2.4 Manage Security Aspects of Change Control ISSMP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization is updating its change control process to better integrate security. Which of the following is the MOST effective way to embed security requirements into the change control process?

   • ARequiring all change requests to include a security impact assessment
   • BAdding security questions to the change request form
   • CAllowing the security team to veto any change they do not like
   • DConducting security training for all change requestors
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a key output of a security impact analysis?

   • AA list of security controls that may be affected by the change
   • BA project schedule for implementing the change
   • CA cost-benefit analysis of the change
   • DA list of stakeholders who must approve the change
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is required to maintain a complete audit trail of all changes to its production systems. The change control process is currently manual, and there have been instances where change documentation was incomplete. The company is considering implementing a change management tool. Which of the following is the MOST important feature to look for in the tool to address the documentation issue?

   • AThe ability to integrate with the company's ticketing system
   • BThe ability to automate the change approval workflow
   • CThe ability to enforce mandatory fields in change requests
   • DThe ability to generate reports on change activity
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team is conducting a security impact analysis for a change that will move a critical application from an on-premises data center to a public cloud. The change is expected to reduce costs but may introduce new risks. Which of the following is the MOST important security impact to assess?

   • AThe cost savings from not having to maintain on-premises hardware
   • BThe potential for increased latency due to the cloud environment
   • CThe loss of direct control over the physical infrastructure
   • DThe need to retrain IT staff on cloud technologies
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An organization is required to maintain an audit trail of all changes to its financial reporting system. During a routine audit, it is discovered that several change requests were approved but the implementation steps were not documented. What is the MOST likely consequence of this lack of documentation?

   • AThe changes will be automatically reversed by the system.
   • BThe organization will be unable to demonstrate that the changes were properly reviewed and tested.
   • CThe change requests will be re-submitted for approval.
   • DThe changes will be considered low-risk and require no further action.
   Reveal Solution Discussion Select an answer first