712-50 Question 322
Single answerInstall and operate the IT systems in a test configuration manner that does not alter the program code or compromise security safeguardsA CISO is overseeing pre-production testing of a critical payment application after a major infrastructure refresh. The application owner wants the test team to validate system behavior in an environment that closely mirrors production, but the software vendor prohibits any source-code changes and the organization must preserve existing security safeguards for audit and compliance reasons. Which approach BEST meets these requirements while allowing effective testing?
- A
Deploy the application in an isolated test environment cloned from production, use configuration and infrastructure changes only, retain security controls such as MFA, logging, segmentation, and least privilege, and sanitize any production-derived data before testing
- B
Disable selected security controls such as MFA and centralized logging during testing to reduce operational friction, then re-enable them before go-live so the production design remains unchanged
- C
Modify the application code to insert additional debug statements and bypass certain validation routines temporarily, because the changes are limited to the test environment
- D
Run testing directly in production during low-usage periods using privileged administrator accounts so results reflect the real environment without building a separate test platform
Show answer and explanation
Correct answer: A
Explanation
The best answer is to create a production-like but isolated test configuration that relies on configuration management, infrastructure provisioning, and data sanitization rather than source-code modification or control bypass. From a CISO perspective, this balances assurance, compliance, and operational safety. Relevant best practices include maintaining separate environments, enforcing least privilege, preserving audit logging, and protecting sensitive data used in testing. Guidance from NIST SP 800-53 emphasizes security testing, assessment, and environment separation through controls such as CM (Configuration Management), SA (System and Services Acquisition), AC (Access Control), AU (Audit and Accountability), and SC (System and Communications Protection). NIST SP 800-115 also supports structured security testing in controlled environments. In practice, the organization should validate that the test environment mirrors production architecture and security posture as closely as feasible, while masking or synthesizing sensitive data and documenting all deviations through formal change and risk management.
- A. Correct.
Correct. This approach supports testing in a production-like configuration without altering program code or weakening security safeguards. It uses environment-level controls rather than code changes, preserves core protections such as authentication, logging, network segmentation, and least privilege, and reduces data protection risk by sanitizing any copied production data. This aligns with secure system testing practices, change management discipline, and control preservation expected in regulated environments.
- B. Incorrect.
Incorrect. Disabling MFA, logging, or other safeguards in test may make operations easier, but it creates a configuration that is no longer representative of the intended secure operating state and can invalidate test results. It also introduces unnecessary risk and may violate internal policy or audit expectations. A common misconception is that temporary control suspension is acceptable in non-production; however, when the objective is to validate the system without compromising safeguards, this approach fails that requirement.
- C. Incorrect.
Incorrect. Changing source code, even temporarily and only in test, directly violates the stated vendor restriction and undermines the requirement to test without altering program code. Although teams may be tempted to add debug hooks to improve observability, acceptable alternatives include application logs already supported by the product, infrastructure monitoring, packet capture where approved, and other non-invasive methods.
- D. Incorrect.
Incorrect. Testing in production exposes live services and data to unnecessary operational and security risk. Using privileged administrator accounts further weakens control integrity and may mask issues that would occur under normal role-based access conditions. While production testing can sometimes be appropriate for tightly controlled smoke tests, it is not the best answer when the goal is a test configuration that preserves safeguards and avoids code changes.