English
Menu

IT Service Management and Systems Audit

A serious security vulnerability has been found, and a patch must be applied to the production servers immediately. The regular meeting that reviews changes is two weeks away. Which of the following is the most appropriate response in change management?

  1. ABecause it is urgent, skip both approval and records, apply the patch immediately at the discretion of the person in charge, and report only if a problem occurs
  2. BFollow the normal procedure: review the impact and risk at the regular meeting two weeks from now, and apply the patch after it is approved
  3. CFollow the emergency change procedure defined in advance: a small group of authorized approvers quickly assesses and approves the change, it is applied, and the records are completed and reviewed afterward
Show answer and explanation

Answer: C. Follow the emergency change procedure defined in advance: a small group of authorized approvers quickly assesses and approves the change, it is applied, and the records are completed and reviewed afterward

Change management defines an emergency change procedure for changes that must be carried out urgently. Even for an emergency change, a small group of approvers with the authority to approve quickly assesses the impact and risk and approves it, and the change is applied after testing and a back-out procedure have been prepared as far as possible. If records and documents are completed after implementation, they are completed and reviewed afterward. If both approval and records are skipped, the cause cannot be traced when the change causes a failure.

  • A. Approval and records are not skipped even in an emergency; the simplified emergency change procedure is used instead.
  • B. Waiting two weeks greatly increases the risk that the vulnerability will be exploited.
  • C. Correct. The change is approved quickly under the emergency change procedure, applied, and reviewed afterward.
Practice this topic Back to topic

Books on IT Service Management and Systems Audit Ad

As an Amazon Associate I earn from qualifying purchases.

More IT Service Management and Systems Audit questions

  1. Several approved changes are bundled into a release and deployed to the production environment. Which of the following is an appropriate way to carry out release management?
  2. Which of the following describes a configuration item (CI) recorded in the CMDB (configuration management database) in configuration management appropriately?
  3. Which of the following is the main benefit of setting up a service desk as a single point of contact (SPOC) that receives all inquiries and failure reports from users?
  4. An incident received by a service desk staff member was about to exceed the resolution target time set in the SLA. The staff member reported the situation to the service desk manager and asked for a decision on adding staff and on contacting users. Which of the following is this action?
  5. Which of the following is an appropriate activity of capacity management?