Acceptance of a boundary control and removable-media process
A fictional organization is integrating a new customer-facing service with an internal record store. The approved design permits only the documented application-to-database path, provides separate authenticated administrative access and sends relevant security events to an existing collector. A supplier requests a temporary unrestricted rule to complete installation, and the operations team has no agreed owner for removing it. The handover also includes removable recovery media containing an encrypted export; the key copy and media custody have not yet been recorded. Physical access is managed by the facilities team under its own approved design. The exercise requires written acceptance criteria and ownership, not a live configuration change or an invented electrical, fire or data-retention standard.
1. Identify acceptance evidence for the network and administrative paths.
Read the worked answer
Verify permitted flows and denied unrelated access, review temporary-rule purpose and expiry, confirm administrative identity controls and test that expected events reach the collector with usable time and identity data. Record results, exceptions and the owner of each follow-up.
2. Explain how the recovery media and temporary access should be handed over.
Read the worked answer
Document media inventory, custody, authorized use and relevant key recovery/access arrangements. Identify who removes or reauthorizes the temporary rule and supplier access. Encryption alone does not establish media custody, usable recovery or complete sanitization at disposal.