220-1102 Operational Procedures Practice Question
A change advisory board (CAB) approved a standard change to update antivirus definitions on all servers. The technician completes the update on a file server and verifies the server is functioning normally. According to change management best practices, what documentation should the technician complete?
⚠ Common exam trap
A common mix-up: candidates confuse the informal communication step (emailing the CAB) with the formal documentation requirement (updating the change log), or they mistakenly think a backout plan is created after implementation rather than before.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the change log with implementation details and results
Change management best practices require that after implementing an approved change, the technician must document the implementation details and results in the change log. This ensures a complete audit trail, supports rollback decisions, and provides evidence that the change was executed as approved by the CAB. Simply updating antivirus definitions is a standard change, but the closure documentation is still mandatory for compliance and future reference.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Send an email summary to all CAB members
Why it's wrong here
Sending a summary email is a supplementary communication tool, but it does not satisfy the formal, auditable record-keeping requirement for a completed standard change. The change management system's change log is the authoritative system of record; emails are ephemeral, not version-controlled, and may be excluded from official change audits. Even for a pre-approved standard change, the implementer must close the loop by entering precise completion data into the change record, not merely broadcasting a summary.
- ✓
Update the change log with implementation details and results
Why this is correct
Updating the change log with implementation details (exact timestamp, steps actually taken, deviation notes, and verification results) is the required closure step for every approved change, including standard changes. This permanent entry provides an audit trail that proves the execution matched the CAB-approved template and supports fault analysis if later anomalies emerge. Without this update the change record remains in 'in progress' state, and the workflow cannot formally mark the change as closed.
- ✗
Create a backout plan in case the change fails
Why it's wrong here
A backout plan is a pre-implementation contingency artifact that must be designed, risk-assessed, and documented before authorization, so it is available to reverse the change if something fails during implementation. Drafting it after the change has already been applied is meaningless because it cannot roll back past actions and provides no guidance for mid-incident response. Standard changes typically embed the rollback procedure inside the standard operating procedure or change template, making a separate post-implementation backout plan both redundant and out of sequence.
- ✗
Submit a post-implementation review report
Why it's wrong here
A post-implementation review (PIR) is a formal assessment reserved for major, high-risk, or emergency changes that require a structured evaluation of outcomes, stakeholder input, and lessons learned—not for standard changes that follow a pre-approved, low-risk, repeatable procedure. Standard changes are governed by an existing approved change model, so their execution and results are validated against that model and captured in the change log. Forcing a PIR on every trivial standard change would inject unnecessary overhead and contradict the change policy's classification criteria.
Go deeper
Related to this question
Learn chapter
Linux Package Management: apt and yum
Key term
Change management
Change management is the structured process of planning, approving, implementing, and reviewing changes to IT systems to minimize risk and disruption.
Key term
Antivirus
Antivirus is software that detects, prevents, and removes malicious software (malware) from a computer or network.
About these practice questions
One of 925 original 220-1102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.