ISC Secure Operations Change Management And Disposal Practice Test 4 — 15 Questions

Question 1

You are the security engineer for a federal agency that must follow NIST SP 800-53 configuration management controls. A system administrator submits an emergency change to modify a firewall rule to allow a new business partner's IP range. The change is implemented immediately and documented afterward. Which configuration management control requirement does this action violate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CM-3 Configuration Change Control, which requires documented approval before implementation.. CM-3 requires that changes to systems be reviewed and approved before implementation, with emergency changes documented and approved within a defined period. Implementing the firewall rule first and documenting later bypasses the required authorization, undermining configuration change control and leaving the agency unable to demonstrate compliance to auditors.

Answer

CM-8 System Component Inventory, which requires an accurate inventory of system components.

Answer

CM-2 Baseline Configuration, which requires a documented baseline for the system.

Answer

CM-6 Configuration Settings, which requires security settings to be enforced automatically.

Question 2

You are the ISSE reviewing a change management process for a system that supports a continuous authorization approach. The process must ensure that security-relevant changes are identified and handled appropriately. Which TWO activities are required to maintain the authorization when a security-relevant change occurs? (Choose two.)

Accepted Answer

Perform a security impact analysis to determine whether the change affects the security posture or the controls in the authorization package.. Maintaining an authorization during security-relevant change requires a security impact analysis to evaluate the effect on controls and risk, followed by updates to the system security plan and related documentation. These two activities keep the authorization package accurate and support the continuous authorization decision.

Answer

Notify all users of the change and obtain their written acknowledgment before implementing the change.

Answer

Submit the change to the Change Advisory Board and wait for a unanimous vote before proceeding.

Answer

Reauthorize the system from scratch by conducting a full security assessment of all controls regardless of the change scope.

Question 3

You are an ISSE for a healthcare provider. A legacy server that stored electronic protected health information (ePHI) is being decommissioned. The server's hard drives are encrypted with AES-256, and the encryption keys are managed by a hardware security module (HSM). The drives will be repurposed within the organization for non-sensitive data. According to NIST SP 800-88 Rev. 1, which sanitization method is most appropriate to render the ePHI unrecoverable while allowing drive reuse?

Accepted Answer

Purge the drives by performing a cryptographic erase (crypto-erase) using the HSM to destroy the encryption keys.. Cryptographic erase is the most appropriate method because the drives are already encrypted and the keys can be securely destroyed via the HSM. This renders the ePHI unrecoverable while allowing the drives to be reused. NIST SP 800-88 Rev. 1 recognizes cryptographic erase as a Purge method, which is suitable for media that will be reused within the organization. It is efficient and meets the assurance level required for ePHI.

Answer

Physically destroy the drives by shredding them into 2 mm particles.

Answer

Clear the drives by overwriting with a single pass of zeros.

Answer

Degauss the drives to remove all data and then reuse them.

Question 4

You are designing the disposal process for a data center that hosts a multi-tenant cloud environment. The hardware includes NVMe SSDs and HDDs. Regulatory requirements mandate that data must be rendered unrecoverable even against laboratory attacks. Which combination of sanitization methods should you specify for the SSDs and HDDs respectively to meet the most stringent level?

Accepted Answer

Destroy by shredding for SSDs and Destroy by shredding for HDDs.. The most stringent sanitization level is Destroy, which renders media unusable and data unrecoverable. Shredding is a recognized Destroy method for both SSDs and HDDs. While Purge methods like cryptographic erase or degaussing may be sufficient for many cases, they do not provide the same assurance against laboratory attacks. Therefore, specifying shredding for both media types meets the regulatory requirement.

Answer

Block erase for SSDs and overwrite for HDDs.

Answer

Cryptographic erase for SSDs and degaussing for HDDs.

Answer

Purge using ATA Secure Erase for SSDs and Purge using degaussing for HDDs.

Question 5

A system is being disposed of, and the disposal plan includes sanitizing solid-state drives that contain sensitive but unclassified data. The drives will be reused within the same organization but in a different security domain with a lower sensitivity level. Which sanitization method is most appropriate?

Accepted Answer

Purge the drives using the manufacturer's approved sanitization command and verify the result before reuse.. Solid-state drives moving to a lower sensitivity domain require a purge because clearing is not sufficient for a domain change. Manufacturer-approved sanitization commands can purge the media, and verification confirms effectiveness before the drives are reused.

Answer

Physically destroy the drives and purchase new ones for the lower domain, documenting the destruction.

Answer

Clear the drives by overwriting all addressable locations with a single pass of random data.

Answer

Degauss the drives to remove all residual data before transferring them to the lower domain.

