hardMultiple ChoiceObjective-mapped
PK0-005 Practice Question: A project is in the execution phase, developing a…
A project is in the execution phase, developing a mobile payment application. The project manager receives a report that a critical security vulnerability was discovered in the third-party authentication library used by the application. The library is widely used and has an available patch that requires upgrading to a newer version. However, upgrading the library will break compatibility with the existing user authentication database schema, requiring a database migration that was not planned. The project has a fixed budget and a tight deadline. The change control board (CCB) meets weekly, and the next meeting is in three days. The lead developer recommends applying the patch immediately without waiting for CCB approval, arguing that the security risk is high and the patch is straightforward. What is the BEST course of action for the project manager?
⚠ Common exam trap
Test-takers frequently assume security vulnerabilities always justify bypassing change control, but the PM must balance urgency with process, especially when the patch introduces an unplanned database migration that affects the fixed budget and tight deadline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Wait for the next CCB meeting to present the issue and get approval for the upgrade and database migration
The project manager must follow the established change control process, even for urgent security patches, when the change introduces an unplanned database migration that impacts scope, budget, and schedule. Waiting for the next CCB meeting (in three days) allows proper assessment of the upgrade's impact on the authentication database schema and ensures all stakeholders approve the change. Applying the patch without approval violates the change management plan and could lead to uncontrolled scope creep and budget overruns.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Escalate the issue to the project sponsor to decide on an exception to the change control process
Why it's wrong here
The CCB is the appropriate body for change decisions; bypassing it may be unnecessary.
- ✗
Apply the patch immediately and inform the CCB after the fact, as security vulnerabilities require urgent action
Why it's wrong here
Bypassing CCB approval violates change control and could lead to uncontrolled changes.
- ✗
Do not implement the patch because the project is on a tight schedule and the risk is acceptable
Why it's wrong here
Ignoring a critical security vulnerability is not acceptable; it could lead to major issues.
- ✓
Wait for the next CCB meeting to present the issue and get approval for the upgrade and database migration
Why this is correct
This follows the change control process and ensures proper assessment and approval.
Go deeper
Related to this question
About these practice questions
This PK0-005 question is part of Courseiva's 980-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PK0-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PK0-005 exam.