CSLLP Software Deployment, Operations, and Disposal 2 — Questions and Answers
Question 1: What is the purpose of an incident response plan (IRP) in software operations?
- To document software deployment procedures
- To provide a structured approach for detecting, containing, eradicating, and recovering from security incidents (Correct answer)
- To specify change management approval workflows
- To define SLAs for system availability
Correct answer: To provide a structured approach for detecting, containing, eradicating, and recovering from security incidents
An IRP defines roles, responsibilities, and procedures that enable an organization to respond effectively to security incidents, minimizing damage and recovery time.
Question 2: Which disposal technique renders data on storage media unrecoverable by overwriting it multiple times with random data?
- Degaussing
- Cryptographic erasure
- Physical destruction
- Secure wiping/overwriting (Correct answer)
Correct answer: Secure wiping/overwriting
Secure overwriting (data wiping) replaces existing data with random or patterned bit sequences multiple times, making recovery impractical without physical destruction.
Question 3: What is the security significance of maintaining an audit log in production systems?
- Audit logs improve system performance by caching frequently accessed data
- Audit logs provide a tamper-evident record of actions taken, supporting forensic investigation and accountability (Correct answer)
- Audit logs replace the need for access controls
- Audit logs are required only for financial transaction systems
Correct answer: Audit logs provide a tamper-evident record of actions taken, supporting forensic investigation and accountability
Audit logs create a chronological, tamper-evident record of system and user activities, which is essential for detecting incidents, conducting forensic investigations, and demonstrating compliance.
Question 4: Which process involves systematically identifying and documenting all software assets and their versions in a production environment?
- Change management
- Software inventory management / asset management (Correct answer)
- Vulnerability management
- Release management
Correct answer: Software inventory management / asset management
Software asset management maintains an accurate inventory of all software deployed in the environment, enabling rapid identification of systems affected when new vulnerabilities are disclosed.
Question 5: What is a key security requirement for decommissioning a system that stored sensitive data?
- Archiving all system logs to cold storage
- Sanitizing all storage media to ensure no sensitive data can be recovered from decommissioned hardware (Correct answer)
- Transferring all data to the replacement system before shutdown
- Revoking only the service account credentials
Correct answer: Sanitizing all storage media to ensure no sensitive data can be recovered from decommissioned hardware
Before decommissioning, all storage media containing sensitive data must be sanitized using approved methods (overwriting, degaussing, or physical destruction) to prevent data recovery.
Question 6: Which security practice involves regularly reviewing and removing user accounts and access rights that are no longer needed?
- Penetration testing
- Access recertification / account lifecycle management (Correct answer)
- Threat modeling
- Security awareness training
Correct answer: Access recertification / account lifecycle management
Access recertification is a periodic review process that ensures user accounts and permissions are still appropriate, removing stale accounts and over-provisioned access rights.
CSLLP Software Deployment, Operations, and Disposal 2
What is the purpose of an incident response plan (IRP) in software operations?