220-1102 Question 688
Single answerPeer reviewA support team is updating its incident response runbook after a malware infection was made worse by an incorrect cleanup step. The team lead wants to reduce future mistakes by requiring another technician to verify proposed changes before they are added to the official documentation. Which process best meets this goal?
- A
Peer review of the runbook changes before publication
- B
Version control that automatically saves each draft of the runbook
- C
A chain of custody form for the affected workstation
- D
An end-user acceptable use policy acknowledgement
Show answer and explanation
Correct answer: A
Explanation
The best answer is peer review because the requirement is for another technician to verify proposed documentation changes before they are formally adopted. In IT operations and security workflows, peer review is a best practice for reducing errors, improving accuracy, and ensuring that procedures reflect approved methods. This is especially important for incident response documentation, where a bad instruction can increase downtime, data loss, or security impact. Version control is commonly used alongside peer review, but it is not a substitute for it. Chain of custody and acceptable use policies serve different purposes. This aligns with standard IT documentation and change-management best practices: changes should be reviewed by another qualified individual before publication to reduce risk and improve consistency.
- A. Correct.
Correct. Peer review means another qualified person examines the proposed changes for accuracy, completeness, and potential risk before the changes are approved. In this scenario, the goal is to catch incorrect remediation steps before they become part of the official process, which is exactly what peer review is intended to do.
- B. Incorrect.
Incorrect. Version control is useful for tracking revisions, comparing drafts, and rolling back changes, but by itself it does not ensure that another technician has verified the content. It supports documentation management, but it is not the review process being asked for here.
- C. Incorrect.
Incorrect. Chain of custody is used to document evidence handling, especially in security incidents or potential legal investigations. While important in some malware or forensic cases, it does not address validating the quality or correctness of changes to internal documentation.
- D. Incorrect.
Incorrect. An acceptable use policy acknowledgement confirms that users understand organizational rules for system use. It is unrelated to having a second technician validate incident response procedures or runbook updates.