ITIL4F Normal change Practice Question
An organization has a documented policy that all changes to the financial system must be approved by the change advisory board, but emergency changes require a separate emergency CAB. Which type of change is a planned update to a firewall rule that will be approved by the CAB?
⚠ Common exam trap
Many candidates confuse a low-risk planned change with a standard change, but the requirement for CAB approval explicitly makes it a normal change, not a pre-authorized standard change.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Normal change
In ITIL, a normal change is one that requires approval from the change authority (such as a CAB) before implementation. Although a planned update to a firewall rule might seem low risk, the organization's policy explicitly requires CAB approval for all changes to the financial system, including this firewall rule. Therefore, it must follow the normal change process. Standard changes are pre-authorized and do not need CAB approval, while emergency changes would use a separate emergency CAB. Since the question states the change will be approved by the CAB (not the emergency CAB), it is a normal change.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Service request
Why it's wrong here
Service requests are formal requests from users for something that is a pre-defined, existing service offering, typically fulfilled through a standard, repeatable process. Unlike changes, service requests do not involve modifying core infrastructure components or altering the fundamental design of a service. A change to a firewall rule fundamentally alters the network's security posture and connectivity, making it a change, not a simple request for an existing item.
- ✗
Standard change
Why it's wrong here
Standard changes are pre-authorized, low-risk changes that are frequently performed and have a well-documented procedure for implementation. While a firewall rule update could be a standard change in specific, highly controlled contexts, the question does not provide information indicating it meets the criteria of being pre-approved, low-risk, or routine. Without such context, a general 'change to a firewall rule' is unlikely to be automatically classified as standard due to its potential impact on security and service availability.
- ✗
Emergency change
Why it's wrong here
Emergency changes are implemented to resolve an incident or implement a critical security fix with extreme urgency, where delaying the change would cause significant business disruption or harm. These changes typically bypass some steps of the normal change process due to time constraints but still require authorization, often from an Emergency Change Advisory Board (ECAB). The question implies a planned process for 'all changes,' indicating this is not an unplanned, urgent response to an immediate crisis.
- ✓
Normal change
Why this is correct
Normal changes are any changes that are not standard or emergency, following a comprehensive change workflow including assessment, authorization, and scheduling. These changes require formal evaluation of risk and impact, often necessitating approval from a designated Change Authority or Change Advisory Board (CAB). A change to a firewall rule, given its potential impact on security, connectivity, and service availability, typically falls into this category unless it is explicitly pre-approved as a standard change or required for an emergency.
Go deeper
Related to this question
About these practice questions
One of 805 original ITIL4F practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ITIL4F practice question is part of Courseiva's free PeopleCert certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ITIL4F exam.