SSCP Security Operations and Administration Practice Question
A company is implementing a change management process. Which THREE elements are essential for every change request? (Select THREE)
⚠ Common exam trap
Many candidates confuse 'essential change request elements' with general business processes like HR reviews or financial approvals, but the SSCP focuses strictly on technical and operational controls for security and stability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Description of the change
A description of the change (A) is essential because it defines exactly what will be modified, including the systems, services, and scope involved, so that approvers and implementers understand the request. An impact assessment (B) is required to identify the risks, affected users, dependencies, and potential downtime, which allows the change advisory board to evaluate and prioritize the change. A rollback plan (C) is critical because it provides a tested, documented procedure to revert the change if it fails or causes an outage, minimizing business disruption. Employee performance review (D) is unrelated to change management, as it evaluates individual job performance rather than a technical or process change. Budget approval (E) may be needed for some changes, but it is not an essential element of every change request, since many changes involve no direct cost.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Description of the change
Why this is correct
A description of the change is essential because it defines the scope, affected systems and intended outcome, enabling the change advisory board to assess risk and impact before approval. Without it, reviewers cannot evaluate the request against the change management process, so this element satisfies the stem's requirement for every change request.
- ✓
Impact assessment
Why this is correct
An impact assessment identifies the affected systems, users and business processes before approval, satisfying the change management requirement to evaluate risk and scope prior to implementation. Without it, approvers cannot judge whether a change is safe, so it is essential for every change request alongside documentation and rollback planning.
- ✓
Rollback plan
Why this is correct
A rollback plan provides the documented procedure for reverting a change if it fails or causes disruption, directly satisfying change management's requirement for controlled recovery. Without it, failed changes leave systems in an unstable state with no defined reversal path, undermining the process's core purpose of maintaining availability and integrity.
- ✗
Employee performance review
Why it's wrong here
Employee performance review is an HR appraisal activity, unrelated to controlling changes to configuration items. It is tempting because change management touches people and roles, but a change request needs description, justification, impact analysis, risk assessment, approval and rollback plan, not individual performance data.
- ✗
Budget approval
Why it's wrong here
Budget approval is a financial governance step, not a required field of every change request; low-cost or emergency changes still need impact analysis, risk assessment and rollback plans. Budget approval is tempting because changes consume resources, but it is a separate financial control, not a change-request element.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.