hardMultiple ChoiceObjective-mapped
220-1102 Practice Question: A company’s change management policy states that…
A company’s change management policy states that all changes must be reviewed by the CAB. An urgent security vulnerability is discovered that requires an immediate patch to a critical database server. The CAB is not available for 24 hours. What is the best course of action?
⚠ Common exam trap
CompTIA often tests the misconception that all changes must wait for CAB approval, ignoring the emergency change process explicitly defined in ITIL and many corporate policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply the patch immediately and document it as an emergency change
The change management policy includes an emergency change process for urgent security vulnerabilities. Applying the patch immediately and documenting it as an emergency change aligns with ITIL best practices and the company's policy, ensuring the vulnerability is mitigated without delay while maintaining compliance through post-implementation review.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wait for the CAB to meet and approve the change
Why it's wrong here
Waiting for a standard Change Advisory Board (CAB) meeting to approve a patch for a critical vulnerability is an unacceptable delay. Such a delay leaves the system exposed to active exploitation for an extended period, potentially leading to severe data breaches, service outages, or complete system compromise. Prioritizing a rigid process over immediate security mitigation in a critical scenario directly contradicts best practices for incident response.
- ✓
Apply the patch immediately and document it as an emergency change
Why this is correct
Applying the patch immediately and documenting it as an emergency change is the correct procedure for critical vulnerabilities. Emergency change processes are specifically designed for situations requiring immediate action to prevent or mitigate severe business impact or security threats. This approach allows for rapid deployment of the fix, followed by retrospective documentation and approval, ensuring both prompt risk mitigation and adherence to change management governance.
- ✗
Apply the patch but do not document it to avoid policy violation
Why it's wrong here
Applying a critical patch but intentionally failing to document it is a significant policy violation and creates substantial operational risks. Undocumented changes lead to an inaccurate configuration management database (CMDB), making future troubleshooting, auditing, and rollback procedures extremely difficult and error-prone. This practice undermines system stability, accountability, and the integrity of the IT environment, potentially causing more issues down the line.
- ✗
Disconnect the server from the network until the CAB meets
Why it's wrong here
Disconnecting a server from the network until the CAB meets is an overly drastic measure that causes unnecessary business disruption. While it might prevent immediate exploitation, it renders critical services unavailable to users and customers, impacting productivity and potentially revenue. For a known vulnerability with an available patch, applying the fix is a far more targeted, less disruptive, and appropriate response than a complete service outage.
Go deeper
Related to this question
Learn chapter
Windows Security Features
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Change management
Change management is the structured process of planning, approving, implementing, and reviewing changes to IT systems to minimize risk and disruption.
About these practice questions
This 220-1202 question is part of Courseiva's 495-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.