Secure Operations Change Management And Disposal practice questions

Recreate

Why it fails: Terminating all existing instances of the application pod simultaneously before scheduling the new version creates a temporary coverage gap where incoming requests lack security sidecar protection and traffic handling is completely disrupted. Administrators are often drawn to this approach because it guarantees that old and conflicting sidecar configurations never run concurrently within the same node namespace. It is the correct choice for resource-constrained development clusters where maintaining continuous service availability is unnecessary and a clean slate prevents state corruption during schema migrations.

Canary Release

Why it fails: Canary deployments route a small percentage of traffic to a new version to validate application logic with real users before full rollout. While tempting for minimising blast radius during updates, this partial-exposure mechanism fails here because security sidecars protect the main container concurrently; splitting traffic leaves the security posture fragmented and the target workload unprotected on canary instances. This strategy would be the correct choice when testing functional code changes in user-facing microservices where gradual validation of business logic under live load is required.

Blue/Green Deployment

Why it fails: While safe, it is a deployment strategy, not a native update mechanism for a singular pod update.

Perform a bit-level wipe using dd

Why it fails: You do not have physical access to the underlying hardware in AWS to perform bit-level wipes.

Run an Amazon Inspector scan

Why it fails: Amazon Inspector is designed for vulnerability management and assessing software configurations against security best practices, making it tempting if you were auditing storage instances for unpatched packages or exposed ports. However, it cannot render residual data unrecoverable or verify cryptographic erasure, failing to satisfy the physical sanitation and media sanitisation destruction mandates outlined in NIST SP 800-88 for safely decommissioning drives containing sensitive information.

Reformat the filesystem using mkfs

Why it fails: Running `mkfs` merely overwrites filesystem metadata tables rather than addressing the underlying raw storage blocks, leaving sensitive data recoverable via low-level disk carving tools and thus failing the NIST SP 800-88 sanitisation standard for high-risk media. System administrators often consider filesystem formatting when repurposing a drive for a new operating system or application within the same trust boundary, as it quickly resets directory structures and creates a clean mount point for routine operational reuse.

Transition to Standard

Why it fails: Classifying a request as Standard bypasses the rigorous assessment and authorization controls required for critical security patches by pre-authorising low-risk, routine tasks. This transition tempts administrators because Standard changes require minimal oversight and expedite repetitive operational deployments. It would be the correct choice when handling routine, pre-approved maintenance activities that possess a well-understood implementation path and negligible risk profile, which fundamentally contradicts the rigorous evaluation demanded by the Request for Change governance framework for security updates.

Transition to Closed

Why it fails: Closing a Request for Change prematurely skips the mandatory Assess, Authorize, and Implement phases required to validate and deploy a critical security patch. Moving directly to the Closed state is tempting because it represents the final administrative resolution of a ticket once all lifecycle stages are finished. This status would be the correct choice only after the patch has been fully deployed, verified in the production environment, and subject to post-implementation review to document successful completion.

Transition to New

Why it fails: Moving a Request for Change back to the "New" state is incorrect because that state is reserved exclusively for newly submitted tickets prior to initial triage and approval, violating the mandatory compliance workflow required before deploying a security patch. This option is tempting because practitioners naturally associate the creation of any fresh change ticket with the initial "New" stage of its lifecycle. It would be the correct choice if you were resetting an improperly drafted change request to start the assessment and authorisation process completely from scratch.

Sending a notification email

Why it fails: Archiving a cryptographic key without first verifying that no active systems require decryption operations will cause immediate operational outages, making administrative notifications entirely secondary to functional validation. Communicating retirement schedules to stakeholders is nevertheless tempting because stakeholder outreach is a standard procedural requirement in change management protocols to prevent downstream application failures. Such notification workflows are critical for alerting system owners and dependent application administrators well in advance of scheduled maintenance windows, but they cannot replace the technical necessity of escrow confirmation and dependency audits.

