4.2 - Change control, onboarding and incident procedures
CompTIA A+ Core 2 objective 4.2 covers security-related procedures and policies. Before deploying a risky configuration change to production, a formal change needs an approval, a plan and a rollback plan. When onboarding a new employee, create accounts with least privilege; when someone leaves, disable their accounts and recover company assets. While handling a security incident, preserving the chain of custody keeps evidence admissible and tamper-evident. A Safety Data Sheet (SDS) documents safe handling for chemicals such as cleaning supplies. Recognising the right procedure for each situation - change, onboarding, offboarding, incident - is what the exam tests. Expect scenario questions that describe a workplace event and ask for the correct security procedure or the document that governs it. Getting the order or the owner of a step wrong - cleaning before quarantine, or leaving an ex-employee's account enabled - is a common trap the exam highlights.
Risky prod change = approval + plan + rollback. New hire = least-privilege accounts. Departure = disable accounts + recover assets. Incident evidence = preserve chain of custody. Chemicals = SDS.
Practice questions
1. Which document lists hazards and safe handling for a chemical such as a cleaning solvent?
- An EULA
- A Safety Data Sheet (SDS) (correct answer)
- A statement of work
- A non-disclosure agreement
An SDS (formerly MSDS) describes hazards, handling, storage and disposal for chemicals.
2. While handling a security incident, why is preserving the chain of custody important?
- To make the corporate network run faster
- To free up unused space on the system disk
- To keep evidence admissible and tamper-evident (correct answer)
- To roll out the latest hardware driver updates
Chain of custody documents who handled evidence and when, keeping it tamper-evident and legally admissible.
3. When onboarding a new employee, which checklist item is MOST appropriate?
- Delete all their old files
- Create accounts with least-privilege (correct answer)
- Give them domain admin rights
- Disable multifactor authentication
New-user setup: create accounts, assign group memberships/least-privilege access, provision device, brief on AUP.
4. When an employee leaves the company, which is the BEST security practice?
- Leave the departing user's account active
- Disable accounts and recover company assets (correct answer)
- Share their password with the rest of the team
- Do nothing at all and simply move on
Offboarding promptly disables accounts, revokes access/tokens, recovers devices, and preserves needed data.
5. Before deploying a risky configuration change to production, what must a formal change include?
- Nothing at all; just apply it directly
- An approval, a plan, and a rollback plan (correct answer)
- Only a quick verbal heads-up to a colleague
- A brand-new administrator password
Change management requires a documented plan, risk analysis, approval (change board), a scheduled window, and a rollback/back-out plan if it fails.
6. Why keep detailed documentation of a completed change (what, when, by whom, and result)?
- To simply waste everyone's time
- For accountability, audits, and rollback (correct answer)
- To help quietly hide any mistakes
- It is honestly never really needed
Change documentation supports accountability, future troubleshooting, audits, and provides the reference needed to roll back safely if problems emerge.