What should 1.1.5 include?

What should 1.1.5 include?

• A. Description of groups, roles & responsibilities for mgmt of network components.
• B. Network performance metrics.
• C. Groups, roles & responsibilities for mgmt of network components.
• D. Incident response team contact list.

Answer: (C)

This item tests documenting who is responsible for managing network components. The best answer is the one that specifies the actual groups, roles and responsibilities for the management of network components. Establishing and recording these groups and their assigned duties creates clear ownership and accountability for firewall configurations, network changes, and ongoing maintenance, which is exactly what is required to manage network component security effectively. Having explicit groups and roles helps ensure that the right people are approving, implementing, and auditing changes, rather than leaving responsibilities vague. It supports proper access control, change management, and incident handling when network components are involved. The alternative phrasing that only describes the groups and roles, without establishing them as defined, may be less precise about who actually owns each responsibility. Other options focusing on performance metrics or incident-contact lists do not address the governance of network component management.

This item tests documenting who is responsible for managing network components. The best answer is the one that specifies the actual groups, roles and responsibilities for the management of network components. Establishing and recording these groups and their assigned duties creates clear ownership and accountability for firewall configurations, network changes, and ongoing maintenance, which is exactly what is required to manage network component security effectively.

Having explicit groups and roles helps ensure that the right people are approving, implementing, and auditing changes, rather than leaving responsibilities vague. It supports proper access control, change management, and incident handling when network components are involved. The alternative phrasing that only describes the groups and roles, without establishing them as defined, may be less precise about who actually owns each responsibility. Other options focusing on performance metrics or incident-contact lists do not address the governance of network component management.