Topic 03 Practice Test 2 covers Change Management and Security for CompTIA Security+ SY0-701 and maps to objective 1.3: Explain the importance of change management processes and the impact to security. For broader exam preparation, review the CompTIA Security+ Exam Dumps. Every option includes focused editorial reasoning explaining both the concept and its fit to the scenario.
Question 1
A security engineer is working through a controlled production-change review. The immediate requirement is involvement of affected business and technical parties before a change is made. Which choice is the best fit?
- Version control
- Stakeholder review
- Dependency analysis
- Impact analysis
Correct Answer: B
Correct Answer
Answer B is correct because Stakeholder review means involvement of affected business and technical parties before a change is made. This is the precise fit for the scenario. Dependency analysis serves the different purpose of identification of systems, applications, services, or integrations that rely on the component being changed.
Incorrect Answers
Answer A is incorrect because Version control means tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back. The key mismatch is functional: Stakeholder review addresses involvement of affected business and technical parties before a change is made, the need stated by the question.
Answer C is incorrect because Dependency analysis means identification of systems, applications, services, or integrations that rely on the component being changed. The concept is valid, but it does not match this stem. The required function is involvement of affected business and technical parties before a change is made, which maps to Stakeholder review.
Answer D is incorrect because Impact analysis means evaluation of how a proposed change may affect systems, users, security controls, and business processes. The key mismatch is functional: Stakeholder review addresses involvement of affected business and technical parties before a change is made, the need stated by the question.
Question 2
Which term describes evidence from validation activities that demonstrates whether the proposed change behaves as expected?
- Standard operating procedure
- Version control
- Test results
- Maintenance window
Correct Answer: C
Correct Answer
Answer C is correct because Test results means evidence from validation activities that demonstrates whether the proposed change behaves as expected. The requirement maps directly to this function, whereas Maintenance window is aimed at a scheduled period during which disruptive changes can be implemented with controlled operational impact.
Incorrect Answers
Answer A is incorrect because Standard operating procedure refers to a documented, repeatable set of steps for performing routine operational tasks consistently. The scenario instead requires evidence from validation activities that demonstrates whether the proposed change behaves as expected, which is why Test results is the better answer; this option serves the different function defined above.
Answer B is incorrect because Version control refers to tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back. The question is not asking for this function. It is testing evidence from validation activities that demonstrates whether the proposed change behaves as expected, so Test results is the stronger fit.
Answer D is incorrect because Maintenance window refers to a scheduled period during which disruptive changes can be implemented with controlled operational impact. This could be appropriate elsewhere, but the required function is evidence from validation activities that demonstrates whether the proposed change behaves as expected; that makes Test results the precise choice.
Question 3
The control set for a controlled production-change review must address both evidence from validation activities that demonstrates whether the proposed change behaves as expected and updating diagrams, procedures, and configuration records so they match the post-change environment. Which TWO choices map directly to those needs? Choose TWO.
- Dependency analysis
- Impact analysis
- Configuration documentation
- Version control
- Test results
Correct Answers: C, E
Correct Answers
Answer C is correct because Configuration documentation means updating diagrams, procedures, and configuration records so they match the post-change environment. This selection maps directly to one of the named needs. Impact analysis addresses evaluation of how a proposed change may affect systems, users, security controls, and business processes, so it does not satisfy the same slot.
Answer E is correct because Test results means evidence from validation activities that demonstrates whether the proposed change behaves as expected. This selection maps directly to one of the named needs. Dependency analysis addresses identification of systems, applications, services, or integrations that rely on the component being changed, so it does not satisfy the same slot.
Incorrect Answers
Answer A is incorrect because Dependency analysis means identification of systems, applications, services, or integrations that rely on the component being changed. The question requires exactly 2 selections: Configuration documentation, Test results. This option falls outside that required set.
Answer B is incorrect because Impact analysis means evaluation of how a proposed change may affect systems, users, security controls, and business processes. The scenario calls for Configuration documentation, Test results. Selecting this option would leave one of those required functions uncovered.
Answer D is incorrect because Version control means tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back. Every answer slot must map to a stated requirement. The correct set is Configuration documentation, Test results, so this option cannot replace one of those selections.
Question 4
A security engineer is working through a controlled production-change review. The immediate requirement is validation that access-control entries still permit only intended items and block known-unwanted items after a change. Which choice is the best fit?
