Change Management and Version Control ACCISO Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the fundamental purpose of version control?

   • ATo automatically deploy code to production
   • BTo encrypt all stored data
   • CTo replace the need for backups
   • DTo track and manage changes to files, configurations, and code over time
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A proposed change to the core banking system has been submitted for approval. The change has a high potential impact on transaction processing. According to change management best practices, who should review and approve this change?

   • AThe external vendor that provides the core banking system.
   • BThe help desk team, since they handle user issues.
   • CThe system administrator who proposed the change, without further review.
   • DThe Change Advisory Board (CAB), which includes representatives from IT, security, and business units.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A financial services firm needs to apply a critical security patch to a production authentication server to address a known vulnerability. The change window is tight, and the patch must be deployed within the next two hours to meet compliance deadlines. The firm's change policy requires all changes to be reviewed by the Change Advisory Board (CAB), but the next scheduled CAB meeting is in three days. What is the most appropriate action for the change manager?

   • AClassify the change as an emergency change, obtain approval from the CAB chair or designated emergency approver, and deploy the patch immediately.
   • BDeploy the patch immediately without any approval, then document it as a standard change after the fact.
   • CReject the change because it was not submitted through the normal change request process.
   • DWait for the next scheduled CAB meeting to approve the change, then deploy the patch as a normal change.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which factor is most important to consider when assessing the risk of a proposed change?

   • AThe number of people requesting the change
   • BThe potential impact on system availability and security controls
   • CThe name of the change requester
   • DThe color scheme of the change request form
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization uses a central Git repository to store configuration files for its production systems. The security team is concerned that unauthorized changes could be made to these files, and that there is no way to trace who made changes. What should the organization implement to address these concerns?

   • ARestrict access to the repository to a single administrator who makes all changes.
   • BUse a shared account for all developers to simplify access management.
   • CEnable branch protection rules that require pull request reviews and enforce signed commits.
   • DAllow all developers to push directly to the main branch, but require them to log their changes in a separate system.
   Reveal Solution Discussion Select an answer first