CISA Question 202

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D3

  Since these quarterly price update jobs are not going through the regular change management process, continuous monitoring is crucial to detect any unexpected or erroneous changes resulting from the scheduled job. Exception reports will highlight anomalies or irregularities in the updated prices, enabling timely investigation and correction. This control provides a safety net that compensates for the lack of formal change management for these automated updates. Why not the others? A. An overarching approval from the change advisory board This would be ideal, but the question states the updates are outside the regular change management process. B. User acceptance testing (UAT) after production run UAT is generally performed before production deployment, and after-the-fact UAT is inefficient and may not catch issues timely. C. Each production run is approved by an authorized individual Approving a scheduled automated run may not be practical or effective without checking results post-run.

• Chose C2

  This ensures accountability and oversight, mitigating the risk of unauthorized or incorrect updates that could adversely affect the system or its data.

• Chose A1

  Approval control that does not go through the normal change management process should be responsibility of the CAB.