Change Management, Version Control, and Disaster Recovery CCISO Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   A Change Advisory Board (CAB) is reviewing a change request to migrate a critical application to a new server. The change request includes an impact assessment, a rollback plan, and a proposed implementation window. However, the CAB is concerned that the rollback plan is not feasible because it requires restoring a large database from backup, which would take longer than the application's RTO. What should the CAB do?

   • ADefer the change until the database backup can be restored faster.
   • BApprove the change because the rollback plan is documented, even if it is not feasible.
   • CReject the change and require the requester to develop a more feasible rollback plan that meets the RTO.
   • DApprove the change and extend the RTO to accommodate the rollback plan.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A financial services firm has a documented change management policy that requires all changes to production systems to be approved by the Change Advisory Board (CAB). During a weekend, a critical security vulnerability is discovered in the internet-facing web application, and the security team determines that an immediate patch is required to prevent an active exploit. The change manager is not available, and the CAB cannot convene until Monday. What is the most appropriate action for the security team to take?

   • AApply the emergency change process, document the change, and obtain CAB approval retrospectively at the next meeting.
   • BWait until Monday to submit a normal change request so that the CAB can review the patch in the standard manner.
   • CApply the patch immediately and do not document it because the vulnerability is critical and the change is justified.
   • DApply the patch and then submit a standard change request after the fact, without any emergency designation.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a recommended best practice for naming branches in a version control system?

   • AAlways use the developer's name as the branch name
   • BUse a descriptive convention that includes the type and purpose, such as 'feature/login-page'
   • CUse random names to avoid conflicts
   • DUse the date of creation as the branch name
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a key benefit of using version control for configuration files?

   • AIt provides a historical record of changes, enabling rollback to a known-good state
   • BIt allows multiple users to work on the same file simultaneously without conflict
   • CIt prevents any unauthorized changes from ever occurring
   • DIt automatically backs up files to offsite storage
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Why is change management important for disaster recovery planning?

   • AIt eliminates the need for disaster recovery testing
   • BIt guarantees that all changes are reversible without any impact
   • CIt prevents any unauthorized changes from being made
   • DIt ensures that changes to systems are documented and approved, so recovery procedures remain accurate
   Reveal Solution Discussion Select an answer first