CISA Change Management Controls 3

Question 1

A change advisory board (CAB) is reviewing a proposed infrastructure change. The MOST important information the CAB needs is:

Accepted Answer

The risk assessment and rollback plan

Answer

Risk assessment and rollback plan are essential for the CAB to make an informed approval decision and ensure recovery capability if the change fails.

Question 2

Which situation represents a segregation of duties violation in change management?

Accepted Answer

A developer writes the code, tests it, and promotes it to production

Answer

Allowing one developer to write, test, and deploy code eliminates the checks that detect errors or fraud before changes reach production.

Question 3

An organization uses automated deployment pipelines. What change management control is MOST critical to implement in this context?

Accepted Answer

Embedding approval gates and automated testing within the pipeline

Answer

Automated pipelines must include programmatic approval gates and testing checkpoints to maintain change control discipline while preserving speed.

Question 4

When auditing change management, which metric BEST indicates that the process is effective?

Accepted Answer

Percentage of changes that required rollback due to failures

Answer

A low change-failure/rollback rate indicates that changes are being adequately planned, tested, and reviewed before deployment.

Question 5

An IS auditor is assessing a SaaS vendor's change management process. The MOST important concern is:

Accepted Answer

Whether the client has visibility into changes that may affect service levels

Answer

Clients must receive advance notification of vendor changes that could affect availability, security, or functionality to manage their own risk exposure.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Change Management Controls 3