Implementation Configuration and Release Management CISA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   When should a post-implementation review typically be conducted?

   • ABefore the implementation begins
   • BAfter the system has been in production for a sufficient period to assess its performance
   • CDuring the development phase
   • DOnly when a major failure occurs
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A development team is using a version control system to manage a critical application. The team has a policy that all changes must be reviewed before merging into the main branch. However, a developer accidentally merges a change without review. The change introduces a security vulnerability. What is the MOST appropriate action?

   • ALeave the merge in place but document it as a known issue.
   • BRevert the merge immediately and require the developer to go through the review process.
   • CConduct a post-implementation review to decide whether to keep the change.
   • DUpdate the version control policy to allow such merges in the future.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of a post-implementation review?

   • ATo plan the next release
   • BTo evaluate whether the implementation met its objectives and to identify lessons learned
   • CTo assign blame for any failures
   • DTo document the configuration items
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An organization is implementing a new financial system. The project team has been making changes to the system configuration without going through the change management process. The internal audit team has identified this as a risk. What is the MOST appropriate control to address this risk?

   • AImplement a formal change management process that requires approval before any configuration change is made.
   • BConduct a post-implementation review to identify any unauthorized changes.
   • CRestrict access to the configuration management system to only the project manager.
   • DRequire all configuration changes to be logged in the configuration management database (CMDB) after implementation.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In the configuration management process, which activity involves defining and documenting the characteristics of each configuration item, such as its name, version, and owner?

   • AConfiguration identification
   • BConfiguration control
   • CConfiguration audit
   • DStatus accounting
   Reveal Solution Discussion Select an answer first