- Allow list and deny list review
- Approval process
- Test results
- Configuration documentation
Correct Answer: A
Correct Answer
Answer A is correct because Allow list and deny list review means validation that access-control entries still permit only intended items and block known-unwanted items after a change. This matches the requirement as written. Approval process can be valid in another context, but it is used for the formal authorization step that ensures a proposed change is reviewed before implementation.
Incorrect Answers
Answer B is incorrect because Approval process means the formal authorization step that ensures a proposed change is reviewed before implementation. The scenario instead requires validation that access-control entries still permit only intended items and block known-unwanted items after a change, which is why Allow list and deny list review is the better answer; this option serves the different function defined above.
Answer C is incorrect because Test results means evidence from validation activities that demonstrates whether the proposed change behaves as expected. The question is not asking for this function. It is testing validation that access-control entries still permit only intended items and block known-unwanted items after a change, so Allow list and deny list review is the stronger fit.
Answer D is incorrect because Configuration documentation means updating diagrams, procedures, and configuration records so they match the post-change environment. The key mismatch is functional: Allow list and deny list review addresses validation that access-control entries still permit only intended items and block known-unwanted items after a change, the need stated by the question.
Question 5
Two requirements remain open in a controlled production-change review: involvement of affected business and technical parties before a change is made; scheduled period during which disruptive changes can be implemented with controlled operational impact. Which TWO options close those specific gaps? Choose TWO.
- Approval process
- Impact analysis
- Maintenance window
- Change ownership
- Stakeholder review
Correct Answers: C, E
Correct Answers
Answer C is correct because Maintenance window means a scheduled period during which disruptive changes can be implemented with controlled operational impact. This selection maps directly to one of the named needs. Impact analysis addresses evaluation of how a proposed change may affect systems, users, security controls, and business processes, so it does not satisfy the same slot.
Answer E is correct because Stakeholder review means involvement of affected business and technical parties before a change is made. This option satisfies a specific requirement in the stem; Change ownership serves clear assignment of responsibility for planning, implementing, and following up on a change and therefore is not interchangeable with it.
Incorrect Answers
Answer A is incorrect because Approval process means the formal authorization step that ensures a proposed change is reviewed before implementation. The required choices are Stakeholder review, Maintenance window. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer B is incorrect because Impact analysis means evaluation of how a proposed change may affect systems, users, security controls, and business processes. The fixed-count answer set is Stakeholder review, Maintenance window; this option does not fill one of those named functions.
Answer D is incorrect because Change ownership means clear assignment of responsibility for planning, implementing, and following up on a change. The fixed-count answer set is Stakeholder review, Maintenance window; this option does not fill one of those named functions.
Question 6
During a controlled production-change review, the team needs tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back. Which option best meets this requirement?
- Version control
- Impact analysis
- Maintenance window
- Dependency analysis
Correct Answer: A
Correct Answer
Answer A is correct because Version control means tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back. The deciding point is functional fit: this option covers the stated need, while Maintenance window addresses a scheduled period during which disruptive changes can be implemented with controlled operational impact.
Incorrect Answers
Answer B is incorrect because Impact analysis means evaluation of how a proposed change may affect systems, users, security controls, and business processes. The concept is valid, but it does not match this stem. The required function is tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back, which maps to Version control.
Answer C is incorrect because Maintenance window means a scheduled period during which disruptive changes can be implemented with controlled operational impact. The scenario instead requires tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back, which is why Version control is the better answer; this option serves the different function defined above.
Answer D is incorrect because Dependency analysis means identification of systems, applications, services, or integrations that rely on the component being changed. That concept can be valid in another scenario, but this question is testing tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back; Version control therefore fits the requirement more directly.
Question 7
Two requirements remain open in a controlled production-change review: evaluation of how a proposed change may affect systems, users, security controls, and business processes; evidence from validation activities that demonstrates whether the proposed change behaves as expected. Which TWO options close those specific gaps? Choose TWO.
- Test results
- Dependency analysis
- Version control
- Impact analysis
- Standard operating procedure
Correct Answers: A, D
Correct Answers
Answer A is correct because Test results means evidence from validation activities that demonstrates whether the proposed change behaves as expected. The fixed-count item needs this function in the answer set. Dependency analysis covers identification of systems, applications, services, or integrations that rely on the component being changed, a different requirement.
Answer D is correct because Impact analysis means evaluation of how a proposed change may affect systems, users, security controls, and business processes. One required function is exactly what this option provides. Standard operating procedure may be useful elsewhere, but it is used for a documented, repeatable set of steps for performing routine operational tasks consistently.
