Months after a network was re-segmented into new VLANs, incident responders investigating malware follow outdated diagrams and isolate the wrong switch ports. Which step was missed when the segmentation change was closed out?

Change management does not end when a configuration is applied. Documentation must be updated so that diagrams, runbooks, policies, and procedures match the new state of the environment. Incident responders, auditors, and engineers rely on these records under time pressure, and inaccurate diagrams lead to mistakes such as isolating the wrong ports during containment, which prolongs an incident. CAB approval governs whether the change should happen; the scenario does not indicate the change was unauthorized, and approval would not have kept the diagrams current afterward. A backout test verifies that a change can be reversed; it protects against implementation failure, not against stale documentation months later. Adding VLANs to an application allow list confuses network segments with executable approval; allow lists control which software runs on endpoints and have no relationship to diagram accuracy. Exam caveat: updating diagrams and updating policies or procedures are both listed documentation outcomes of change management, and questions often describe the downstream harm caused by skipping them. Operational check: make documentation updates a required closure task on every change ticket, assign the change owner to confirm diagram revisions, and periodically compare switch and VLAN configurations against the published diagrams to catch drift.