Updating the firewall rules

Why it fails: Modifying firewall configurations controls network-layer packet filtering and ingress or egress traffic paths, which has no cryptographic bearing on the secure archival, verification, or post-operational state of an enterprise key. Network perimeter controls are tempting because they are standard components of system deprovisioning and network isolation when decommissioning an application server or database instance. Updating firewall rules would be the correct choice when severing the network communication paths of a retired server to prevent residual traffic from reaching decommissioned service ports.

Overwriting the key in RAM

Why it fails: Clearing volatile memory addresses transient side-channel vulnerabilities during active runtime processing, making this action tempting when handling active cryptographic material to prevent memory-dump extraction. However, this measure focuses exclusively on short-term RAM sanitation rather than the persistent enterprise storage lifecycle. In the context of full cryptographic key decommissioning, the primary technical requirement is ensuring the permanent, auditable destruction of the master key material stored across persistent HSMs, backup media, and key management databases, rather than merely purging ephemeral operational memory instances.

Hardware degaussing

Why it fails: Degaussing renders a drive completely unusable by disrupting the magnetic field, whereas the 'Clear' status defined in NIST 800-88 requires the media to remain functional for subsequent reuse. This method is specifically designed for 'Destroy' sanitisation, where the physical integrity of the storage device is intentionally compromised. It serves as an effective solution when dealing with failed magnetic media that must be decommissioned permanently, ensuring that data is unrecoverable through the total neutralisation of the magnetic flux.

Cryptographic erasure

Why it fails: Cryptographic erasure involves sanitising media by sanitising the target data encryption key, which renders the data unrecoverable rather than overwriting the storage locations. While this technique is a recognised method within NIST 800-88, it represents the 'Purge' level of sanitisation rather than 'Clear'. Candidates often select this because it effectively protects data on modern encrypted drives; however, it fails the 'Clear' requirement because it does not involve the logical overwriting of addressable storage locations required for that specific standard.

Physical destruction

Why it fails: Physical destruction represents the 'Destroy' category within NIST 800-88 guidelines, which renders the media unusable and prevents any further data recovery. While this method provides the highest level of assurance for end-of-life hardware, it fails the 'Clear' requirement because 'Clear' focuses on logical sanitisation techniques that allow for the subsequent reuse of the storage device. Destruction is the correct choice only when the media has reached its end-of-life or when the sensitivity of the data necessitates permanent physical disposal.

Formatting the partition

Why it fails: Formatting a partition merely updates the file system metadata to mark sectors as available, leaving the underlying raw data intact within the NAND flash cells. While this process effectively clears logical access for day-to-day file management or preparing a drive for re-installation of an operating system, it fails to sanitise the physical storage medium. Consequently, data remains recoverable via forensic software, rendering it insufficient for the secure disposal of sensitive information where permanent, irreversible destruction is the mandatory security requirement.

Degaussing

Why it fails: Degaussing relies on a powerful magnetic field to disrupt the orientation of magnetic domains on storage media, which is ineffective against the NAND flash memory chips used in solid-state drives. Because SSDs store data as electrical charges within floating-gate transistors rather than magnetic patterns, the process leaves the data physically intact. This method remains the standard for sanitising legacy magnetic hard disk drives, where the magnetic field successfully scrambles the platter surface, but it fails to alter the state of semiconductor-based storage.

Implementing a change approval workflow that requires manager sign-off before security group changes.

Why it fails: A change approval workflow is a preventive control that ensures changes are authorized, but it does not detect unauthorized changes that bypass the workflow. It also does not provide continuous monitoring. The scenario specifically asks for detection of unauthorized changes, which requires logging and alerting.

Requiring multi-factor authentication (MFA) for all users who can modify security groups.

Why it fails: MFA is a preventive control that reduces the risk of credential compromise, but it does not detect unauthorized changes after they occur. It also does not provide an audit trail of who made changes or when. While important, MFA alone does not satisfy the detection requirement in the scenario.

Conducting quarterly access reviews of IAM policies and security group rules.

Why it fails: Quarterly access reviews are periodic and detective, but they are not real-time and may miss unauthorized changes that occur between reviews. They also do not provide immediate alerts. The scenario requires an effective control for detecting unauthorized changes, which implies timely detection, making continuous logging and alerting more appropriate.

