Change Management, Version Control, and Disaster Recovery CCISO Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A software development team is adopting a version control system to manage changes to their application code. The team wants to ensure that multiple developers can work on different features simultaneously without interfering with each other, and that they can later integrate their changes. Which version control feature is most directly designed to support this requirement?

   • AAccess control and permissions
   • BBranching and merging
   • CCommit history and logging
   • DTagging and labeling
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A network engineer is implementing a change to the company's VPN concentrator. The change request was approved, but during implementation the engineer discovers that the new configuration causes authentication failures. What should the engineer do?

   • AContinue implementing the change and troubleshoot the authentication issue after the change window.
   • BAsk the CAB to approve a new change while the current change is still failing.
   • CExecute the rollback plan to restore the previous configuration, then document the issue in the change record.
   • DModify the configuration on the fly to fix the authentication issue without updating the change record.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company has implemented a new disaster recovery plan and wants to validate that the plan works without causing disruption to production operations. The company wants to test the recovery procedures in a controlled manner, but it is acceptable to shut down a non-critical system to simulate a failure. Which type of disaster recovery test is most appropriate for this scenario?

   • AA parallel test, where the recovery site is activated and production continues to operate normally.
   • BA checklist review, where the plan is reviewed for completeness but not executed.
   • CA simulation test, where a disaster is simulated but no actual recovery is performed.
   • DA full interruption test, where production is shut down and recovery is performed from the primary site.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security team is adopting version control for their infrastructure-as-code (IaC) templates. They want to ensure that only authorized team members can push changes to the main branch. What should they configure?

   • AA post-commit hook that sends an email to the team after every push to main.
   • BA naming convention for branches but no restrictions on who can push to main.
   • CA shared account that all team members use to push changes directly to main.
   • DBranch protection rules that require pull request reviews and restrict direct pushes to the main branch.
   Reveal Solution Discussion Select an answer first
6. 45expert · medium

   A security team manages firewall rules using a version-controlled text file. Two administrators are working on different changes: one is adding a new rule, and the other is modifying an existing rule. They both commit their changes to the same branch. What is the best practice to avoid conflicts and maintain a clean history?

   • AUse a shared network drive and have one administrator edit the file at a time.
   • BHave one administrator make both changes to avoid conflicts.
   • CHave both administrators work on the same branch and commit frequently, resolving conflicts as they occur.
   • DCreate separate branches for each change, then merge them into the main branch after review.
   Reveal Solution Discussion Select an answer first