hardMultiple Choice
SSCP Practice Question: A security administrator is implementing change…
A security administrator is implementing change management for a critical financial system. Which of the following is the MOST important control to prevent unauthorized changes?
⚠ Common exam trap
The trap is selecting a technical control (staging, backout) over the governance control (CAB approval); the question asks for the MOST important control to prevent unauthorized changes, which is authorization, not testing or rollback.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enforce a formal approval process via a change advisory board
A formal approval process via a change advisory board (CAB) is the most important control because it ensures changes are reviewed, authorized, and documented by appropriate stakeholders before implementation, directly preventing unauthorized changes. While testing, notification, and backout plans are valuable, they do not provide the authorization gate that stops unauthorized changes from being deployed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a staging environment to test all changes
Why it's wrong here
Testing in a staging environment validates change behaviour before release, but it does not gate who may authorise or apply a change; an unauthorised change can still be promoted. It is tempting because staging catches defects and rollback issues, and it would be the right control when the risk is faulty code rather than unauthorised modification.
- ✓
Enforce a formal approval process via a change advisory board
Why this is correct
A change advisory board enforces segregation of duties: the requester cannot self-approve, so every modification to the financial system requires independent review before implementation. This directly satisfies the stem's constraint of preventing unauthorised changes, since approval authority rests with a separate body rather than the administrator performing the work.
- ✗
Notify all users before the change window
Why it's wrong here
Notifying users is communication, not authorisation; it cannot stop an unauthorised change from being made. It is tempting because advance notice reduces operational disruption during a change window, and it would be the correct control when the concern is user impact or scheduling conflicts rather than preventing unauthorised modification.
- ✗
Require a documented backout plan for every change
Why it's wrong here
A backout plan limits damage after a failed change; it does not stop an unauthorised change from being made. It is tempting because rollback documentation is a genuine change-management control, and would be the priority when the concern is recovery rather than authorisation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.