220-1102 Operational Procedures Practice Question
A change request to apply a critical security patch to a production web server has been approved by the Change Advisory Board (CAB) with a detailed implementation plan. During the scheduled maintenance window, the technician discovers that a required prerequisite patch is missing. The prerequisite patch is available for download and was tested in the lab, but it was not listed in the approved change plan. According to change management best practices, what should the technician do FIRST?
⚠ Common exam trap
Watch out — candidates often assume prior lab testing or the urgency of a critical patch justifies proceeding without CAB approval, but change management best practices strictly require formal authorization for any unplanned modification to a production system.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stop and submit a new change request for the prerequisite patch before proceeding
Change management best practices require that all changes, including prerequisite patches, must be formally approved by the CAB before implementation. Even though the prerequisite was tested in the lab, it was not included in the approved change plan, so proceeding without approval violates the change control process and could introduce unapproved modifications to a production system. The technician must stop work and submit a new change request to ensure proper documentation, risk assessment, and authorization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Stop and submit a new change request for the prerequisite patch before proceeding
Why this is correct
The approved change scope is limited to the critical security patch; the prerequisite is an undeclared modification to the production environment. Implementing it without a separate, approved change request breaks the documented baseline and eliminates the audit trail required for compliance. You must stop all work, submit a new change request that includes both patches, and wait for CAB authorization before touching the system.
- ✗
Proceed with the critical patch first, then add the prerequisite in a subsequent change
Why it's wrong here
Attempting to apply the critical patch before the prerequisite is installed places the server in an untested dependency state, which can cause the patch to abort, the service to fail, or the OS to become unstable. Reversing the order also contradicts the tested implementation plan approved by the CAB, and a subsequent change request does not retroactively authorize the already-deployed code. Change management requires that every modification follow the approved sequence, not just appear in the final record.
- ✗
Download and install the prerequisite patch since it was already tested in the lab
Why it's wrong here
Laboratory validation demonstrates technical compatibility, but it does not confer production approval or satisfy the change management process. Installing the prerequisite without CAB sign-off bypasses the required impact analysis, rollback plan, and scheduled maintenance window, and it can introduce unapproved configuration drift across the environment. Even a well-tested patch must be formally documented and authorized before it is applied outside the test lab.
- ✗
Request an emergency change from the CAB while continuing the implementation
Why it's wrong here
An emergency change request is the correct vehicle for urgent fixes, but the rule is to stop and await the decision before making any alteration to the production system. Continuing the implementation while the CAB reviews the request means the work is already happening without authorization, and if the request is denied you must unwind changes made in violation of policy. The hold-and-wait requirement is non-negotiable even in emergency circumstances.
Go deeper
Related to this question
Learn chapter
Ticketing System Workflow
Key term
Risk assessment
Risk assessment is the process of identifying, analyzing, and evaluating potential threats to an organization's assets to determine the likelihood and impact of those threats, and to decide on appropriate treatment measures.
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
About these practice questions
One of 925 original 220-1102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.