Question 6

A defense contractor maintains classified systems in a facility accredited under the NISP. A storage area network (SAN) array will be repurposed from a collateral Secret enclave to an unclassified R&D network. The ISSE must select the sanitization action that renders the array's magnetic disk media free of any residual data that could be recovered using laboratory techniques. Which action satisfies this requirement?

Accepted Answer

Disassemble the drives and physically shred the platters to particles no larger than the specified reduction size.. Repurposing media from a Secret enclave to an unclassified network requires assurance that no recoverable data remains. Physical destruction of the magnetic platters is the only method that eliminates remapped sectors, spare regions, and servo data without depending on drive firmware, encryption coverage, or degausser field adequacy. The other methods can leave remnants that laboratory techniques may recover.

Answer

Execute the array's built-in cryptographic erase and destroy all key material.

Answer

Perform a single-pass overwrite of every logical block address exposed by the SAN controllers.

Answer

Degauss each drive with a field strength rated for the media's coercivity.

Question 7

An ISSE supports a continuous integration pipeline where developers commit infrastructure-as-code that provisions security groups and logging agents. A recent audit found that a developer merged a change disabling flow logs in production without any independent review. Which control directly addresses this gap while preserving the pipeline's automated deployment model?

Accepted Answer

Require a second authorized reviewer to approve the merge request before the pipeline can deploy to production.. The audit finding is a separation-of-duties failure: one person changed a production security control without independent review. Requiring a second authorized approver on the merge request places a human control gate ahead of automated deployment, preserving pipeline speed while ensuring no individual can unilaterally weaken production security configuration.

Answer

Enable branch protection that prevents force pushes and requires signed commits from all contributors.

Answer

Grant developers read-only access to production and require operations staff to apply all infrastructure changes manually.

Answer

Configure the pipeline to run a static analysis scan on every commit and block deployment on high-severity findings.

Question 8

A federal information system is being decommissioned. The ISSE must ensure that hardware containing controlled unclassified information is disposed of in a manner that satisfies both the agency's media protection policy and its contract with a cloud service provider that hosted backups. Which action best addresses the disposal obligation for the provider-held backups?

Accepted Answer

Request a certificate of destruction from the provider covering the backup media.. When a provider holds backups of controlled unclassified information, the agency must obtain documented assurance that the media was sanitized or destroyed. A certificate of destruction provides that evidence and aligns with the media protection policy. Retaining data until a schedule expires, deleting portal references, or revoking access does not demonstrate that the information is gone.

Answer

Rely on the provider's standard data retention schedule to expire the backups.

Answer

Download the backups to agency storage and delete them from the provider portal.

Answer

Revoke the provider's access keys and close the service account.

Question 9

You are the security lead for a financial institution that is decommissioning a legacy server that processed credit card transactions. The server contains encrypted cardholder data. Legal requires that all data be irretrievably destroyed. The server has multiple hard drives that are still functional. Which disposal method best meets the requirement while also allowing for potential reuse of the drives?

Accepted Answer

Purge the drives using cryptographic erase by destroying the encryption keys.. Cryptographic erase is a Purge-level sanitization method that destroys the encryption keys, making the encrypted data unrecoverable. It is suitable for functional drives that may be reused because the media itself is not destroyed. This meets the legal requirement for irretrievable destruction while preserving the drives for potential reuse, unlike degaussing or shredding.

Answer

Clear the drives using a single-pass overwrite of all addressable sectors.

Answer

Physically destroy the drives by shredding them.

Answer

Degauss the drives to remove all magnetic traces.

Question 10

An ISSE is reviewing the change management process for a system that processes law enforcement sensitive data. A proposed emergency change will modify the audit logging configuration to reduce log volume during a peak period. The change must be implemented within four hours. Which action best preserves the security posture while meeting the timeline?

Accepted Answer

Implement the change under emergency change procedures with the security impact documented and a post-implementation review scheduled.. An emergency change to audit logging must proceed quickly but cannot bypass accountability. Using the emergency change procedure with documented security impact and a scheduled post-implementation review lets the change take effect within the four-hour window while ensuring the reduced logging is evaluated, compensated, and formally accepted or rolled back.

Answer

Deny the change because audit logging modifications always require full board approval.

Answer

Reduce log volume by filtering events at the collection tier instead of changing the source configuration.

Answer

Implement the change immediately and document it after the peak period ends.

Question 11

You are developing a decommissioning plan for a system that processes sensitive data. The plan must address both data remanence and the removal of the system from the network. Which two actions are essential to include in the decommissioning plan to ensure secure disposal? (Choose two.)

Accepted Answer

Revoke all certificates and credentials associated with the system.. Secure decommissioning requires sanitizing storage media to prevent data remanence and revoking credentials to eliminate access. These actions address the two primary risks: residual data and lingering trust. Updating disaster recovery plans, scanning for vulnerabilities, or archiving data are not essential for secure disposal and may even conflict with the objective.

