During an active attack, the SOC needs to block an attacker's IP range at the cloud firewall immediately. The organization's change advisory board normally meets once a week. What is the correct approach?
Select an answer to reveal the explanation.
Short Explanation
Change management has a fast lane for exactly this moment. You get a quick yes from the emergency approver, make the change, and then write it up and review it after the fire's out. The trap is either waiting a week or acting like the rules don't exist at all.
Full Explanation
Change management frameworks, including ITIL practices and ISO/IEC 20000-1 requirements, define an emergency change category for changes that must be implemented as soon as possible, such as responding to an active security incident. Emergency changes still require authorization, but from a smaller, designated authority, often an emergency change advisory board or a named manager, reachable at short notice. The change is implemented, recorded in the change system, and reviewed after the fact to confirm it was justified and decide whether it should remain. Waiting for the weekly board leaves the attack unmitigated for days, which defeats the purpose of change control: to manage risk, not to add it. Making an unrecorded change breaks configuration records, makes later troubleshooting harder, and removes accountability; emergencies change the speed of approval, not the need for it. Standard changes are low-risk, repeatable changes pre-approved because their procedure is well understood; misclassifying an urgent, environment-specific block as standard bypasses scrutiny and sets a precedent for avoiding review. Exam caveat: the expected answer balances speed with governance, which is typical of ISC2 manager-level framing. Operational check: confirm that the emergency change record exists with approver, time and justification, that it was reviewed at the next board meeting, and that the configuration management database reflects the new firewall rule.