A multinational corporation has a change management policy that classifies changes as standard, normal, or emergency. A routine patching activity is classified as a standard change and is pre-approved. However, a recent audit found that some standard changes were not being documented properly, and the CAB is concerned about the lack of oversight. The CISO wants to improve control without significantly increasing the administrative burden. What is the most appropriate action?

Eliminate the standard change category and require all changes to go through the full CAB approval process.

Allow standard changes to proceed without documentation because they are pre-approved.

Review the standard change criteria and require documentation for all standard changes, even if pre-approved.

Reclassify all standard changes as normal changes so that the CAB reviews each one individually.

An organization has a disaster recovery plan that has not been tested in over two years. The CISO wants to conduct a test, but the operations team is concerned that a full interruption test would cause significant downtime. The organization has a regulatory requirement to validate the DR plan annually. What is the most appropriate testing strategy?

Conduct a simulation test only, as it is the least disruptive and satisfies the regulatory requirement.

Delay the test until a full interruption test can be scheduled during a maintenance window.

Conduct a full interruption test to fully validate the plan, despite the risk of downtime.

Conduct a parallel test to validate recovery procedures without impacting production, and document the results for compliance.

EC-CouncilCertified Chief Information Security Officer

Domain 3Objective 4

Change Management, Version Control, and Disaster Recovery CCISO Practice Questions (Page 8)

Part of the Security Program Management and Operations domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

11concepts

Questions 36–40

36foundation · easy
Which type of change is pre-approved and typically follows a documented, low-risk procedure?
Select an answer first
37expert · medium
A multinational corporation has a change management policy that classifies changes as standard, normal, or emergency. A routine patching activity is classified as a standard change and is pre-approved. However, a recent audit found that some standard changes were not being documented properly, and the CAB is concerned about the lack of oversight. The CISO wants to improve control without significantly increasing the administrative burden. What is the most appropriate action?
Select an answer first
38foundation · easy
Which disaster recovery objective specifies the maximum time it should take to restore operations after a disruption?
Select an answer first
39expert · medium
An organization has a disaster recovery plan that has not been tested in over two years. The CISO wants to conduct a test, but the operations team is concerned that a full interruption test would cause significant downtime. The organization has a regulatory requirement to validate the DR plan annually. What is the most appropriate testing strategy?
Select an answer first
40foundation · easy
Which of the following is a common version control system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Change Management, Version Control, and Disaster Recovery CCISO Practice Questions (Page 8)

Questions 36–40

Which type of change is pre-approved and typically follows a documented, low-risk procedure?

Which disaster recovery objective specifies the maximum time it should take to restore operations after a disruption?

Which of the following is a common version control system?

Keep studying — Security Program Management and Operations