What documentation is required for all services, protocols, and ports allowed?

What documentation is required for all services, protocols, and ports allowed?

• A. An inventory of hardware assets.
• B. Disaster recovery plan.
• C. A general security policy.
• D. Documentation and business justification for use of all services, protocols, and ports allowed, including security features implemented for insecure protocols.

Answer: (D)

The main idea here is that every service, protocol, and port that is allowed on the network must have documented justification and concrete security measures. By requiring documentation and a business rationale for each allowed item, you establish clear governance over what can run on the network, why it’s needed, and how it’s protected. This also makes it easier to review and audit changes, enforce least privilege, and ensure that even when insecure protocols are used, there are explicit mitigations in place (for example, encryption or strong authentication) and that those mitigations are documented. That’s why this option is the best fit: it goes beyond simply listing assets or planning for outages and demands a traceable record of why each service, protocol, and port is allowed, including how insecure protocols are secured. The other options don’t address this documentation and justification requirement. An inventory of hardware assets helps with asset management but not with controlling allowed network services; a disaster recovery plan focuses on continuity and data recovery; a general security policy is broad and does not specify justification for each service or port.

The main idea here is that every service, protocol, and port that is allowed on the network must have documented justification and concrete security measures. By requiring documentation and a business rationale for each allowed item, you establish clear governance over what can run on the network, why it’s needed, and how it’s protected. This also makes it easier to review and audit changes, enforce least privilege, and ensure that even when insecure protocols are used, there are explicit mitigations in place (for example, encryption or strong authentication) and that those mitigations are documented.

That’s why this option is the best fit: it goes beyond simply listing assets or planning for outages and demands a traceable record of why each service, protocol, and port is allowed, including how insecure protocols are secured. The other options don’t address this documentation and justification requirement. An inventory of hardware assets helps with asset management but not with controlling allowed network services; a disaster recovery plan focuses on continuity and data recovery; a general security policy is broad and does not specify justification for each service or port.