220-1102 Operational Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Implement the patch immediately since time is critical, then document it later

  Why it's wrong here

  While time is a genuine concern, implementing a patch outside the change process creates an undocumented, unauthorized baseline change and eliminates the opportunity to assess rollback plans, dependencies, and potential conflicts with existing configurations. The policy likely mandates that even emergency changes obtain at least expedited approval and a post-change review; 'document later' often becomes 'never documented.' This makes the organization non-compliant and exposes it to audit findings and an unverified, potentially unstable production environment.

• ✓

  Document the change with the justification for urgency and submit it to the CAB for emergency approval

  Why this is correct

  This response correctly uses the emergency change pathway: the technician records the change request, provides a clear business justification for urgency, identifies affected systems, and presents it to the CAB or its designated emergency responder for immediate, risk-based review. Emergency CAB approval is typically granted via a special quorum or virtual meeting, allowing the required authorization to be obtained within hours instead of waiting for a regular meeting. The documented record enables post-implementation verification, rollback execution, and a clear audit trail, satisfying the policy's intent while addressing the critical vulnerability.

• ✗

  Rely solely on the verbal approval from the IT manager and apply the patch

  Why it's wrong here

  Verbal approval from an IT manager, even if that manager has seniority, bypasses the CAB's structured risk-impact analysis and fails to create the authoritative change record required for auditing and configuration management. The IT manager may not have delegated authority to approve changes unless explicitly specified in the policy, and verbal approval cannot capture rollback steps, test results, or affected configuration item details. This leaves the organization unable to prove that a formal decision was made, which violates compliance and makes incident recovery harder.

• ✗

  Refuse to apply the patch until the next scheduled CAB meeting

  Why it's wrong here

  Refusing to take any action until the next scheduled CAB meeting ignores the fact that change management policies typically include an emergency change procedure for time-sensitive vulnerabilities. A critical patch is often a security fix that should be deployed within the vendor-defined window; waiting days or weeks can leave the environment exposed to an exploited CVE. The correct course is to use that expedited process, not to postpone the change entirely, because the same risk-approval controls still apply in compressed form.

Go deeper

Related to this question