CISM Information Security Program Practice Question

Arrange the steps for implementing a new firewall rule in an enterprise environment.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Identify requirement, Submit change request, Test in staging, Implement on production, Verify rule operation

Firewall changes require clear objectives, change control, testing, implementation, and verification.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Identify requirement, Submit change request, Test in staging, Implement on production, Verify rule operation
Why this is correct
This is the correct order because firewall changes must follow a structured change management process: first define the need, then get formal approval, test safely, deploy, and confirm it works.
✗
Test in staging, Implement on production, Identify requirement, Submit change request, Verify rule operation
Why it's wrong here
This is incorrect because testing and implementation occur without a defined requirement or change control, violating security policy and risking unapproved changes.
✗
Submit change request, Identify requirement, Test in staging, Implement on production, Verify rule operation
Why it's wrong here
This is incorrect because the requirement must be identified before submitting a change request; a request without a clear objective is likely to be rejected or cause confusion.
✗
Identify requirement, Test in staging, Implement on production, Submit change request, Verify rule operation
Why it's wrong here
This is incorrect because implementation and testing are done without prior change approval, which violates change management procedures and could lead to untracked configuration changes.

Go deeper