1
00:00:06,510 --> 00:00:09,690
- So welcome to lesson
three, deep dive quiz.

2
00:00:09,690 --> 00:00:12,540
Now, lesson three was all
about explaining the importance

3
00:00:12,540 --> 00:00:15,600
of change management processes
and the impact to security.

4
00:00:15,600 --> 00:00:18,030
And we had two lessons, lesson 3 1,

5
00:00:18,030 --> 00:00:19,710
configuration management

6
00:00:19,710 --> 00:00:22,680
and lesson 3 2, change management.

7
00:00:22,680 --> 00:00:24,870
So in our deep dive quiz

8
00:00:24,870 --> 00:00:28,140
we're gonna work together
to answer five questions.

9
00:00:28,140 --> 00:00:28,973
Are you ready?

10
00:00:28,973 --> 00:00:30,423
Alright, let's start.

11
00:00:31,680 --> 00:00:35,880
Which statement is not true
about baseline configurations?

12
00:00:35,880 --> 00:00:39,150
The word not here is important, not true.

13
00:00:39,150 --> 00:00:41,520
It's an aggregation of components

14
00:00:41,520 --> 00:00:43,770
treated as a single entity,

15
00:00:43,770 --> 00:00:47,160
it's used as a basis for future builds,

16
00:00:47,160 --> 00:00:48,660
modifications should go through

17
00:00:48,660 --> 00:00:50,760
the change management process,

18
00:00:50,760 --> 00:00:52,713
it is a set of specifications.

19
00:00:54,060 --> 00:00:56,490
So put me on pause if you need to, right?

20
00:00:56,490 --> 00:00:58,770
But you're gonna choose which statement

21
00:00:58,770 --> 00:01:02,253
is not true about baseline configurations.

22
00:01:03,630 --> 00:01:05,250
It's an aggregation of components

23
00:01:05,250 --> 00:01:08,730
treated as a single entity,
a basis for future builds,

24
00:01:08,730 --> 00:01:10,020
modifications should go through

25
00:01:10,020 --> 00:01:11,790
the change management process

26
00:01:11,790 --> 00:01:13,950
or it's a set of specifications.

27
00:01:13,950 --> 00:01:16,290
Three of those are true, one is not.

28
00:01:16,290 --> 00:01:17,840
Which one are you gonna choose?

29
00:01:19,020 --> 00:01:21,810
Well, I'm gonna choose the first one

30
00:01:21,810 --> 00:01:24,510
because an aggregation
of components treated

31
00:01:24,510 --> 00:01:28,170
as a single entity is not
a baseline configuration.

32
00:01:28,170 --> 00:01:30,600
It's a configuration item.

33
00:01:30,600 --> 00:01:32,820
Now, it is true about
baseline configurations

34
00:01:32,820 --> 00:01:34,800
that it's a basis of future builds.

35
00:01:34,800 --> 00:01:36,600
That modifications should go through

36
00:01:36,600 --> 00:01:39,420
the change management
process, and it is a set

37
00:01:39,420 --> 00:01:42,543
of specifications for
that configuration item.

38
00:01:43,800 --> 00:01:45,510
So I'm choosing that one, do you agree?

39
00:01:45,510 --> 00:01:47,583
No? It's correct.

40
00:01:48,450 --> 00:01:49,803
Alright, question two.

41
00:01:50,700 --> 00:01:53,010
Your organization is making strides

42
00:01:53,010 --> 00:01:55,350
in maturing its configuration management

43
00:01:55,350 --> 00:01:57,750
and automated provisioning process.

44
00:01:57,750 --> 00:02:01,410
The guiding principle is to use automation

45
00:02:01,410 --> 00:02:04,410
to replace rather than fix.

46
00:02:04,410 --> 00:02:08,550
What term best describes this principle?

47
00:02:08,550 --> 00:02:13,550
Immutability, idempotence,
infrastructure-as-code

48
00:02:13,740 --> 00:02:16,863
or demand generated resource allocation.

49
00:02:19,320 --> 00:02:23,160
Immutability, idempotence,
infrastructure-as-code

50
00:02:23,160 --> 00:02:25,770
or demand generated resource allocation.

51
00:02:25,770 --> 00:02:27,320
Put me on pause if you need to.

52
00:02:30,503 --> 00:02:33,060
Well, I'm gonna choose the first one.

53
00:02:33,060 --> 00:02:35,700
Immutability or an immutable system, right

54
00:02:35,700 --> 00:02:38,730
is the idea that we're
not gonna try to fix.

