Asset inventory, baselines and end-of-support for Network+

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

1. A formally reviewed and agreed specification for a system records its network topology and component placement and serves as the basis for future builds and changes. Which of the following is this document?

   Right. In the game that’s Renown for your Network Operations building.

   Not that one: D is right. In the game your Network Operations building would lose a little Renown, and this question would come back later.

   Your answerA.Production configurationThe production configuration is the live state of the devices. It drifts as changes are applied, and it is compared against the baseline to find that drift; it is not itself the reviewed and agreed reference.Your answerB.Backup configurationA backup configuration is a copy of a device's configuration saved so it can be restored after a failure or a bad change. It records one device at one moment and is not a formally reviewed specification for the whole system.Your answerC.Logical diagramA logical diagram draws the topology, and CM-2 does say the baseline includes network topology. But the document described is the agreed specification as a whole, of which the topology is one part; the diagram alone is not reviewed and approved as the basis for future builds.The answerD.Baseline configurationNIST SP 800-53 Rev. 5 control CM-2 describes baseline configurations as 'documented, formally reviewed, and agreed-upon specifications for systems' that 'serve as a basis for future builds, releases, or changes' and include 'information about system components, network topology, and logical placement of components in the system architecture'.

   Show the full explanation and doc quotes

   That is the document described.

   Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

2. A switch's maintenance contract has lapsed and its vendor publishes no further firmware, though a user community still posts fixes. Which of the following should the organization do?

   Right. In the game that’s Renown for your Network Operations building.

   Not that one: A is right. In the game your Network Operations building would lose a little Renown, and this question would come back later.

   The answerA.Replace the switch or arrange in-house or external support for it.NIST SP 800-53 Rev. 5 control SA-22 says support for a component includes software patches, firmware updates, replacement parts and maintenance contracts, and it must come from the developer, vendor or manufacturer.Your answerB.Keep the switch, since community fixes count as continued support.Fixes posted by volunteers are not vendor support. SA-22 defines support as patches, firmware updates, replacement parts and maintenance contracts from the developer, vendor or manufacturer; when those end the component is unsupported no matter who else publishes code for it.Your answerC.Decommission the switch at once and remove it from the asset inventory.Immediate decommissioning is one possible outcome but not what the control requires. SA-22 gives two routes, replacement or an arranged alternative support source, and even allows exceptions for isolated or mission-critical systems.Your answerD.Renew the warranty so the switch returns to a supported state.A renewed warranty only covers hardware failure. It does not bring back the firmware updates the vendor has stopped producing, so the switch would still be unsupported in the sense the control uses.

   Show the full explanation and doc quotes

   Once that support ends, the organization either replaces the component or provides an alternative source of support, in-house or from an external provider under contract. Community fixes are neither.

   Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

3. A vendor advisory says a flaw affects only certain firmware builds of a switch model the organization runs widely. Which of the following asset inventory fields identifies the affected units without a login to each?

   Right. In the game that’s Renown for your Network Operations building.

   Not that one: A is right. In the game your Network Operations building would lose a little Renown, and this question would come back later.

   The answerA.Software versionNIST SP 800-53 Rev. 5 control CM-8 lists 'software version numbers' among the information an inventory needs for accountability, alongside hardware specifications such as model and serial number.Your answerB.Serial numberA serial number uniquely identifies a unit and prevents duplicate accounting, but it is fixed at manufacture and says nothing about the firmware that has since been loaded.Your answerC.Physical locationPhysical location is one of the inventory specifications CM-8 names, and it is what the team will need next to go and patch the affected switches. It does not reveal which switches those are.Your answerD.Warranty supportWarranty or support status tells the organization whether the vendor is obliged to supply the fix. It does not record the running firmware version.

   Show the full explanation and doc quotes

   A current version field lets the team match an advisory's affected builds against the fleet from the inventory alone.

   Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf