Professional Ethics and Comprehensive Application
Domain 10 combines case-based practice with professional ethics. A scenario is described, sometimes with a timeline, and you must choose the correct process, the correct order of actions, and the ethically defensible option.
Ethical duties
Confidentiality: data seen in the course of work is never viewed, copied or discussed out of scope, even to satisfy curiosity. Integrity: records and reports reflect what actually happened; errors are disclosed, not hidden. Competence: work within your skill and escalate when a task exceeds it. Due care: follow approved procedures, back up before changing, and test before declaring success. Objectivity: declare conflicts of interest. Accountability: keep credentials personal, never share administrative passwords, and report suspected breaches through the defined channel rather than investigating alone.
Integrated practice
A case usually gives: an alert or user report, the on-call action, the outcome, and a follow-up. Answer by naming the process and artefact at each step, and by keeping the order contain, record, communicate, remediate, verify, document, improve. Check whether the action needed approval, whether personal data was involved, and whether a change record and CMDB update are required at the end.
Worked example
At 02:10 an alert reports the database server volume at 98% and the application has begun to fail writes. Integrated response: acknowledge and verify the alert; check the volume and identify the growth source; apply a temporary mitigation - move or compress approved archive files - after obtaining the on-call authorisation, and record it as an emergency change; notify the application owner; create an incident record with a timeline; after service is restored, open a problem record; root cause is a missing purge job and no growth threshold alert; raise a normal change to add the purge job and monitoring threshold; update the runbook and CMDB; hold a review. If customer personal data was exposed during the failure, follow the breach-notification obligation. Reasoning: each step maps to a process, an approval and a record, and the ethical duty is to disclose rather than quietly patch.
Traps
- Fixing production without a ticket, so there is no record and no learning.
- Sharing or embedding a root password to save time.
- Using real customer data for testing or a demonstration.
- Blaming an individual in the post-incident review instead of examining the process.
- Declaring success without verification by the user or by monitoring.