easyMultiple ChoiceObjective-mapped
CISA Practice Question: Is the BEST control to ensure that system changes…
Which of the following is the BEST control to ensure that system changes are authorized?
⚠ Common exam trap
Test-takers frequently confuse detective controls (audit trails) or technical controls (version control) with the governance-based authorization control (CAB approval), leading them to select a control that records or manages changes rather than one that formally authorizes them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change advisory board approval
The change advisory board (CAB) is the primary control for authorizing system changes because it provides a formal, documented approval process before any change is implemented. This ensures that changes are reviewed by stakeholders with appropriate authority, reducing the risk of unauthorized or poorly planned modifications. Without CAB approval, there is no definitive authorization step, making it the best control for ensuring authorization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Change advisory board approval
Why this is correct
The CAB formally authorizes changes based on impact assessment.
- ✗
Audit trail of all changes
Why it's wrong here
Audit trails provide detective control, not preventive authorization.
- ✗
Segregation of duties between developers and operators
Why it's wrong here
Segregation of duties is important but not the primary authorization control.
- ✗
Version control system
Why it's wrong here
Version control manages code versions but does not authorize changes.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.