unrecoverable, and allows the drive to be reused. Verifying the sanitization status confirms the operation succeeded. This method is recommended for SSDs when reuse in a lower-security environment is intended, as it addresses wear leveling and over-provisioning.

Answer

Degauss the solid-state drives to remove all magnetic traces, then reuse them.

Answer

Perform a single-pass overwrite using a software wiping utility, then reuse the drives.

Answer

Physically shred the solid-state drives and purchase new drives for the lower-security environment.

Question 14

An organization is retiring a legacy application that stores personal data. The decommissioning plan must address data retention, media sanitization, and the removal of the application from the authorization boundary. Which activity must be completed before the system is removed from the authorization boundary?

Accepted Answer

Verify that all data has been migrated or retained according to the records retention schedule and that media sanitization is documented.. Removing a system from the authorization boundary requires assurance that data has been handled per the records retention schedule and that media sanitization is complete and documented. These steps protect personal data and satisfy compliance obligations before the boundary is formally changed.

Answer

Notify the user community that the application will be unavailable and provide a rollback plan in case the decommissioning fails.

Answer

Archive the application source code and database schema in the configuration management system for future reference.

Answer

Obtain a new authorization to operate for the remaining systems that shared the same network segment.

Question 15

You are an ISSE at a financial institution. A critical security patch for a web application firewall (WAF) must be deployed to production. The change management policy requires that a rollback plan be documented and tested. The WAF configuration is managed via infrastructure-as-code (IaC) in a Git repository. Which approach best satisfies the rollback requirement while maintaining security?

Accepted Answer

Use Git to revert to the previous commit of the IaC repository and redeploy the WAF configuration.. The change management policy requires a documented and tested rollback plan. Using Git to revert to a previous commit of the IaC repository and redeploying provides an automated, repeatable, and tested rollback. This method ensures the exact previous configuration is restored, maintains an audit trail, and aligns with security best practices. It also allows the rollback to be rehearsed in a staging environment, satisfying the testing requirement.

Answer

Schedule the patch during a maintenance window and rely on the WAF vendor's support to revert if needed.

Answer

Apply the patch and monitor for issues; if problems arise, manually edit the WAF rules to fix them.

Answer

Store a backup of the WAF configuration file on a secure file share before applying the patch, and document the restore procedure.