Examkin

Question

Difficulty: MediumChange Management and Security Impacts

A healthcare organization's cloud operations team plans to update the TLS configuration on its primary API gateways by disabling TLS 1.0 and 1.1 to comply with updated security baselines. Before the Change Advisory Board (CAB) approves this modification, which action should the security team mandate to evaluate the potential security and functional impact of the proposed change?

  1. Perform an inventory and dependency analysis to identify internal and legacy external systems that rely on older encryption protocols.Answer
  2. B
    Apply an emergency firewall exception that permits unencrypted HTTP fallback traffic during the maintenance window.
  3. C
    Initiate an automated rollback script immediately prior to submitting the formal change request to verify backout readiness.
  4. D
    Reclassify the protocol deprecation as a standard emergency change to expedite deployment without pre-implementation review.

Answer

Perform an inventory and dependency analysis to identify internal and legacy external systems that rely on older encryption protocols.
Performing a thorough dependency analysis allows the security and operations teams to identify legacy applications, client software, or third-party services that depend on older TLS versions. Discovering these dependencies before the Change Advisory Board (CAB) approves the request ensures that potential outages are identified early, remediation plans are established, and security impacts are fully understood.

Step-by-Step Solution

1
Evaluate the scope of the proposed infrastructure change.
Disabling legacy cryptographic protocols (TLS 1.0/1.1) affects all incoming client connections that have not updated to modern TLS standards.
Changes to security baselines can break dependent systems if clients rely on deprecated protocol suites.
2
Identify necessary pre-approval change control procedures.
A comprehensive dependency analysis must be conducted to discover legacy integrations, API consumers, and client applications.
Change management policy requires assessing potential operational disruptions and security impacts before CAB approval.
3
Select the option that properly executes a security impact assessment within the formal change control lifecycle.
Conducting an inventory and dependency audit provides empirical risk data to the CAB.
Proactive dependency analysis prevents unexpected service outages and maintains secure operations.

Key Concept

Change Management Security Impact and Dependency Analysis
Rate this question

Topics

Change Management and Security Impacts

More questions from this topic