Perform a cryptographic erase using the drive's built-in ATA Secure Erase command.

Why it fails: Cryptographic erase via ATA Secure Erase requires the drive to be powered on and functional. Since the SSD is non-functional, this command cannot be issued. Even if it could, the effectiveness depends on proper implementation and may not meet the assurance level required for CUI. Physical destruction is the reliable option here.

Overwrite the SSD with a single pass of random data using a software tool.

Why it fails: Overwriting requires the drive to be operational and accessible. A non-functional SSD cannot be overwritten. Moreover, overwriting SSDs is complicated by wear leveling and spare blocks, which may retain data. NIST SP 800-88 Rev. 1 does not recommend overwriting as a primary sanitization method for SSDs. This approach fails in the given scenario.

Degauss the SSD with a NSA EPL-listed Type II degausser.

Why it fails: Degaussing applies a strong magnetic field to erase magnetic media such as HDDs and tapes. SSDs store data in NAND flash memory cells, which are not affected by magnetic fields, so degaussing would leave the CUI intact. This method is ineffective for SSDs and would not satisfy sanitization requirements. The correct approach for a non-functional SSD is physical destruction or another approved method for flash media.

Enforce mandatory security awareness training for all employees annually.

Why it fails: Security awareness training is important for overall security, but it is not specific to the change management procedure for the SaaS application. The scenario focuses on controls that directly govern changes, such as authorization and testing.

Conduct a vulnerability scan after every change is deployed.

Why it fails: Vulnerability scanning is a good practice, but it is not a change management control per se. It is part of continuous monitoring. The critical controls for change management are approval, testing, and rollback, not post-deployment scanning.

Use a dedicated change advisory board (CAB) to review all changes.

Why it fails: While a CAB can be part of change management, it is not always required for every change, especially in agile environments. The more critical controls are formal approval by the system owner and having a rollback plan, which directly address authorization and reversibility.

Change Manager

Why it fails: The Change Manager coordinates and administers the change process but does not typically authorize changes. Authorization is the responsibility of the Change Advisory Board (CAB) or a designated authorizer. The Change Manager ensures that changes are assessed and scheduled but does not grant final approval for high-impact changes.

Configuration Manager

Why it fails: The Configuration Manager maintains the configuration management system and ensures that configuration items are recorded accurately. This role supports change management by providing configuration data but does not authorize changes. Authorization is a separate function performed by the CAB or Change Manager with delegated authority.

Service Desk Manager

Why it fails: The Service Desk Manager oversees the service desk operations and may be involved in change communication, but does not have the authority to approve changes affecting multiple critical systems. That authority rests with the CAB or a designated change authority. The Service Desk Manager's role is operational, not governance.

Degauss all four drives to disrupt the magnetic domains, then release the server for disposal.

Why it fails: Degaussing is effective only for magnetic media such as the three HDDs; it has no effect on the NAND flash cells in the SSD cache. Applying a magnetic field to the SSD would not render its data unrecoverable, so the CUI on that drive could remain accessible. This approach fails the Purge requirement for the complete media set and leaves residual risk.

Use the ATA Secure Erase command on the HDDs and the SSD, then verify the sanitization result.

Why it fails: ATA Secure Erase can satisfy Purge for many drives, but its implementation varies by manufacturer and firmware, and some SSDs implement it as a block erase that may not clear all remapped or over-provisioned cells. Without vendor-specific validation, relying on it for the SSD cache leaves uncertainty, so it is not the defensible choice for all media here.

Overwrite every drive with a single pass of random data using a software wiping tool, then confirm the tool's success log.

Why it fails: A single-pass overwrite does not meet Purge for modern magnetic media and is ineffective on SSDs because the controller may remap logical blocks, leaving original data in physical cells untouched. Software overwrite tools cannot guarantee coverage of spare or remapped areas, so CUI could persist. This method is insufficient for the required sanitization level.

