Security Procedures

1. An IT administrator proposes a change to the production database schema to improve performance. The Change Control Board reviews the proposal and notes that no rollback procedure is documented for the change. What should the CCB do, and why is a backout plan required?

A. Approve the change anyway; rollback procedures can be created during the change window if something goes wrong B. Reject or table the change until a backout plan is documented; without a rollback procedure, a failed change may leave the system in an undefined state with no clear path to recovery C. Approve the change but require a backup of the database, which serves as an implicit rollback plan D. Forward the change to the CISO for approval since database changes are always high-risk

2. A new marketing analyst joins the company. During onboarding, IT creates an account with read/write access to all company marketing files, read access to the finance department's files (in case collaboration is needed), and local administrator rights on the workstation. What security principle was violated, and what should the access have been?

A. No principle was violated; broad initial access reduces future access request tickets B. Least privilege was violated; the analyst should receive only the permissions required for current job responsibilities (marketing files); finance access and local admin should require separate formal justification and approval C. Separation of duties was violated; marketing analysts cannot have write access to any files D. The principle of defense in depth was violated; the account should have had two-factor authentication enabled before any access was granted

3. A systems administrator is terminated for cause. The HR team requests that IT immediately delete the former administrator's Active Directory account. The security team objects and says the account should only be disabled. What is the security reason for disabling rather than deleting the account?

A. Deleted accounts can be used by attackers to create new accounts with the same name, creating a security risk B. The account may be associated with encrypted data, EFS certificates, digital signatures, or other records; deleting it may permanently destroy the ability to decrypt files the administrator encrypted, making data irrecoverable C. Account deletion requires CCB approval; HR cannot initiate a deletion without formal change control D. Deleted accounts create gaps in the audit log timeline that could compromise any legal investigation of the termination

4. A security analyst receives a SIEM alert for ransomware activity on an endpoint. Within 30 seconds, the endpoint is isolated from the network, a ticket is created, the on-call analyst is notified via SMS, and threat intelligence is queried for the malware hash — all without any human action. What technology enabled this automated response?

A. SIEM — the SIEM executed the containment actions directly through its built-in response capabilities B. SOAR (Security Orchestration, Automation, and Response) — it executed a pre-defined playbook automatically when the trigger condition was met, coordinating actions across multiple security tools C. EDR — endpoint detection and response platforms can automatically notify helpdesk and query threat intelligence independently D. XDR — extended detection and response replaced all SIEM functions including automated containment

5. A security playbook for phishing response states: "Step 3: If the email reached more than 50 mailboxes, escalate to the IR lead and engage the communications team. If fewer than 50 mailboxes, proceed to Step 4." What feature of security playbooks does this demonstrate?

A. Automation — this decision is made automatically by the SOAR platform without human intervention B. Conditional logic — playbooks include decision points that direct responders to different steps based on specific criteria, enabling appropriate response scaling based on incident scope C. Risk scoring — playbooks assign numerical risk scores to incidents to prioritize response D. Chain of custody — the branching logic documents which analyst handled each phase of response

6. A global organization with 15 business units in 12 countries decides that each business unit's local IT team will manage its own security with independent decision-making authority, while the central CISO sets minimum baseline standards that all units must meet. What governance model is this?

A. Centralized governance — the CISO sets all security standards and all decisions flow through the central team B. Federated (hybrid) governance — central standards set enterprise-wide minimums; business units have authority for local implementation decisions within those standards C. Decentralized governance — each business unit operates completely independently with no central oversight D. Regulatory governance — government regulators in each country set the security standards for each local business unit

Matching: Security Procedure Concepts

Match each concept (1–4) to its correct description (A–D).

1Change Control Board (CCB)

2SOAR

3Offboarding account disable

4Onboarding hardware provisioning

ANew employees should receive pre-configured devices with security tools installed rather than blank hardware, ensuring consistent security baseline from day one

BThe formal governance body that reviews and approves or rejects proposed system changes after evaluating scope, risk, impact, and rollback plans

CAccounts are set to inactive rather than removed on an employee's last day, preserving encrypted data, certificates, and digital signatures associated with the account

DA platform that connects security tools and executes playbook steps automatically in response to trigger conditions, reducing response time from minutes to seconds

Security Procedures — Quiz