2.4 Manage Security Aspects of Change Control ISSMP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is planning a major upgrade to its customer relationship management (CRM) system. The change will affect multiple departments, and there are concerns about data privacy. The change control process requires that security requirements be integrated. Which of the following is the BEST way to ensure that data privacy requirements are included in the change?

   • ADefer privacy considerations to the post-implementation review
   • BRely on the vendor's assurance that the system is compliant with privacy regulations
   • CInvolve the legal team only if a data breach occurs
   • DAdd a data privacy impact assessment as a mandatory part of the change request
   Reveal Solution Discussion Select an answer first
2. 7expert · hard · select all that apply

   A company has a policy that all changes must be continuously monitored to ensure they do not introduce security issues. Which of the following activities are part of continuous monitoring after a change? (Select all that apply.)

   • AUpdating the change request form after implementation
   • BRunning vulnerability scans on the affected systems
   • CComparing system behavior to a baseline
   • DReviewing system logs for unusual activity
   • EConducting a security impact analysis before approval
   Check answers Discussion Select an answer first
4. 8expert · hard · select all that apply

   An organization is reviewing its change control process to improve the audit trail. Which of the following practices would improve the documentation and tracking of changes? (Select all that apply.)

   • ARequiring all change requests to be submitted through a centralized system
   • BConducting periodic audits of the change log
   • CAllowing changes to be implemented before documentation is completed
   • DRecording the date, time, and person responsible for each change
   • EDeleting change records after the change is implemented
   Check answers Discussion Select an answer first
5. 9application · medium

   A security analyst is performing a security impact analysis for a change that will update the encryption algorithm used for data at rest. Which of the following is the MOST important factor to consider in the analysis?

   • AThe cost of the new encryption software
   • BThe strength of the new algorithm and its resistance to known attacks
   • CThe number of systems that will be affected by the change
   • DThe compatibility of the new algorithm with existing systems
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is the most effective way to embed security requirements into the change control process?

   • AConduct security training for all employees before any change is made
   • BAdd a security review step to the change control workflow that uses predefined security criteria
   • CRequire all change requests to be approved by the security team
   • DPerform a security audit after each change is implemented
   Reveal Solution Discussion Select an answer first