Incorrect Answers
Answer B is incorrect because Dependency analysis means identification of systems, applications, services, or integrations that rely on the component being changed. The fixed-count answer set is Test results, Impact analysis; this option does not fill one of those named functions.
Answer C is incorrect because Version control means tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back. The required choices are Test results, Impact analysis. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer E is incorrect because Standard operating procedure means a documented, repeatable set of steps for performing routine operational tasks consistently. The question requires exactly 2 selections: Test results, Impact analysis. This option falls outside that required set. For example, Test results is required for evidence from validation activities that demonstrates whether the proposed change behaves as expected.
Question 8
The team is resolving a gap found during a controlled production-change review: it needs scheduled period during which disruptive changes can be implemented with controlled operational impact. Which option is most appropriate?
- Dependency analysis
- Approval process
- Maintenance window
- Version control
Correct Answer: C
Correct Answer
Answer C is correct because Maintenance window means a scheduled period during which disruptive changes can be implemented with controlled operational impact. The deciding point is functional fit: this option covers the stated need, while Dependency analysis addresses identification of systems, applications, services, or integrations that rely on the component being changed.
Incorrect Answers
Answer A is incorrect because Dependency analysis means identification of systems, applications, services, or integrations that rely on the component being changed. This could be appropriate elsewhere, but the required function is a scheduled period during which disruptive changes can be implemented with controlled operational impact; that makes Maintenance window the precise choice.
Answer B is incorrect because Approval process means the formal authorization step that ensures a proposed change is reviewed before implementation. The scenario instead requires a scheduled period during which disruptive changes can be implemented with controlled operational impact, which is why Maintenance window is the better answer; this option serves the different function defined above.
Answer D is incorrect because Version control means tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back. That concept can be valid in another scenario, but this question is testing a scheduled period during which disruptive changes can be implemented with controlled operational impact; Maintenance window therefore fits the requirement more directly.
Question 9
A security plan created during a controlled production-change review must provide involvement of affected business and technical parties before a change is made, evidence from validation activities that demonstrates whether the proposed change behaves as expected, and validation that access-control entries still permit only intended items and block known-unwanted items after a change. Which THREE options should be selected? Choose THREE.
- Dependency analysis
- Backout plan
- Test results
- Allow list and deny list review
- Stakeholder review
- Maintenance window
Correct Answers: C, D, E
Correct Answers
Answer C is correct because Test results means evidence from validation activities that demonstrates whether the proposed change behaves as expected. This selection maps directly to one of the named needs. Maintenance window addresses a scheduled period during which disruptive changes can be implemented with controlled operational impact, so it does not satisfy the same slot.
Answer D is correct because Allow list and deny list review means validation that access-control entries still permit only intended items and block known-unwanted items after a change. It belongs in the fixed-count answer set because it covers one of the stated requirements. Dependency analysis instead serves identification of systems, applications, services, or integrations that rely on the component being changed and cannot replace this function.
Answer E is correct because Stakeholder review means involvement of affected business and technical parties before a change is made. It belongs in the fixed-count answer set because it covers one of the stated requirements. Backout plan instead serves a documented method for reversing a change if implementation causes unacceptable problems and cannot replace this function.
Incorrect Answers
Answer A is incorrect because Dependency analysis means identification of systems, applications, services, or integrations that rely on the component being changed. Every answer slot must map to a stated requirement. The correct set is Allow list and deny list review, Stakeholder review, Test results, so this option cannot replace one of those selections.
Answer B is incorrect because Backout plan means a documented method for reversing a change if implementation causes unacceptable problems. The required choices are Allow list and deny list review, Stakeholder review, Test results. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer F is incorrect because Maintenance window means a scheduled period during which disruptive changes can be implemented with controlled operational impact. The required choices are Allow list and deny list review, Stakeholder review, Test results. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 10
To prevent unreviewed or unauthorized changes from reaching production, which security approach should be selected?
- Allow list and deny list review
- Approval process
- Configuration documentation
- Version control
Correct Answer: B
Correct Answer
Answer B is correct because Approval process means the formal authorization step that ensures a proposed change is reviewed before implementation. That is the function the question is testing. Version control would instead be used for tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back.
Incorrect Answers
Answer A is incorrect because Allow list and deny list review refers to validation that access-control entries still permit only intended items and block known-unwanted items after a change. The scenario instead requires the formal authorization step that ensures a proposed change is reviewed before implementation, which is why Approval process is the better answer; this option serves the different function defined above.