55
00:02:38,730 --> 00:02:41,520
We're only created and destroyed.

56
00:02:41,520 --> 00:02:42,900
Idempotence, right?

57
00:02:42,900 --> 00:02:43,733
Is the principle

58
00:02:43,733 --> 00:02:46,560
that every time we run
a configuration script

59
00:02:46,560 --> 00:02:49,860
we should have the same exact results.

60
00:02:49,860 --> 00:02:52,890
Infrastructure-as-code is
using code to create systems

61
00:02:52,890 --> 00:02:56,370
and demand generated resource
allocation is just about the

62
00:02:56,370 --> 00:03:00,000
in an autonomic manner we can add.

63
00:03:00,000 --> 00:03:03,300
So provision and de-provision resources.

64
00:03:03,300 --> 00:03:04,560
Do you like immutability?

65
00:03:04,560 --> 00:03:05,393
Let's try it.

66
00:03:06,270 --> 00:03:07,563
And that is correct.

67
00:03:08,520 --> 00:03:10,260
Alright, question three.

68
00:03:10,260 --> 00:03:12,720
The network engineering team
is determined that a change

69
00:03:12,720 --> 00:03:15,930
to the server configuration
baseline is necessary.

70
00:03:15,930 --> 00:03:18,630
How would you advise them to proceed?

71
00:03:18,630 --> 00:03:19,800
Test the change.

72
00:03:19,800 --> 00:03:21,540
Seems like a pretty good idea.

73
00:03:21,540 --> 00:03:23,520
Follow change management procedures,

74
00:03:23,520 --> 00:03:25,440
also seems like a good idea.

75
00:03:25,440 --> 00:03:27,000
Submit a change request form.

76
00:03:27,000 --> 00:03:29,490
Well, absolutely, they
should be doing that.

77
00:03:29,490 --> 00:03:31,530
Design a rollback strategy.

78
00:03:31,530 --> 00:03:33,270
A hundred percent they
should be doing that.

79
00:03:33,270 --> 00:03:34,980
Uh-oh, what are we gonna do now?

80
00:03:34,980 --> 00:03:36,360
It looks like all four

81
00:03:36,360 --> 00:03:40,140
of those answers are really good answers.

82
00:03:40,140 --> 00:03:41,430
So what did I tell you earlier?

83
00:03:41,430 --> 00:03:43,590
When you see multiple answers

84
00:03:43,590 --> 00:03:45,930
that you're really convinced or correct

85
00:03:45,930 --> 00:03:47,820
I want you to put yourself in the mindset

86
00:03:47,820 --> 00:03:49,710
that this is a hierarchical question

87
00:03:49,710 --> 00:03:51,690
and that one of those answers

88
00:03:51,690 --> 00:03:53,523
is going to encompass the other.

89
00:03:54,720 --> 00:03:57,090
Test the change, follow
change management procedures,

90
00:03:57,090 --> 00:04:00,510
submit a change request,
design a rollback strategy.

91
00:04:00,510 --> 00:04:04,530
One of those encompasses the other three.

92
00:04:04,530 --> 00:04:05,850
Which one is it?

93
00:04:05,850 --> 00:04:08,333
Put me on pause if you need
to while you think through it.

94
00:04:09,412 --> 00:04:11,220
Well, I'm gonna choose the second answer

95
00:04:11,220 --> 00:04:14,370
which is follow change
management procedures.

96
00:04:14,370 --> 00:04:15,930
Because testing the change,

97
00:04:15,930 --> 00:04:17,790
submitting a change request form

98
00:04:17,790 --> 00:04:20,520
and designing a rollback
strategy are all part

99
00:04:20,520 --> 00:04:22,980
of my change management procedures.

100
00:04:22,980 --> 00:04:24,780
So that's the one I'm gonna go with.

101
00:04:24,780 --> 00:04:25,613
You like it?

102
00:04:26,580 --> 00:04:27,413
I hope so.

103
00:04:27,413 --> 00:04:28,563
It's the correct answer.

104
00:04:29,580 --> 00:04:31,500
Alright, question four.

105
00:04:31,500 --> 00:04:32,670
And this time we're going to put

106
00:04:32,670 --> 00:04:36,270
the configuration management
workflow in the correct order.

107
00:04:36,270 --> 00:04:37,103
So we'll start

108
00:04:37,103 --> 00:04:40,140
with the very first thing
we're gonna do as number one.

109
00:04:40,140 --> 00:04:43,950
Now our options are
research, publish, propose,

110
00:04:43,950 --> 00:04:48,333
define objectives and
requirements, approve or implement.