Deleting partitions

Why it fails: Simply removing partition tables only alters the file system pointers, leaving the underlying sectors containing the actual sensitive data fully intact and easily recoverable with basic file carving tools, thus failing to achieve the cryptographic or overwrite threshold required by the NIST 'Purge' standard. Administrators often find this action tempting because it serves as the standard OS-level method for quickly freeing up storage space or preparing a drive for a fresh operating system installation where data recovery is not a security concern.

OS reinstallation

Why it fails: Reinstalling an operating system merely overwrites active file pointers and system directories, leaving residual data in unallocated clusters, slack space, and hidden partitions accessible via forensic tools, thus failing to meet the cryptographic erase, overwrite, or degaussing thresholds required to completely prevent recovery of magnetic media under the NIST 800-88 Purge standard. Administrators are often tempted to use this method because it successfully restores a factory state and prepares a machine for internal redeployment by clearing user-space configurations, making it the correct choice when a device is remaining within the organisation rather than being decommissioned for disposal.

File system encryption

Why it fails: File system encryption protects data at rest against unauthorised access on lost or stolen devices by scrambling the stored data, making it tempting for routine laptop decommissioning where physical theft is a concern. However, it fails the NIST 800-88 'Purge' standard because the cryptographic keys and underlying ciphertext remain intact on the magnetic media, meaning the data can still be theoretically recovered or decrypted if the key management practices fail. True 'Purge' requires overwriting all addressable storage locations or executing a cryptographic erase that permanently destroys the decryption key, rendering the ciphertext completely irrecoverable.

Terraform Refresh

Why it fails: Terraform Refresh synchronises the state file with the actual infrastructure configuration to detect drift, but it lacks any mechanism for access control or approval workflows. It is often mistaken for a security feature because it ensures the state file reflects real-world resource status, which is essential for accurate planning. This function is useful when you need to reconcile discrepancies between your code and deployed resources, yet it provides no gatekeeping capability to prevent unauthorised changes from reaching production environments.

Provider Aliases

Why it fails: Provider aliases are designed to configure multiple instances of the same provider within a single module, allowing simultaneous resource deployment across different regions or accounts, which makes them tempting when managing multi-environment architectures. However, they fail this scenario because they deal exclusively with provider instantiation and scoping rather than enforcing authorisation workflows, access controls, or review gates for security-critical changes.

State Locking

Why it fails: State locking prevents concurrent write operations and race conditions that corrupt the state file when multiple engineers run `terraform apply` simultaneously, making it tempting if you assume authorisation involves preventing conflicting deployments. However, it fails in this scenario because it operates purely as a concurrency control mechanism at the storage backend level rather than an access control gate. It cannot evaluate who is initiating the change, inspect the content of the execution plan for security-critical modifications, or enforce a peer-review workflow before production deployment.

Global Runner tags

Why it fails: Global runner tags restrict job execution to specific build agents based on hardware or licensing requirements, rather than governing branch access permissions or authorising merges. This option appears tempting because administrators often use runner tags to isolate secure environments and segregate workloads from standard pipelines. It would be the correct choice if the objective were to force compliance jobs to execute exclusively on hardened, dedicated runner hardware rather than controlling human authorisation workflows for merging code into protected branches.

Pipeline schedules for automated auditing

Why it fails: Pipeline schedules trigger jobs at predefined temporal intervals rather than enforcing access controls on incoming merge requests, meaning they cannot intercept or block unauthorized code changes to the master branch. They are tempting because they automate recurring security audits, vulnerability scans, and compliance reporting tasks, making them the correct choice when you need to execute periodic maintenance workflows independently of human code contributions.

Webhook integration with Jira

Why it fails: Relying on external webhook integrations to Jira facilitates ticket status synchronisation and project management tracking rather than enforcing repository-level access control within GitLab. Although this approach is tempting because it automates workflow governance and blocks merges until associated issues meet defined criteria, it operates downstream as an administrative check. It fails this scenario because it cannot natively restrict source code branch permissions or cryptographic merge requests directly inside the version control platform.