Answer C is incorrect because Configuration documentation refers to updating diagrams, procedures, and configuration records so they match the post-change environment. The scenario instead requires the formal authorization step that ensures a proposed change is reviewed before implementation, which is why Approval process is the better answer; this option serves the different function defined above.
Answer D is incorrect because Version control refers to tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back. The scenario instead requires the formal authorization step that ensures a proposed change is reviewed before implementation, which is why Approval process is the better answer; this option serves the different function defined above.
Question 11
To reduce variance and mistakes during security-sensitive operations, which security approach should be selected?
- Approval process
- Stakeholder review
- Version control
- Standard operating procedure
Correct Answer: D
Correct Answer
Answer D is correct because Standard operating procedure means a documented, repeatable set of steps for performing routine operational tasks consistently. This is the precise fit for the scenario. Stakeholder review serves the different purpose of involvement of affected business and technical parties before a change is made.
Incorrect Answers
Answer A is incorrect because Approval process refers to the formal authorization step that ensures a proposed change is reviewed before implementation. The concept is valid, but it does not match this stem. The required function is a documented, repeatable set of steps for performing routine operational tasks consistently, which maps to Standard operating procedure.
Answer B is incorrect because Stakeholder review refers to involvement of affected business and technical parties before a change is made. The concept is valid, but it does not match this stem. The required function is a documented, repeatable set of steps for performing routine operational tasks consistently, which maps to Standard operating procedure.
Answer C is incorrect because Version control refers to tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back. The scenario instead requires a documented, repeatable set of steps for performing routine operational tasks consistently, which is why Standard operating procedure is the better answer; this option serves the different function defined above.
Question 12
During a controlled production-change review, the team has two independent requirements: (1) clear assignment of responsibility for planning, implementing, and following up on a change; and (2) tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back. Which TWO choices best satisfy those requirements? Choose TWO.
- Maintenance window
- Change ownership
- Version control
- Stakeholder review
- Standard operating procedure
Correct Answers: B, C
Correct Answers
Answer B is correct because Change ownership means clear assignment of responsibility for planning, implementing, and following up on a change. The fixed-count item needs this function in the answer set. Standard operating procedure covers a documented, repeatable set of steps for performing routine operational tasks consistently, a different requirement.
Answer C is correct because Version control means tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back. One required function is exactly what this option provides. Maintenance window may be useful elsewhere, but it is used for a scheduled period during which disruptive changes can be implemented with controlled operational impact.
Incorrect Answers
Answer A is incorrect because Maintenance window means a scheduled period during which disruptive changes can be implemented with controlled operational impact. Every answer slot must map to a stated requirement. The correct set is Change ownership, Version control, so this option cannot replace one of those selections.
Answer D is incorrect because Stakeholder review means involvement of affected business and technical parties before a change is made. The question requires exactly 2 selections: Change ownership, Version control. This option falls outside that required set. For example, Version control is required for tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back.
Answer E is incorrect because Standard operating procedure means a documented, repeatable set of steps for performing routine operational tasks consistently. The required choices are Change ownership, Version control. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 13
The team is resolving a gap found during a controlled production-change review: it needs clear assignment of responsibility for planning, implementing, and following up on a change. Which option is most appropriate?
- Impact analysis
- Backout plan
- Maintenance window
- Change ownership
Correct Answer: D
Correct Answer
Answer D is correct because Change ownership means clear assignment of responsibility for planning, implementing, and following up on a change. The deciding point is functional fit: this option covers the stated need, while Maintenance window addresses a scheduled period during which disruptive changes can be implemented with controlled operational impact.
Incorrect Answers
Answer A is incorrect because Impact analysis means evaluation of how a proposed change may affect systems, users, security controls, and business processes. That concept can be valid in another scenario, but this question is testing clear assignment of responsibility for planning, implementing, and following up on a change; Change ownership therefore fits the requirement more directly.
Answer B is incorrect because Backout plan means a documented method for reversing a change if implementation causes unacceptable problems. The concept is valid, but it does not match this stem. The required function is clear assignment of responsibility for planning, implementing, and following up on a change, which maps to Change ownership.
Answer C is incorrect because Maintenance window means a scheduled period during which disruptive changes can be implemented with controlled operational impact. The question is not asking for this function. It is testing clear assignment of responsibility for planning, implementing, and following up on a change, so Change ownership is the stronger fit.
Question 14
Which term describes evaluation of how a proposed change may affect systems, users, security controls, and business processes?