111
00:04:49,680 --> 00:04:52,290
So we're gonna put these in
the correct order, one to six.

112
00:04:52,290 --> 00:04:54,300
This is an awesome one
to put me on pause for

113
00:04:54,300 --> 00:04:55,850
so you can write them all down.

114
00:04:57,360 --> 00:05:00,240
So what's the first thing that
we're gonna be looking for?

115
00:05:00,240 --> 00:05:01,830
Well, the first thing, right?

116
00:05:01,830 --> 00:05:03,180
When we're arranging our

117
00:05:03,180 --> 00:05:05,880
doing our configuration arrangement
workflow is figuring out

118
00:05:05,880 --> 00:05:09,180
what are we doing and why are we doing it?

119
00:05:09,180 --> 00:05:12,930
So that would be defining our
objectives and requirements.

120
00:05:12,930 --> 00:05:14,490
Now, once we know what we're doing

121
00:05:14,490 --> 00:05:18,000
and kind of why we're doing
it, we will probably research.

122
00:05:18,000 --> 00:05:20,370
And that's already in number two.

123
00:05:20,370 --> 00:05:22,020
Once we have researched

124
00:05:22,020 --> 00:05:24,180
and we have come up with our plan, right?

125
00:05:24,180 --> 00:05:29,180
Our proposal, well, we'll
actually have to propose it.

126
00:05:30,600 --> 00:05:33,630
So we've defined a
requirement, we've researched,

127
00:05:33,630 --> 00:05:37,860
we've proposed, now
before we can move forward

128
00:05:37,860 --> 00:05:39,720
it must be approved.

129
00:05:39,720 --> 00:05:40,553
Now it'll be approved

130
00:05:40,553 --> 00:05:42,390
at different levels in the organization

131
00:05:42,390 --> 00:05:46,380
really depending upon
what the configuration is.

132
00:05:46,380 --> 00:05:48,090
From there, we're gonna publish it out

133
00:05:48,090 --> 00:05:49,590
so everybody knows it

134
00:05:49,590 --> 00:05:51,300
and then we're gonna implement it.

135
00:05:51,300 --> 00:05:54,060
So define objectives, research, propose,

136
00:05:54,060 --> 00:05:57,180
approve, publish, implement.

137
00:05:57,180 --> 00:05:58,500
That would be our workflow.

138
00:05:58,500 --> 00:05:59,910
Do you like it?

139
00:05:59,910 --> 00:06:03,300
Let's check it out, and it is correct.

140
00:06:03,300 --> 00:06:05,730
Alright, our last question,
and this one's a matching.

141
00:06:05,730 --> 00:06:08,160
We're gonna match the following
change management components

142
00:06:08,160 --> 00:06:09,783
with their descriptions.

143
00:06:10,770 --> 00:06:14,340
So we've got recovery to a
previous state, regression

144
00:06:14,340 --> 00:06:17,760
and interoperability,
prioritization, authorization

145
00:06:17,760 --> 00:06:19,620
and evaluation of risks and benefits.

146
00:06:19,620 --> 00:06:21,480
That's on our left hand side.

147
00:06:21,480 --> 00:06:22,830
On our right hand side

148
00:06:22,830 --> 00:06:26,130
we've got rollback and impact analysis,

149
00:06:26,130 --> 00:06:30,780
alignment with business needs,
testing, and accountability.

150
00:06:30,780 --> 00:06:33,270
So these aren't necessarily
one to one definitions,

151
00:06:33,270 --> 00:06:36,423
they're really descriptions
if you will, of an activity.

152
00:06:37,740 --> 00:06:40,080
So if we start right up
on the left hand side

153
00:06:40,080 --> 00:06:42,300
recovery to a previous
state, oh, look at that.

154
00:06:42,300 --> 00:06:43,133
It's right there.

155
00:06:43,133 --> 00:06:43,966
There's our rollback.

156
00:06:43,966 --> 00:06:44,823
So that's pretty easy.

157
00:06:45,840 --> 00:06:47,910
Regression and interoperability.

158
00:06:47,910 --> 00:06:51,030
I wanna make sure that the
change is going to work

159
00:06:51,030 --> 00:06:53,520
and how am I gonna make sure
the change is gonna work?

160
00:06:53,520 --> 00:06:56,553
I'm probably gonna have
to do some testing.

161
00:06:58,320 --> 00:07:02,670
Prioritization, authorization
and evaluation of risks

162
00:07:02,670 --> 00:07:04,680
and benefits are what I have left.

