Examkin

Question

Difficulty: MediumChange Management and Security Impacts

A DevOps engineering team plans to deploy an automated continuous integration and continuous deployment (CI/CD) pipeline update that alters how production application secrets are fetched and stored. To minimize potential security impacts and align with enterprise change management governance, which of the following procedures should be completed before deploying this change to production? (Select TWO.)

  1. Perform a security impact analysis and test the new secret management workflow within an isolated staging environment.Answer
  2. B
    Reclassify the secret storage mechanism from a technical control to a deterrent administrative policy to expedite release.
  3. Obtain approval from the Change Advisory Board (CAB) following a documented evaluation of the rollback strategy.Answer
  4. D
    Apply web application firewall (WAF) filtering rules to mitigate secret leakage vulnerabilities embedded directly within source code.

Answer

Prior to deploying a CI/CD pipeline change affecting application secrets to production, the team must evaluate the security impact in a staging environment and obtain CAB authorization alongside a validated rollback plan.
Proper change control requires validating security impacts in non-production environments and obtaining formal approval from governance bodies like the Change Advisory Board (CAB) supported by a verified rollback plan. This ensures both operational continuity and security posture preservation.

Step-by-Step Solution

1
Identify key requirements of enterprise change management
Recognize that change management requires testing security impacts in staging and securing formal approval before production release.
Deploying untested changes to production or bypassing change control increases operational and security risk.
2
Evaluate the correct operational and governance controls
Selecting staging environment security testing and CAB review with a documented rollback plan satisfies both security analysis and administrative compliance.
CAB review verifies risk exposure, while staging validation ensures secret isolation mechanisms function without breaking dependent services.
3
Eliminate inappropriate control actions and ineffective mitigations
Discard option suggesting control reclassification and option relying on external WAF rules to fix internal software flaws.
Reclassifying control types does not mitigate risk, and network perimeter controls cannot remediate application-level credential handling flaws.

Key Concept

Change Management Workflows and Security Impact Assessments
Rate this question

Topics

Change Management and Security Impacts

More questions from this topic