- Dependency analysis
- Backout plan
- Impact analysis
- Configuration documentation
Correct Answer: C
Correct Answer
Answer C is correct because Impact analysis means evaluation of how a proposed change may affect systems, users, security controls, and business processes. This is the precise fit for the scenario. Dependency analysis serves the different purpose of identification of systems, applications, services, or integrations that rely on the component being changed.
Incorrect Answers
Answer A is incorrect because Dependency analysis refers to identification of systems, applications, services, or integrations that rely on the component being changed. This could be appropriate elsewhere, but the required function is evaluation of how a proposed change may affect systems, users, security controls, and business processes; that makes Impact analysis the precise choice.
Answer B is incorrect because Backout plan refers to a documented method for reversing a change if implementation causes unacceptable problems. The question is not asking for this function. It is testing evaluation of how a proposed change may affect systems, users, security controls, and business processes, so Impact analysis is the stronger fit.
Answer D is incorrect because Configuration documentation refers to updating diagrams, procedures, and configuration records so they match the post-change environment. The concept is valid, but it does not match this stem. The required function is evaluation of how a proposed change may affect systems, users, security controls, and business processes, which maps to Impact analysis.
Question 15
A security engineer is working through a controlled production-change review. The immediate requirement is evidence from validation activities that demonstrates whether the proposed change behaves as expected. Which choice is the best fit?
- Backout plan
- Change ownership
- Test results
- Version control
Correct Answer: C
Correct Answer
Answer C is correct because Test results means evidence from validation activities that demonstrates whether the proposed change behaves as expected. That is the function the question is testing. Backout plan would instead be used for a documented method for reversing a change if implementation causes unacceptable problems.
Incorrect Answers
Answer A is incorrect because Backout plan means a documented method for reversing a change if implementation causes unacceptable problems. The concept is valid, but it does not match this stem. The required function is evidence from validation activities that demonstrates whether the proposed change behaves as expected, which maps to Test results.
Answer B is incorrect because Change ownership means clear assignment of responsibility for planning, implementing, and following up on a change. This could be appropriate elsewhere, but the required function is evidence from validation activities that demonstrates whether the proposed change behaves as expected; that makes Test results the precise choice.
Answer D is incorrect because Version control means tracking revisions to code, configuration, or documents so changes can be identified, compared, and rolled back. The key mismatch is functional: Test results addresses evidence from validation activities that demonstrates whether the proposed change behaves as expected, the need stated by the question.
Question 16
Two requirements remain open in a controlled production-change review: documented method for reversing a change if implementation causes unacceptable problems; scheduled period during which disruptive changes can be implemented with controlled operational impact. Which TWO options close those specific gaps? Choose TWO.
- Allow list and deny list review
- Configuration documentation
- Backout plan
- Maintenance window
- Standard operating procedure
Correct Answers: C, D
Correct Answers
Answer C is correct because Backout plan means a documented method for reversing a change if implementation causes unacceptable problems. One required function is exactly what this option provides. Allow list and deny list review may be useful elsewhere, but it is used for validation that access-control entries still permit only intended items and block known-unwanted items after a change.
Answer D is correct because Maintenance window means a scheduled period during which disruptive changes can be implemented with controlled operational impact. One required function is exactly what this option provides. Configuration documentation may be useful elsewhere, but it is used for updating diagrams, procedures, and configuration records so they match the post-change environment.
Incorrect Answers
Answer A is incorrect because Allow list and deny list review means validation that access-control entries still permit only intended items and block known-unwanted items after a change. Every answer slot must map to a stated requirement. The correct set is Backout plan, Maintenance window, so this option cannot replace one of those selections.
Answer B is incorrect because Configuration documentation means updating diagrams, procedures, and configuration records so they match the post-change environment. The fixed-count answer set is Backout plan, Maintenance window; this option does not fill one of those named functions.
Answer E is incorrect because Standard operating procedure means a documented, repeatable set of steps for performing routine operational tasks consistently. The required choices are Backout plan, Maintenance window. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 17
To support approval with proof that the change was tested safely, which security approach should be selected?
- Dependency analysis
- Test results
- Allow list and deny list review
- Standard operating procedure
Correct Answer: B
Correct Answer
Answer B is correct because Test results means evidence from validation activities that demonstrates whether the proposed change behaves as expected. That makes it the best answer here; Allow list and deny list review addresses validation that access-control entries still permit only intended items and block known-unwanted items after a change, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Dependency analysis refers to identification of systems, applications, services, or integrations that rely on the component being changed. The scenario instead requires evidence from validation activities that demonstrates whether the proposed change behaves as expected, which is why Test results is the better answer; this option serves the different function defined above.