Answer

Update the disaster recovery plan to remove the system.

Answer

Conduct a vulnerability scan of the system before decommissioning.

Answer

Back up all data to a long-term archive for potential future use.

Question 12

An ISSE is preparing a disposal plan for a system that has reached end of life. The system includes custom-developed software, commercial hardware, and interfaces to an external identity provider. Which TWO activities must be included in the disposal plan to address security and continuity obligations? (Choose two.)

Accepted Answer

Notify the external identity provider to revoke the system's registered client credentials and service accounts.. A disposal plan must close both the internal security boundary and any external trust relationships. Documenting the removal or transfer of unique security controls ensures no orphaned safeguard remains, and notifying the external identity provider to revoke credentials terminates the system's access path. Retention, unsanitized reuse, and public release do not satisfy disposal obligations.

Answer

Reassign the system's hardware to a new project without sanitizing the storage media.

Answer

Retain the production database indefinitely in case future litigation requires historical records.

Answer

Publish the system's source code to a public repository to preserve it for future reference.

Question 13

A financial services firm runs a three-tier web application on-premises. The security team must apply an emergency patch to the TLS library on all web servers because of an actively exploited vulnerability. The change management policy requires an emergency change process, but the firm's regulator mandates that production changes be traceable and approved by someone other than the implementer. Which sequence best satisfies both the emergency response need and the regulatory requirement?

Accepted Answer

Convene the Emergency Change Advisory Board (ECAB), obtain approval from a designated approver who is not the implementer, apply the patch, and document the outcome.. An emergency change still requires independent approval to meet the regulator's separation-of-duties mandate. The ECAB provides a fast-track approval path, and having a different person authorize the patch preserves the control while enabling rapid response. Applying the patch first or combining roles would violate the regulatory requirement, and waiting for the regular CAB would leave the exploited vulnerability unmitigated. Documenting the outcome completes the traceability chain.

Answer

Apply the patch immediately to all servers, then document the change and obtain retroactive approval from the change manager within 24 hours.

Answer

Have the security team lead both approve and apply the patch to shorten the response time, then notify the change manager afterward.

Answer

Wait for the next scheduled Change Advisory Board meeting to obtain approval, then apply the patch during the standard maintenance window.

Question 14

A healthcare provider is retiring an on-premises electronic health record (EHR) system that stored protected health information (PHI). The decommissioning plan includes data migration, media sanitization, and contract termination with the hardware maintenance vendor. The security engineer must ensure that residual PHI on the vendor's diagnostic laptops and spare parts inventory is addressed before the maintenance contract ends. Which action best closes this disposal gap?

Accepted Answer

Require the maintenance vendor to certify in writing that all diagnostic laptops and spare parts have been sanitized according to the organization's media disposal standard.. Third-party diagnostic equipment and spare parts can retain PHI from troubleshooting activities, so the decommissioning plan must extend sanitization requirements to vendor-controlled media. Requiring written certification against the organization's disposal standard provides assurance and audit evidence. Network scanning cannot prove data absence, and relying on generic contract clauses or future contract language leaves the current residual PHI unaddressed, which is a compliance risk under HIPAA.

Answer

Perform a network scan of the vendor's diagnostic laptops before contract termination to confirm that no PHI is present on their storage.

Answer

Terminate the maintenance contract immediately and rely on the vendor's standard end-of-contract clause to handle equipment disposition.

Answer

Include a clause in the new maintenance contract requiring future diagnostic devices to be sanitized, and let the current contract expire without further action.

Question 15

A government agency is decommissioning a legacy identity management system that issued smart card credentials. The system's hardware security modules (HSMs) contain root certificate authority (CA) private keys, and the directory database holds user attributes. The decommissioning team must decide how to handle the HSM keys and the directory data. Which two actions are required to properly dispose of the CA key material and user data while preserving the ability to validate previously issued credentials? (Choose two.)

Accepted Answer

Destroy the HSM root CA private keys using the HSM's secure zeroization function and record the destruction in the decommissioning log.. Proper disposal of a legacy identity system requires destroying the root CA private keys to prevent forgery while preserving public certificates and revocation information so existing credentials remain verifiable. Retaining private keys or leaving the directory database intact creates unnecessary risk and violates data lifecycle requirements. The two required actions balance security with the operational need for trust continuity during the transition period.

Answer

Migrate the directory user attributes to the new identity system and then leave the legacy database intact for historical reference.

Answer

Archive the root CA private keys in an offline vault so they can be used to re-sign certificates if validation issues arise later.

Answer

Delete the directory database by dropping all tables and removing the database files from the storage array without further sanitization.