A proposed change will update the encryption algorithm used for data at rest from AES-128 to AES-256. The change review must consider the impact on systems that are not capable of supporting AES-256. What is the most appropriate action?

Approve the change and require all systems to be upgraded immediately.

Approve the change because AES-256 is more secure.

Reject the change because some systems are not compatible.

Approve the change with a plan to upgrade or replace incompatible systems.

When assessing the impact of a proposed change, which of the following is the most important to consider?

The impact on system confidentiality, integrity, and availability

The number of users affected by the change

The cost of the change implementation

The time required to implement the change

Which activity is an example of verification of a change?

Rolling back the change if issues occur

Testing the change in a staging environment to confirm it functions as expected

A healthcare organization is implementing a new electronic health record (EHR) system. The change will involve migrating patient data from a legacy system. The change review board is assessing the impact on data confidentiality and integrity. The legacy system has been in use for many years and contains data that may be incomplete or inaccurate. The new system will have enhanced security controls. After the migration, the risk assessment documentation must be updated. What is the most appropriate action?

Approve the change with a requirement to perform data cleansing and validation before migration, and update the risk assessment to reflect the new system's controls and residual risks.

Reject the change because the legacy data may be inaccurate.

Approve the change because the new system has better security controls.

Approve the change and update the risk assessment after migration.

When should risk assessment documentation be updated in relation to a change?

Only during the annual risk review

After the change is implemented and verified

Only if a security incident occurs

Information Systems Security Engineering Professional

Domain 5Objective 3

Participate in Change Management ISSEP Practice Questions (Page 2)

Part of the Secure Operations, Change Management and Disposal domain, which accounts for 14% of the ISSEP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

4concepts

14%of the exam

Questions 6–10

6application · medium
A proposed change will update the encryption algorithm used for data at rest from AES-128 to AES-256. The change review must consider the impact on systems that are not capable of supporting AES-256. What is the most appropriate action?
Select an answer first
7foundation · easy
When assessing the impact of a proposed change, which of the following is the most important to consider?
Select an answer first
8foundation · easy
Which activity is an example of verification of a change?
Select an answer first
9expert · hard
A healthcare organization is implementing a new electronic health record (EHR) system. The change will involve migrating patient data from a legacy system. The change review board is assessing the impact on data confidentiality and integrity. The legacy system has been in use for many years and contains data that may be incomplete or inaccurate. The new system will have enhanced security controls. After the migration, the risk assessment documentation must be updated. What is the most appropriate action?
Select an answer first
10foundation · easy
When should risk assessment documentation be updated in relation to a change?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSEP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSEP” is a trademark of its owner, used for identification only.