163
00:07:04,680 --> 00:07:07,290
So again, sometimes you may
not be sure of the answer.

164
00:07:07,290 --> 00:07:10,230
So start doing a little process

165
00:07:10,230 --> 00:07:12,333
of elimination as much as possible.

166
00:07:13,710 --> 00:07:15,270
Alignment with business needs

167
00:07:15,270 --> 00:07:18,270
probably evaluation of risks and benefits.

168
00:07:18,270 --> 00:07:20,400
Authorization means who authorized it,

169
00:07:20,400 --> 00:07:21,870
who can be held accountable.

170
00:07:21,870 --> 00:07:23,250
So I like authorization

171
00:07:23,250 --> 00:07:27,000
and accountability and
prioritization and impact.

172
00:07:27,000 --> 00:07:27,833
Now, wait.

173
00:07:27,833 --> 00:07:29,640
When I go through that,

174
00:07:29,640 --> 00:07:32,340
I don't think that's
actually gonna be right.

175
00:07:32,340 --> 00:07:35,700
So when you're doing your
test, take your time.

176
00:07:35,700 --> 00:07:38,310
Kinda after you've done your
first pass through, go and say

177
00:07:38,310 --> 00:07:40,500
is that really what I meant?

178
00:07:40,500 --> 00:07:43,530
I think prioritization
is what we're going to do

179
00:07:43,530 --> 00:07:45,480
in alignment with business needs

180
00:07:45,480 --> 00:07:47,250
and might impact analysis

181
00:07:47,250 --> 00:07:50,070
is a valuation of risks and benefits.

182
00:07:50,070 --> 00:07:52,980
So recovery to a previous state, rollback.

183
00:07:52,980 --> 00:07:55,830
Regression and interoperability
describes testing.

184
00:07:55,830 --> 00:07:57,510
Prioritization, we're gonna do that

185
00:07:57,510 --> 00:07:59,610
in alignment with business needs.

186
00:07:59,610 --> 00:08:01,800
Authorization, that's
all about accountability.

187
00:08:01,800 --> 00:08:03,120
Who said we could do this?

188
00:08:03,120 --> 00:08:05,520
And evaluation of the risks and benefits.

189
00:08:05,520 --> 00:08:08,040
That's gonna be an impact analysis.

190
00:08:08,040 --> 00:08:10,020
What do you think, did
we do the right thing?

191
00:08:10,020 --> 00:08:11,103
Let's check it out.

192
00:08:12,090 --> 00:08:13,620
And that is correct.

193
00:08:13,620 --> 00:08:14,940
You know, I can't stress enough

194
00:08:14,940 --> 00:08:18,330
in your exam how important
reading for comprehension is

195
00:08:18,330 --> 00:08:21,120
and also just taking your time.

196
00:08:21,120 --> 00:08:23,730
A lot of people really just
try to rush through the exams

197
00:08:23,730 --> 00:08:27,150
as if getting done quicker is
gonna get them extra points.

198
00:08:27,150 --> 00:08:27,983
It's not.

199
00:08:27,983 --> 00:08:31,230
And when you rush, when you
don't read all the answers,

200
00:08:31,230 --> 00:08:33,360
when you don't read the
question thoroughly,

201
00:08:33,360 --> 00:08:35,520
when you don't take your time
after you've answered to say

202
00:08:35,520 --> 00:08:37,320
is that really what I meant?

203
00:08:37,320 --> 00:08:38,153
That's the time

204
00:08:38,153 --> 00:08:40,200
you're probably gonna
get the question wrong

205
00:08:40,200 --> 00:08:42,210
even though you had the knowledge.

206
00:08:42,210 --> 00:08:44,640
You weren't able to
apply it appropriately.

207
00:08:44,640 --> 00:08:45,750
So make sure again

208
00:08:45,750 --> 00:08:49,290
you're taking your time when
you're answering questions.

209
00:08:49,290 --> 00:08:50,520
Alright, let's see how we did.

210
00:08:50,520 --> 00:08:51,480
Oh, we did a great job.

211
00:08:51,480 --> 00:08:53,070
We got five out of five.

212
00:08:53,070 --> 00:08:54,150
Alright, up next

213
00:08:54,150 --> 00:08:57,420
we're gonna do one of my
absolute favorite topics.

214
00:08:57,420 --> 00:09:00,510
We're gonna go into lesson
four, explain the importance

215
00:09:00,510 --> 00:09:03,180
of using appropriate
cryptographic solutions.

216
00:09:03,180 --> 00:09:04,130
I'll see you there.