2.4 Manage Security Aspects of Change Control ISSMP Practice Questions (Page 6)

Questions 26–27

1. 26expert · hard

   An organization has a change control policy that requires continuous monitoring of changes to ensure they do not introduce security issues. A recent change to a web server configuration was approved and implemented. A week later, a security scan reveals a new vulnerability on the server. What is the MOST likely cause of this vulnerability?

   • AThe change introduced a misconfiguration that was not detected during the security impact analysis
   • BThe change was approved by the wrong stakeholders
   • CThe change was not properly documented in the change log
   • DThe continuous monitoring was not performed after the change
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary goal of a security impact analysis for a proposed change?

   • ATo determine the cost of implementing the change
   • BTo ensure the change is approved by all stakeholders
   • CTo document the change in the change management system
   • DTo identify the potential security effects of the change on the organization
   Reveal Solution Discussion Select an answer first