Security+ topic 1.2
Change Management and Security
Many outages and security holes come from changes made without a plan. Change management makes changes safe: someone requests the change, owners and stakeholders review its impact, a change advisory board approves it, it is tested, and it is scheduled in a maintenance window with a backout plan in case it fails. Technical details matter too, such as allow and deny lists, restricted activities, required restarts, legacy applications, and dependencies between services. Afterward, documentation, network diagrams, and version control are updated so the next person knows what changed.
Change Management and Security vocabulary
- Change advisory board (CAB): The group that reviews and approves proposed changes.
- Backout plan: Steps to undo a change and return to the last working state if it fails.
- Maintenance window: A scheduled time for changes when the impact on users is lowest.
- Impact analysis: Studying what a change could affect before approving it.
Exam-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
An administrator applied a firewall update during business hours without approval. The update blocked the payroll application, and no one knew how to reverse it.
1. Which of the following would have most likely prevented the long outage?
- (A) A backout plan
- (B) A honeypot
- (C) A stronger password policy
- (D) A risk register
Show answer
(A) A backout plan A backout plan gives steps to undo a change that causes problems.
2. Which of the following groups is responsible for reviewing and approving proposed changes to production systems?
- (A) The red team
- (B) The change advisory board
- (C) The data custodians
- (D) The incident response team
Show answer
(B) The change advisory board The change advisory board reviews and approves changes.
3. A change requires restarting a database that several applications depend on. Which of the following should be done first?
- (A) Restart the database immediately
- (B) Perform an impact analysis to identify dependent services
- (C) Delete the database logs
- (D) Disable the firewall during the change
Show answer
(B) Perform an impact analysis to identify dependent services An impact analysis finds dependencies so the change can be scheduled and communicated safely.
4. Why do organizations schedule changes during a maintenance window?
- (A) To avoid documenting the change
- (B) To make the change when it will affect the fewest users
- (C) To skip testing
- (D) To give attackers less time to notice
Show answer
(B) To make the change when it will affect the fewest users Maintenance windows are chosen for low impact on users and the business.