7.9 - Understand and Participate in Change Management Processes CISSP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which type of change is pre-authorized and considered low risk, such as applying a routine security patch?

   • ANormal change
   • BStandard change
   • CMajor change
   • DEmergency change
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How does change management interact with incident management during an emergency change?

   • AThe incident is closed before the change is implemented
   • BThe change is implemented immediately to resolve the incident, and the change approval is obtained afterward
   • CThe change management process is bypassed entirely
   • DThe incident management process is suspended until the change is approved
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security incident occurred when an attacker exploited a vulnerability in a web application. The incident response team applied an emergency change to patch the vulnerability. After the incident is contained, what is the most important follow-up action related to change management?

   • AImmediately revert the emergency change to return to the previous state.
   • BClose the incident without any further action because the vulnerability is patched.
   • CSubmit the emergency change to the CAB for retroactive approval, but do not document it.
   • DConduct a post-incident review to document the emergency change and evaluate its effectiveness.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is planning to replace its entire network infrastructure, including routers, switches, and firewalls. This change will affect all employees and external customers. According to change management principles, how should this change be classified?

   • AAs an emergency change because it will cause downtime.
   • BAs a major change because it has a high impact on the organization and requires extensive planning and review.
   • CAs a normal change because it is not an emergency.
   • DAs a standard change because it is a routine upgrade.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the purpose of a post-incident review in the context of change management?

   • ATo assign blame to the change implementer
   • BTo approve the emergency change retroactively
   • CTo identify improvements to change management processes and prevent similar incidents
   • DTo close the incident ticket without further action
   Reveal Solution Discussion Select an answer first