CSLLP Software Deployment, Operations, and Disposal 2

Question 1

What is the purpose of an incident response plan (IRP) in software operations?

Accepted Answer

To provide a structured approach for detecting, containing, eradicating, and recovering from security incidents

Answer

To document software deployment procedures

Answer

To specify change management approval workflows

Answer

To define SLAs for system availability

Question 2

Which disposal technique renders data on storage media unrecoverable by overwriting it multiple times with random data?

Accepted Answer

Secure wiping/overwriting

Answer

Degaussing

Answer

Cryptographic erasure

Answer

Physical destruction

Question 3

What is the security significance of maintaining an audit log in production systems?

Accepted Answer

Audit logs provide a tamper-evident record of actions taken, supporting forensic investigation and accountability

Answer

Audit logs improve system performance by caching frequently accessed data

Answer

Audit logs replace the need for access controls

Answer

Audit logs are required only for financial transaction systems

Question 4

Which process involves systematically identifying and documenting all software assets and their versions in a production environment?

Accepted Answer

Software inventory management / asset management

Answer

Change management

Answer

Vulnerability management

Answer

Release management

Question 5

What is a key security requirement for decommissioning a system that stored sensitive data?

Accepted Answer

Sanitizing all storage media to ensure no sensitive data can be recovered from decommissioned hardware

Answer

Archiving all system logs to cold storage

Answer

Transferring all data to the replacement system before shutdown

Answer

Revoking only the service account credentials

Question 6

Which security practice involves regularly reviewing and removing user accounts and access rights that are no longer needed?

Accepted Answer

Access recertification / account lifecycle management

Answer

Penetration testing

Answer

Threat modeling

Answer

Security awareness training