Run a virus scan

Why it fails: Running a virus scan fails to address the fundamental requirement of data sanitisation, as it merely identifies malicious software rather than rendering stored information unrecoverable. This action is tempting because it is a standard maintenance procedure used to ensure system integrity and security before transferring ownership or decommissioning hardware. While virus scanning is essential for verifying that a device is free of malware before repurposing, it does not achieve the permanent destruction of sensitive data necessary for secure disposal.

Physically destroy the hardware

Why it fails: Physical destruction represents the final stage of the sanitisation lifecycle rather than the initial preparation phase. While this method guarantees the permanent unrecoverability of data by rendering the storage medium unusable, it prematurely terminates the asset's utility. This action is the correct choice only when dealing with highly sensitive media that has reached its end-of-life or when cryptographic erasure fails, as it prevents any further forensic recovery of information after all other logical sanitisation processes have been exhausted.

Send it to recycling

Why it fails: Sending hardware to a recycler prematurely exposes sensitive data to third-party handlers before sanitisation has occurred, violating the fundamental requirement for data destruction. While recycling is the ecologically responsible final stage for decommissioned assets, it only follows the successful execution of cryptographic erasure or physical destruction. This option attracts candidates because it represents the standard lifecycle conclusion for hardware, yet it fails here because it lacks the necessary security controls to render stored information unrecoverable prior to physical transfer.

To calculate the budget

Why it fails: Budget calculations rely on financial forecasting, procurement schedules, and resource planning rather than the security categorisation determined by Federal Information Processing Standards (FIPS) 199. FIPS 199 specifically evaluates potential impact on confidentiality, integrity, and availability to establish baseline security controls under NIST Special Publication 800-53, rather than governing fiscal allocations. Reviewing financial metrics would be the correct focus when developing a project cost proposal or responding to an annual budgetary review during the planning phase of system procurement.

To verify physical location

Why it fails: FIPS 199 deals strictly with information security categorisation based on confidentiality, integrity, and availability impacts, making physical facility location entirely irrelevant to this specific impact assessment process. Reviewing physical locations would instead be tempting when auditing environmental controls, physical access perimeters, or site-specific contingency planning under NIST SP 800-53 physical and environmental protection security controls, but it does not determine the baseline security impact level of a system change.

To update the system inventory

Why it fails: Updating the system inventory addresses asset management rather than evaluating how modifications alter confidentiality, integrity, and availability baselines defined by Federal Information Processing Standards. This distractor is tempting because configuration management and change control procedures naturally require tracking hardware, software, and data inventories when modifications occur. Such an inventory review becomes the correct choice during hardware or software refresh cycles where asset registers, configuration item lists, and baseline documentation must reflect physical or logical additions and removals.

Data leakage

Why it fails: Data leakage protection addresses the exfiltration of sensitive intellectual property or corporate data, making it a plausible concern during standard IT system modifications where business databases are accessed. However, in an Industrial Control System implementation phase, the overriding priority is maintaining physical process safety, real-time availability, and avoiding catastrophic operational disruptions. While confidentiality remains a security objective, unauthorized disclosure does not directly threaten physical safety or cause immediate operational failure in the way that improper patching, unauthorized PLC firmware overwrites, or misconfigured real-time network rules do. Therefore, data leakage fails to address the immediate physical and availability threats inherent to operational technology deployment.

Loss of audit logs

Why it fails: Loss of audit logs represents a failure in accountability rather than a direct threat to the operational stability of an ICS. While maintaining a comprehensive audit trail is vital for post-incident forensics and regulatory compliance, it does not directly cause the process disruption or safety hazards that define the 'Implement' phase of an ICS change. This option remains a valid concern during security auditing or incident response scenarios, where the absence of logs prevents the reconstruction of unauthorised access or malicious configuration changes.

Unauthorized access

Why it fails: Unauthorized access represents a persistent security concern rather than the primary operational hazard during the implementation of industrial changes. While robust identity controls managed via Microsoft Entra ID are essential for securing administrative interfaces, the implementation phase of an ICS focuses on physical process stability and safety. This option appears attractive because access control is a fundamental security pillar, yet it fails to address the immediate risk of process disruption or equipment damage inherent to modifying live industrial control logic.

