CISSP Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  To provide oversight and approval for significant changes

  Why this is correct

  The Change Advisory Board (CAB) primarily serves as a governance body responsible for evaluating and authorizing significant changes to IT services and infrastructure. This oversight ensures that all high-impact or high-risk modifications are thoroughly assessed for potential security implications, operational disruptions, and resource requirements before implementation. Their approval process is crucial for maintaining system stability, security posture, and compliance.

• ✗

  To implement changes as requested by management

  Why it's wrong here

  The Change Advisory Board (CAB) is not responsible for the physical or technical implementation of changes. Its role is strictly advisory and approval-based, focusing on the strategic assessment and authorization of proposed modifications. The actual execution, scheduling, and deployment of approved changes are typically handled by dedicated change management teams or operational staff, who follow the procedures established by the CAB's approval.

• ✗

  To review security incidents after they occur

  Why it's wrong here

  Reviewing security incidents after they occur falls under the domain of incident response and post-incident analysis teams, not the Change Advisory Board (CAB). The CAB's mandate is proactive, focusing on mitigating risks *before* changes are introduced into the production environment. Its purpose is to prevent incidents by carefully scrutinizing proposed changes, rather than reacting to or analyzing events that have already transpired.

• ✗

  To approve all changes to the production environment

  Why it's wrong here

  While the Change Advisory Board (CAB) plays a critical role in change control, it does not approve *all* changes to the production environment. Many routine, low-risk, pre-approved 'standard changes' or urgent 'emergency changes' often bypass full CAB review to expedite necessary actions. The CAB typically concentrates its efforts on 'normal changes' that are significant, complex, or carry higher potential risk, ensuring efficient resource allocation and focused risk management.

Go deeper

Related to this question