SSCP Security Operations and Administration Practice Question
After a patch is deployed to a critical server, the system becomes unstable. The change management plan includes a rollback procedure. What should be done FIRST?
⚠ Common exam trap
Candidates may incorrectly think that a new change request is required for the rollback, but the change management plan already includes the rollback procedure, so it can be executed immediately without additional approvals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Execute the rollback procedure
When a patch deployment causes system instability, the immediate priority is to restore service stability by executing the pre-approved rollback procedure. The change management plan already includes this procedure, so no new approvals are needed; acting quickly minimizes downtime and risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new change request for the rollback
Why it's wrong here
Raising a new change request introduces approval delay before the server is stabilised, while the existing plan already authorises rollback. It is tempting because formal change control is normally mandatory, and a new request would be correct for a change lacking pre-approved rollback authority.
- ✗
Conduct a post-implementation review
Why it's wrong here
A post-implementation review documents what happened after the fact; it does not restore the unstable server, which the rollback procedure addresses first. It is tempting because reviews are a required change-management activity, and one would be correct after service is recovered.
- ✓
Execute the rollback procedure
Why this is correct
Executing the documented rollback restores the unstable server to its last known-good state, immediately containing the outage. The change management plan already authorises this procedure, so it takes precedence over investigation, which can follow once service is restored.
- ✗
Notify the Change Advisory Board
Why it's wrong here
Notifying the Change Advisory Board delays restoring the unstable critical server, whereas the plan's rollback procedure should be invoked first. It is tempting because CAB notification is a genuine change-management step, and it would be correct once service is stable or for a planned change.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.