Secure Configuration and Version Control CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is one of the primary benefits of using version control for managing code and configuration changes?

   • AIt guarantees that code is bug-free
   • BIt automatically fixes security vulnerabilities
   • CIt provides a historical record of changes
   • DIt eliminates the need for testing
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is it important to document configuration settings and changes?

   • ATo reduce the need for security testing
   • BTo increase the system's performance
   • CTo make the system easier to use for end users
   • DTo provide a record for troubleshooting and auditing
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of defining a secure baseline configuration for a system?

   • ATo simplify user administration
   • BTo ensure consistent and secure settings across all systems
   • CTo maximize system performance
   • DTo reduce the need for patch management
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During an audit, an external auditor requests evidence that a specific security configuration change was approved and implemented correctly. The company has a change management process but documentation is scattered across emails and spreadsheets. What is the best way to provide the required evidence?

   • AReconstruct the change details from memory and write a summary for the auditor.
   • BProvide the auditor with the email thread where the change was discussed and approved.
   • CShow the auditor the current configuration and explain that it matches the intended change.
   • DMaintain a centralized change log that records the change request, approval, implementation details, and verification results.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is required to maintain documentation of all configuration changes for compliance with industry regulations. The documentation must be sufficient to support incident response activities. Which documentation practice is most effective?

   • AKeep a simple list of changes with only the date and the person who made the change.
   • BStore configuration change documentation in personal email folders of the administrators.
   • CDocument changes only when a security incident occurs.
   • DRecord the date, author, reason, and impact of each configuration change in a central repository.
   Reveal Solution Discussion Select an answer first