Pass ISC CISSP Exam in First Attempt Guaranteed!

Unprepared rollback can amplify failure and corrupt state. The proposal would not be defensible for this case.

This is appropriate for a later condition (The system moves to immutable deployment artifacts rather than in-place changes.), but it does not directly resolve the initial need. Immutable infrastructure changes recovery mechanics but does not remove rollback duty.

This response addresses a different condition: A firewall engineer must deploy an urgent ACL change to restore a failing emergency service. The present case requires the measure described by Prepare tested backout procedures, dependency checks and rollback decision thresholds before deployment.

This is a limitation elsewhere: A firewall engineer must deploy an urgent ACL change to restore a failing emergency service. It does not explain the deficiency of the specified proposed approach.

This explains a later shift in requirements (The system moves to immutable deployment artifacts rather than in-place changes.), not the failure of the current proposal.

This is an advantage of another design (Use documented emergency change approval, scoped testing, rollback plan and retrospective review.), not the particular flaw of Deploy immediately and improvise rollback only after a major outage.

This demonstrates controls in another circumstance: A firewall engineer must deploy an urgent ACL change to restore a failing emergency service.

This other observation is relevant to: A cloud environment uses infrastructure-as-code but local engineers modify production resources directly through a console.

An approved change without an executed test cannot prove operating effectiveness. The needed evidence is A controlled test restores the previous working configuration without loss.

Writable snapshots under the same trust boundary do not provide resilient recovery. The proposal would not be defensible for this case.

This is appropriate for a later condition (Business objectives require only minutes of acceptable data loss for a transaction database.), but it does not directly resolve the initial need. A tight RPO may need continuous data protection beyond daily immutable copies.

This response addresses a different condition: A manufacturer runs one production line from a facility vulnerable to seasonal flooding. The present case requires the measure described by Use isolated immutable backups with independent access and validated restores.

This is a limitation elsewhere: A customer-facing service has active-active database replicas but inconsistent writes during network partition tests. It does not explain the deficiency of the specified proposed approach.

This explains a later shift in requirements (Business objectives require only minutes of acceptable data loss for a transaction database.), not the failure of the current proposal.

This is an advantage of another design (Define consistency, quorum and failover policy suitable for transaction integrity and availability targets.), not the particular flaw of Depend solely on a daily snapshot that compromised administrators can delete.

This demonstrates controls in another circumstance: A manufacturer runs one production line from a facility vulnerable to seasonal flooding.

This other observation is relevant to: A customer-facing service has active-active database replicas but inconsistent writes during network partition tests. In the current case, the assessed requirement is: An enterprise backs up files nightly but stores writable backup copies under the same administrative identities as production. The organization has now implemented this response: Use isolated immutable backups with independent access and validated restores. Which observation would MOST directly demonstrate that the security objective was met.

An approved change without an executed test cannot prove operating effectiveness. The needed evidence is A controlled compromised-admin test cannot modify the protected backup and restore succeeds.

This is the appropriate response to the original situation: Ransomware that controls production administrators may otherwise destroy recovery copies. It does not directly meet the new condition.

This remains inappropriate: Writable snapshots under the same trust boundary do not provide resilient recovery.

This is a record of how the initial safeguard would be checked, not an action implementing the newly requested condition: A controlled compromised-admin test cannot modify the protected backup and restore succeeds.

This is appropriate for a later condition (The alternate site itself depends on the same single power utility.), but it does not directly resolve the initial need. Redundancy must remove shared failure domains, not merely duplicate assets.

This response addresses a different condition: A customer-facing service has active-active database replicas but inconsistent writes during network partition tests. The present case requires the measure described by Design alternate production and recovery capability based on business impact analysis.

Co-located redundant hardware still shares the flood risk. The proposal would not be defensible for this case.

This explains a later shift in requirements (The alternate site itself depends on the same single power utility.), not the failure of the current proposal.

This is an advantage of another design (Use isolated immutable backups with independent access and validated restores.), not the particular flaw of Add a second machine in the same flood zone and claim geographic redundancy.

This is a limitation elsewhere: An enterprise backs up files nightly but stores writable backup copies under the same administrative identities as production. It does not explain the deficiency of the specified proposed approach.

This other observation is relevant to: An enterprise backs up files nightly but stores writable backup copies under the same administrative identities as production. In the current case, the assessed requirement is: A manufacturer runs one production line from a facility vulnerable to seasonal flooding. The organization has now implemented this response: Design alternate production and recovery capability based on business impact analysis. Which observation would MOST directly demonstrate that the security objective was met.

An approved change without an executed test cannot prove operating effectiveness. The needed evidence is Site failure exercise demonstrates prioritized production recovery at the alternate site.

This demonstrates controls in another circumstance: A customer-facing service has active-active database replicas but inconsistent writes during network partition tests.

This remains inappropriate: Co-located redundant hardware still shares the flood risk.

This is a record of how the initial safeguard would be checked, not an action implementing the newly requested condition: Site failure exercise demonstrates prioritized production recovery at the alternate site.

This is the appropriate response to the original situation: Business continuity must mitigate location-specific physical failure modes. It does not directly meet the new condition.