SSDs have internal encryption

Why it fails: Degaussing relies on exposing magnetic media to a powerful magnetic field to disrupt the alignment of magnetic domains, a process that has no physical effect on the NAND flash memory cells used in SSDs. While this method is highly effective for sanitising traditional Hard Disk Drives by destroying the magnetic orientation of the platters, it fails to alter the electrical charge states within an SSD. Consequently, the data remains fully intact and accessible despite the application of the magnetic field.

SSDs are too thin

Why it fails: Degaussing relies on magnetic fields to disrupt the orientation of magnetic domains on traditional hard disk platters, whereas SSDs store data using electrical charges within NAND flash memory cells. Because SSDs lack magnetic storage media, a degausser fails to alter the state of the stored bits. This option appears logical because degaussing is the standard, highly effective method for sanitising legacy magnetic media, such as tape drives or spinning hard drives, where total magnetic erasure is required to ensure data remains unrecoverable.

SSDs have wear leveling algorithms

Why it fails: Wear levelling manages the physical mapping of logical blocks to flash cells to extend component lifespan, yet it remains irrelevant to degaussing because SSDs store data using electrical charges in floating-gate transistors rather than magnetic fields. Degaussing effectively sanitises magnetic media like hard disk drives by disrupting magnetic domains, making it a tempting choice for legacy storage disposal. However, it fails to influence the non-volatile memory cells of an SSD, which require cryptographic erasure or physical destruction to ensure data remains unrecoverable.

chown

Why it fails: `chown` modifies file ownership and user permissions rather than evaluating cryptographic hashes or checksums, meaning it cannot detect unauthorized modifications or corruption in downloaded patch files. Administrators are often tempted to use this utility during maintenance windows because patch deployment requires adjusting file and directory ownership so that updated binaries execute under the correct service accounts or root privileges.

dd

Why it fails: `dd` is a low-level utility designed for bit-stream copying, disk cloning, and raw device input/output, which fails this scenario because it lacks any cryptographic hashing or signature verification capabilities required to validate binary file integrity. It is tempting because administrators frequently use it during maintenance windows to create exact sector-level backups or image drives prior to applying patches, where it would be the correct choice for safe disaster recovery preparations.

chmod

Why it fails: `chmod` is completely unsuited for verifying file integrity because it modifies filesystem permissions and access control lists rather than evaluating cryptographic checksums or hashing algorithms like SHA-256. It is tempting because administrators routinely execute permission adjustments during the staging phase of a maintenance patch update to ensure binaries are executable before deployment. However, while it successfully establishes correct execution rights, it offers zero cryptographic verification to detect data corruption or tampering.

To perform technical code reviews

Why it fails: Technical code reviews fall under the remit of developers or automated quality assurance pipelines rather than the strategic oversight provided by a CAB. While this option is tempting because rigorous peer review is a critical component of successful change management, those technical assessments occur at the implementation level. A CAB functions instead to evaluate the business risk, scheduling, and resource impact of proposed changes, ensuring alignment with organisational objectives rather than scrutinising individual lines of source code.

To manage hardware procurement

Why it fails: Hardware procurement falls under the remit of asset management and financial planning rather than the risk-based assessment of service changes. This option is tempting because IT departments frequently bundle physical infrastructure upgrades with the change management process to ensure budgetary approval. However, a Change Advisory Board focuses exclusively on evaluating the technical and business impact of proposed modifications to the production environment, whereas procurement teams handle the transactional lifecycle of acquiring new physical components.

To conduct system testing

Why it fails: System testing falls under the remit of technical teams or quality assurance specialists rather than a governance body. The Change Advisory Board focuses exclusively on the assessment, prioritisation, and authorisation of proposed changes to minimise operational risk. This option appears attractive because testing provides the empirical evidence required for the board to make an informed decision. It would be the correct answer if the question asked for the specific activity performed by a development or testing team to validate technical requirements before submission.