Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

ISC2 CISSP Exam - Topic 4 Question 106 Discussion

Posted by Chery on Aug 01, 2025 at 01:55 AM

An audit of an application reveals that the current configuration does not match the configuration of the originally implemented application. Which of the following is the FIRST action to be taken?

Suggested Answer: B

Configuration is the process of setting up and maintaining the parameters, settings, and options of a system or application to ensure its optimal performance and security. Configuration change is the process of modifying or updating the configuration of a system or application to meet the changing needs or requirements of the organization and the stakeholders. Configuration change should be controlled and documented by using a change control process. A change control process is a process that defines the steps, roles, and responsibilities for requesting, approving, implementing, testing, and documenting the configuration changes of a system or application. A change control process can help to ensure that the configuration changes are authorized, validated, and traceable, and that they do not adversely affect the functionality, security, or availability of the system or application. The first action to be taken when an audit of an application reveals that the current configuration does not match the configuration of the originally implemented application is to verify the approval of the configuration change. Verifying the approval of the configuration change is the process of checking and confirming that the configuration change was requested, reviewed, and authorized by the appropriate parties, such as the change owner, the change manager, or the change board, before it was implemented. Verifying the approval of the configuration change can help to determine if the configuration change was legitimate, necessary, and compliant with the organization's policies and standards, as well as to identify and resolve any issues or discrepancies that may arise from the configuration change. Recommending an update to the change control process, rolling back the application to the original configuration, or documenting the changes to the configuration are not the first actions to be taken when an audit of an application reveals that the current configuration does not match the configuration of the originally implemented application, as they are more related to the improvement, restoration, or reporting aspects of the configuration change.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 11: Security Operations, page 665;CISSP Official (ISC)2 Practice Tests, Third Edition, Domain 7: Security Operations, Question 7.9, page 273.


Get Premium CISSP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test
21 comments · newest first
FA
Fannie 10 months ago
I'm not sure about D, documenting changes seems less urgent.
NA
Nancey 10 months ago
I think C makes more sense, just roll it back!
KR
Krissy 10 months ago
Definitely B, you need to verify before doing anything else.
RO
Rodney 10 months ago
Agree with B, approval is key here.
ST
Stevie 10 months ago
Wait, how did the config get changed without anyone knowing?
JU
Judy 11 months ago
I wonder if recommending an update to the change control process is a valid first step. It seems like a good long-term solution, but is it immediate enough?
WI
Willie 11 months ago
I practiced a similar question, and I feel like rolling back the application might be too drastic without checking the approval first.
TA
Talia 11 months ago
I'm not entirely sure, but I remember something about documenting changes being important. Maybe that should come first?
FE
Felicitas 11 months ago
I think the first step should be to verify the approval of the configuration change. It seems like the logical thing to do before taking any further action.
SH
Sheridan 12 months ago
I feel pretty good about this one. Based on my understanding of configuration management best practices, the first step is to verify the approval of the configuration change. That's the foundation for everything else.
TA
Tammara 12 months ago
I'm a little confused by this question. There are a few options that seem reasonable, but I'm not sure which one is the absolute first step. I'll have to think it through more carefully.
CA
Carma 12 months ago
Okay, I've got this. The first step is to verify the approval of the configuration change. That's the most important thing to establish before taking any other action.
LA
Lai 1 year ago
Hmm, I'm a bit unsure about this one. I'm trying to think through the logical flow of steps, but I'm not totally confident in my approach. Maybe I should re-read the question carefully.
CY
Cyril 1 year ago
This seems like a straightforward configuration management question. I think the key is to identify the first step that should be taken, which is likely to verify the approval of the configuration change.
PA
Pamella 1 year ago
That's a good point, Loreen. We should make sure the change was approved before taking any further action.
LO
Loreen 1 year ago
But shouldn't we also verify the approval of the configuration change?
NA
Nan 1 year ago
Hmm, I'm not sure. This seems like a tricky one. Maybe we should consult the IT guy in the break room - he's always good for a laugh and a hint or two.
GO
Golda 1 year ago
C looks like the way to go. Rolling back to the original configuration is the safest option.
NE
Nell 1 year ago
I agree with Pamella, documenting the changes is important for tracking.
PA
Pamella 1 year ago
I think the first action should be to document the changes to the configuration.
BR
Brendan 1 year ago
I think the correct answer is B. We need to verify the approval of the configuration change before doing anything else.
0/2000 characters

Save Cancel