Answer C is incorrect because Allow list and deny list review refers to validation that access-control entries still permit only intended items and block known-unwanted items after a change. The scenario instead requires evidence from validation activities that demonstrates whether the proposed change behaves as expected, which is why Test results is the better answer; this option serves the different function defined above.
Answer D is incorrect because Standard operating procedure refers to a documented, repeatable set of steps for performing routine operational tasks consistently. The scenario instead requires evidence from validation activities that demonstrates whether the proposed change behaves as expected, which is why Test results is the better answer; this option serves the different function defined above. This question specifically tests the requirement represented by Test results.
Question 18
During a controlled production-change review, the team needs documented method for reversing a change if implementation causes unacceptable problems. Which option best meets this requirement?
- Backout plan
- Standard operating procedure
- Maintenance window
- Dependency analysis
Correct Answer: A
Correct Answer
Answer A is correct because Backout plan means a documented method for reversing a change if implementation causes unacceptable problems. That makes it the best answer here; Dependency analysis addresses identification of systems, applications, services, or integrations that rely on the component being changed, not the function requested in the stem.
Incorrect Answers
Answer B is incorrect because Standard operating procedure means a documented, repeatable set of steps for performing routine operational tasks consistently. The concept is valid, but it does not match this stem. The required function is a documented method for reversing a change if implementation causes unacceptable problems, which maps to Backout plan.
Answer C is incorrect because Maintenance window means a scheduled period during which disruptive changes can be implemented with controlled operational impact. That concept can be valid in another scenario, but this question is testing a documented method for reversing a change if implementation causes unacceptable problems; Backout plan therefore fits the requirement more directly.
Answer D is incorrect because Dependency analysis means identification of systems, applications, services, or integrations that rely on the component being changed. The scenario instead requires a documented method for reversing a change if implementation causes unacceptable problems, which is why Backout plan is the better answer; this option serves the different function defined above.
Question 19
The team is resolving a gap found during a controlled production-change review: it needs documented, repeatable set of steps for performing routine operational tasks consistently. Which option is most appropriate?
- Impact analysis
- Standard operating procedure
- Approval process
- Change ownership
Correct Answer: B
Correct Answer
Answer B is correct because Standard operating procedure means a documented, repeatable set of steps for performing routine operational tasks consistently. The deciding point is functional fit: this option covers the stated need, while Impact analysis addresses evaluation of how a proposed change may affect systems, users, security controls, and business processes.
Incorrect Answers
Answer A is incorrect because Impact analysis means evaluation of how a proposed change may affect systems, users, security controls, and business processes. The question is not asking for this function. It is testing a documented, repeatable set of steps for performing routine operational tasks consistently, so Standard operating procedure is the stronger fit.
Answer C is incorrect because Approval process means the formal authorization step that ensures a proposed change is reviewed before implementation. The scenario instead requires a documented, repeatable set of steps for performing routine operational tasks consistently, which is why Standard operating procedure is the better answer; this option serves the different function defined above.
Answer D is incorrect because Change ownership means clear assignment of responsibility for planning, implementing, and following up on a change. The question is not asking for this function. It is testing a documented, repeatable set of steps for performing routine operational tasks consistently, so Standard operating procedure is the stronger fit.
Question 20
Which term describes clear assignment of responsibility for planning, implementing, and following up on a change?
- Allow list and deny list review
- Test results
- Configuration documentation
- Change ownership
Correct Answer: D
Correct Answer
Answer D is correct because Change ownership means clear assignment of responsibility for planning, implementing, and following up on a change. That is the function the question is testing. Test results would instead be used for evidence from validation activities that demonstrates whether the proposed change behaves as expected.
Incorrect Answers
Answer A is incorrect because Allow list and deny list review refers to validation that access-control entries still permit only intended items and block known-unwanted items after a change. The scenario instead requires clear assignment of responsibility for planning, implementing, and following up on a change, which is why Change ownership is the better answer; this option serves the different function defined above.
Answer B is incorrect because Test results refers to evidence from validation activities that demonstrates whether the proposed change behaves as expected. The concept is valid, but it does not match this stem. The required function is clear assignment of responsibility for planning, implementing, and following up on a change, which maps to Change ownership.
Answer C is incorrect because Configuration documentation refers to updating diagrams, procedures, and configuration records so they match the post-change environment. The concept is valid, but it does not match this stem. The required function is clear assignment of responsibility for planning, implementing, and following up on a change, which maps to Change ownership.
