CISA Practice Question: Information Systems Operations and Business Resilience
An organization uses a standard change model for low-risk, pre-approved changes. Which of the following is an example of a standard change?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Applying a routine security patch to the firewall
Standard changes are pre-approved, low-risk, and follow a defined procedure. Applying a routine security patch that has been tested and approved falls under this category.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Upgrading the core router to a new model
Why it's wrong here
Replacing the core router is a significant network infrastructure change with outage risk, needing assessment, approval and a rollback plan. It is tempting because hardware refreshes recur, but the core router's centrality makes impact high. Standard changes are pre-approved, low-risk, routine tasks with a documented procedure and known outcome.
- ✗
Changing the backup schedule from daily to weekly
Why it's wrong here
Altering the backup schedule changes data protection frequency, affecting recovery point objectives, so it requires assessment and approval rather than pre-authorisation. It is tempting because the task appears routine and low effort. Standard changes are pre-approved, repeatable procedures with documented risk, such as a defined password reset or a scheduled patch.
- ✓
Applying a routine security patch to the firewall
Why this is correct
Routine firewall security patching fits the standard change model because it is pre-approved, low-risk, and repeatable, following a documented procedure with no CAB review required. This satisfies the stem's constraint that standard changes are pre-authorised, low-risk, and executed without individual assessment.
- ✗
Migrating the entire email system to the cloud
Why it's wrong here
Migrating the entire email system to the cloud is a high-risk, high-impact transformation requiring full change advisory board review, planning and rollback provisions. It is tempting because cloud migration is common, but its scope and user impact exceed pre-approved criteria. Standard changes are low-risk, repeatable and documented in advance.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.