CCNA Secure Operations Change Management And Disposal Questions

The 'Assess' state in ServiceNow involves the Change Advisory Board (CAB) review, which is a mandatory control gate for security-critical changes.

Rolling updates allow for updating pods incrementally, ensuring the security sidecar is active throughout the transition.

A robust policy requires defined roles, a clear process flow, and mandatory audit logging to ensure accountability and compliance.

Phased rollouts, automated rollback, and canary testing are standard industry practices to limit the blast radius of a failed change.

FIPS 199 defines the impact level (Low, Moderate, High), which dictates the rigor of the change management testing requirements.

Inventory management and secure media sanitization are critical to preventing data leakage during decommissioning.

Changes that have a significant risk or potential for wide-reaching impact must undergo CAB review to ensure proper oversight.

The System Disposal Plan or Data Sanitization Policy outlines the specific requirements for decommissioning equipment to ensure no sensitive data remains.

sha256sum calculates a cryptographic hash that can be compared against a known good value to verify binary integrity.

Sentinel policies in Terraform Enterprise allow for Policy-as-Code, enabling automated enforcement of security rules before infrastructure is provisioned.

The 'Clear' method uses logical techniques (like overwriting) to sanitize data in user-addressable storage locations, ensuring it cannot be recovered through simple file recovery tools.

The CAB is responsible for assessing, prioritizing, and authorizing changes to prevent unauthorized or risky changes from impacting the environment.

Creating an inventory ensures that all components, including peripherals and secondary storage, are accounted for prior to sanitization.

In ICS/SCADA environments, system availability is paramount; uncoordinated changes can cause catastrophic operational failure.

Degaussing is the only method listed that specifically aligns with the Purge standard for magnetic media by exposing the drive to a strong magnetic field.

Emergency changes are driven by urgent threats or failures, while standard changes follow a pre-approved, well-understood process.

Archiving the key is necessary to decrypt legacy data that was encrypted with the old key, otherwise, that data becomes permanently inaccessible.

Standard changes are pre-authorized, low-risk, and routine, allowing them to bypass the full CAB review for efficiency.

AWS performs physical destruction of the underlying storage media when a volume is deleted; however, the cryptographic erasure via AWS KMS key deletion is the standard for secure disposal in the cloud.

Separation of duties prevents a single individual from introducing malicious code and deploying it into production, a critical control for integrity.

The System Security Plan (SSP) is the authoritative document describing a system's security controls; removing a system requires updating this document to reflect the change in boundary.

Moving data to offline, immutable storage (WORM) ensures compliance with retention policies while protecting against unauthorized modification or deletion.

GitLab protected branches allow for granular permissions to restrict who can push or merge, which is a standard security control for change management.

NIST SP 800-53 SA controls (System and Services Acquisition) specifically cover the lifecycle management, including initial configuration and security baseline maintenance.

A PIR ensures the change achieved its goal, did not introduce new vulnerabilities, and met compliance requirements.

NIST 800-88 suggests physical destruction, degaussing (if permitted, though not for SSDs), or cryptographic erasure for SSDs, though physical destruction is most definitive.

A decommissioning plan must ensure data is properly handled and that the asset is removed from all relevant inventories for regulatory compliance.

SSDs store data using floating gate transistors (NAND flash), which are not susceptible to magnetic fields, unlike traditional spinning disks.