hardMultiple ChoiceObjective-mapped
SSCP Practice Question: A security administrator is implementing change…
A security administrator is implementing change management for a critical financial system. Which of the following is the MOST important control to prevent unauthorized changes?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enforce a formal approval process via a change advisory board
A formal approval process via a change advisory board (CAB) ensures that all changes are reviewed and authorized before implementation, which is the most important preventive control. Option A is wrong because a staging environment, while useful for testing, does not prevent unauthorized changes. Option C is wrong because notifying users is a communication step, not a preventive control. Option D is wrong because a documented backout plan is important for recovery, but it does not prevent unauthorized changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a staging environment to test all changes
Why it's wrong here
Testing validates changes but does not prevent unauthorized ones.
- ✓
Enforce a formal approval process via a change advisory board
Why this is correct
A CAB provides review and approval, preventing unauthorized changes.
- ✗
Notify all users before the change window
Why it's wrong here
Notification does not control authorization.
- ✗
Require a documented backout plan for every change
Why it's wrong here
Backout plans are for rollback, not prevention.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.