- So welcome to lesson three, deep dive quiz.
Now, lesson three was all about explaining the importance
of change management processes and the impact to security.
And we had two lessons, lesson 3 1,
configuration management
and lesson 3 2, change management.
So in our deep dive quiz
we're gonna work together to answer five questions.
Are you ready?
Alright, let's start.
Which statement is not true about baseline configurations?
The word not here is important, not true.
It's an aggregation of components
treated as a single entity,
it's used as a basis for future builds,
modifications should go through
the change management process,
it is a set of specifications.
So put me on pause if you need to, right?
But you're gonna choose which statement
is not true about baseline configurations.
It's an aggregation of components
treated as a single entity, a basis for future builds,
modifications should go through
the change management process
or it's a set of specifications.
Three of those are true, one is not.
Which one are you gonna choose?
Well, I'm gonna choose the first one
because an aggregation of components treated
as a single entity is not a baseline configuration.
It's a configuration item.
Now, it is true about baseline configurations
that it's a basis of future builds.
That modifications should go through
the change management process, and it is a set
of specifications for that configuration item.
So I'm choosing that one, do you agree?
No? It's correct.
Alright, question two.
Your organization is making strides
in maturing its configuration management
and automated provisioning process.
The guiding principle is to use automation
to replace rather than fix.
What term best describes this principle?
Immutability, idempotence, infrastructure-as-code
or demand generated resource allocation.
Immutability, idempotence, infrastructure-as-code
or demand generated resource allocation.
Put me on pause if you need to.
Well, I'm gonna choose the first one.
Immutability or an immutable system, right
is the idea that we're not gonna try to fix.
We're only created and destroyed.
Idempotence, right?
Is the principle
that every time we run a configuration script
we should have the same exact results.
Infrastructure-as-code is using code to create systems
and demand generated resource allocation is just about the
in an autonomic manner we can add.
So provision and de-provision resources.
Do you like immutability?
Let's try it.
And that is correct.
Alright, question three.
The network engineering team is determined that a change
to the server configuration baseline is necessary.
How would you advise them to proceed?
Test the change.
Seems like a pretty good idea.
Follow change management procedures,
also seems like a good idea.
Submit a change request form.
Well, absolutely, they should be doing that.
Design a rollback strategy.
A hundred percent they should be doing that.
Uh-oh, what are we gonna do now?
It looks like all four
of those answers are really good answers.
So what did I tell you earlier?
When you see multiple answers
that you're really convinced or correct
I want you to put yourself in the mindset
that this is a hierarchical question
and that one of those answers
is going to encompass the other.
Test the change, follow change management procedures,
submit a change request, design a rollback strategy.
One of those encompasses the other three.
Which one is it?
Put me on pause if you need to while you think through it.
Well, I'm gonna choose the second answer
which is follow change management procedures.
Because testing the change,
submitting a change request form
and designing a rollback strategy are all part
of my change management procedures.
So that's the one I'm gonna go with.
You like it?
I hope so.
It's the correct answer.
Alright, question four.
And this time we're going to put
the configuration management workflow in the correct order.
So we'll start
with the very first thing we're gonna do as number one.
Now our options are research, publish, propose,
define objectives and requirements, approve or implement.
So we're gonna put these in the correct order, one to six.
This is an awesome one to put me on pause for
so you can write them all down.
So what's the first thing that we're gonna be looking for?
Well, the first thing, right?
When we're arranging our
doing our configuration arrangement workflow is figuring out
what are we doing and why are we doing it?
So that would be defining our objectives and requirements.
Now, once we know what we're doing
and kind of why we're doing it, we will probably research.
And that's already in number two.
Once we have researched
and we have come up with our plan, right?
Our proposal, well, we'll actually have to propose it.
So we've defined a requirement, we've researched,
we've proposed, now before we can move forward
it must be approved.
Now it'll be approved
at different levels in the organization
really depending upon what the configuration is.
From there, we're gonna publish it out
so everybody knows it
and then we're gonna implement it.
So define objectives, research, propose,
approve, publish, implement.
That would be our workflow.
Do you like it?
Let's check it out, and it is correct.
Alright, our last question, and this one's a matching.
We're gonna match the following change management components
with their descriptions.
So we've got recovery to a previous state, regression
and interoperability, prioritization, authorization
and evaluation of risks and benefits.
That's on our left hand side.
On our right hand side
we've got rollback and impact analysis,
alignment with business needs, testing, and accountability.
So these aren't necessarily one to one definitions,
they're really descriptions if you will, of an activity.
So if we start right up on the left hand side
recovery to a previous state, oh, look at that.
It's right there.
There's our rollback.
So that's pretty easy.
Regression and interoperability.
I wanna make sure that the change is going to work
and how am I gonna make sure the change is gonna work?
I'm probably gonna have to do some testing.
Prioritization, authorization and evaluation of risks
and benefits are what I have left.
So again, sometimes you may not be sure of the answer.
So start doing a little process
of elimination as much as possible.
Alignment with business needs
probably evaluation of risks and benefits.
Authorization means who authorized it,
who can be held accountable.
So I like authorization
and accountability and prioritization and impact.
Now, wait.
When I go through that,
I don't think that's actually gonna be right.
So when you're doing your test, take your time.
Kinda after you've done your first pass through, go and say
is that really what I meant?
I think prioritization is what we're going to do
in alignment with business needs
and might impact analysis
is a valuation of risks and benefits.
So recovery to a previous state, rollback.
Regression and interoperability describes testing.
Prioritization, we're gonna do that
in alignment with business needs.
Authorization, that's all about accountability.
Who said we could do this?
And evaluation of the risks and benefits.
That's gonna be an impact analysis.
What do you think, did we do the right thing?
Let's check it out.
And that is correct.
You know, I can't stress enough
in your exam how important reading for comprehension is
and also just taking your time.
A lot of people really just try to rush through the exams
as if getting done quicker is gonna get them extra points.
It's not.
And when you rush, when you don't read all the answers,
when you don't read the question thoroughly,
when you don't take your time after you've answered to say
is that really what I meant?
That's the time
you're probably gonna get the question wrong
even though you had the knowledge.
You weren't able to apply it appropriately.
So make sure again
you're taking your time when you're answering questions.
Alright, let's see how we did.
Oh, we did a great job.
We got five out of five.
Alright, up next
we're gonna do one of my absolute favorite topics.
We're gonna go into lesson four, explain the importance
of using appropriate cryptographic solutions.
I'll see you there.