7.9 - Understand and Participate in Change Management Processes CISSP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A database administrator is planning to apply a critical security patch to the organization's customer database. The patch will require a brief downtime of the database service. According to change management best practices, what should the administrator do before implementing the change?

   • AWait until after the change is complete to notify stakeholders.
   • BNotify all affected stakeholders, including application owners and business users, about the planned downtime and expected impact.
   • CApply the patch without notification to avoid alarming users.
   • DNotify only the IT department, as business users do not need to know about technical changes.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the correct sequence of steps in a typical change management process?

   • AReview, implementation, approval, post-implementation review
   • BApproval, request, implementation, review
   • CImplementation, approval, review, request
   • DRequest, review, approval, implementation, post-implementation review
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company has a Change Advisory Board (CAB) composed of IT managers, security officers, and business unit representatives. A request to upgrade the email server to a new version has been submitted. The change is considered a standard change because it is a routine upgrade that has been performed multiple times. What is the most appropriate way to handle this change?

   • ASubmit the change to the CAB for full review and approval as with any other change.
   • BFollow the pre-approved procedure for standard changes, document the implementation, and notify stakeholders as required.
   • CSkip the change management process entirely because it is a routine upgrade.
   • DImplement the change without any documentation because it is standard.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company is implementing a new email filtering system that will affect all employees. The change has been approved and is scheduled for implementation. What is the most important communication step to take before the implementation?

   • AWait until after the implementation to notify employees to avoid unnecessary concern.
   • BSend a detailed technical document to the IT department only.
   • CNotify all employees about the upcoming change, its expected impact, and any actions they may need to take.
   • DNotify only the help desk, as they will handle any issues.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following should be considered during a security impact assessment of a proposed change?

   • AThe number of users who will be affected
   • BThe color scheme of the new user interface
   • CThe marketing strategy for the change
   • DThe potential for introducing new vulnerabilities
   Reveal Solution Discussion Select an answer first