2.4 Manage Security Aspects of Change Control ISSMP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A network administrator proposes a change to the company's firewall rules to allow a new vendor application to communicate with an internal database. The security team is asked to assess the change. Which of the following is the MOST important security consideration during the security impact analysis?

   • AThe vendor's marketing materials for the application
   • BThe potential for the new rule to create an unauthorized access path to the database
   • CThe cost of the new vendor application
   • DThe number of users who will use the new application
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of defining security criteria for change requests in a change control process?

   • ATo eliminate the need for security testing after a change is implemented
   • BTo provide a consistent basis for evaluating whether a proposed change meets the organization's security requirements
   • CTo ensure that all changes are approved by the Chief Information Security Officer
   • DTo ensure that all changes are reviewed by the security team before implementation
   Reveal Solution Discussion Select an answer first
4. 3expert · hard · select all that apply

   A company is implementing a new single sign-on (SSO) solution that will affect all employees and external partners. The change control process requires coordination with stakeholders. Which of the following stakeholders should be included in the change control process? (Select all that apply.)

   • AThe security team
   • BThe marketing department
   • CThe external partners who will use the SSO solution
   • DThe facilities management team
   • EThe IT help desk team
   Check answers Discussion Select an answer first
5. 4application · medium

   An organization has a change control process that requires all changes to be documented and tracked. A security administrator notices that a recent change to a firewall rule was implemented but the change request form was never completed. What is the MOST appropriate action for the security administrator to take?

   • AIgnore the issue because the change has already been implemented and is working.
   • BInvestigate why the change was not documented and ensure the change is properly recorded in the change log.
   • CReverse the firewall change immediately to restore the previous configuration.
   • DComplete the change request form retroactively and submit it for approval.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company has a policy that all changes to production systems must be approved by the change advisory board (CAB). A developer submits an urgent change to fix a critical security vulnerability. The CAB is not scheduled to meet for another week. What is the BEST way to handle this situation while maintaining policy compliance?

   • AUse the emergency change process, which allows for expedited approval and post-implementation review.
   • BImplement the change immediately and inform the CAB at the next meeting.
   • CWait for the next CAB meeting to approve the change before implementing it.
   • DHave the developer implement the change without any approval because it is a security fix.
   Reveal Solution Discussion Select an answer first