Change Management and Version Control ACCISO Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A critical security vulnerability is discovered that requires an immediate fix to prevent exploitation. Which change classification is most appropriate?

   • AStandard change
   • BRoutine change
   • CEmergency change
   • DNormal change
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial services firm has a standard change window every Saturday from 2:00 AM to 4:00 AM. On Friday afternoon, a critical security patch is released that addresses an actively exploited vulnerability in the firm's internet-facing web application. The patch must be applied before the next business day. The change manager has been asked to expedite the approval. What is the most appropriate classification and approval workflow for this change?

   • AClassify it as a normal change and implement it immediately, then document it retroactively in the change log.
   • BClassify it as a standard change and implement it immediately without any approval because it is a security patch.
   • CClassify it as an emergency change and obtain approval from the CAB chair or designated emergency approver before implementation.
   • DClassify it as a normal change and submit it for approval at the next scheduled CAB meeting.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of a formal change management process in an organization?

   • ATo provide a structured way to evaluate, approve, and implement changes while minimizing risk to security and operations
   • BTo ensure that all changes are implemented as quickly as possible to minimize disruption
   • CTo restrict all changes to emergency fixes only, avoiding routine updates
   • DTo eliminate the need for configuration documentation by automating all changes
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is planning to upgrade its network firewall to a new model. The change manager must assess the risk of this change. Which factor is most important to consider when assessing the impact of this change on security and operations?

   • AThe number of users who will be affected by the change.
   • BThe vendor's reputation and market share.
   • CThe cost of the new firewall hardware and licensing.
   • DThe potential for a period of reduced network security or downtime during the transition.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A change request proposes to upgrade the operating system on all servers in a data center. The change is classified as normal and requires CAB approval. The CAB is concerned about the risk of application incompatibility. What is the most appropriate way to assess this risk before approval?

   • ARely on the vendor's compatibility matrix without testing.
   • BDefer the change indefinitely to avoid any risk.
   • CReview the results of a pilot upgrade on a representative subset of servers and applications.
   • DApprove the change based on the assumption that all applications are compatible.
   Reveal Solution Discussion Select an answer first