Which of the following is less likely to be included in the change control sub-phase of the maintenance phase of
a software product?

A.
Estimating the cost of the changes requested

B.
Recreating and analyzing the problem

C.
Determining the interface that is presented to the user

D.
Establishing the priorities of requests

Explanation:
To determine the user interface would not be part of the change control phase. This would be done in an earlier
phase.
The change control analyst is responsible for approving or rejecting requests to make changes to the network,
systems, or software. This role must make certain that the change will not introduce any vulnerability, that it has
been properly tested, and that it is properly rolled out. The change control analyst needs to understand how
various changes can affect security, interoperability, performance, and productivity.
Incorrect Answers:
A: Calculation the cost of the change should be a part of analyzing a change request.
B: Testing is a part of change control. If a problem occurs during testing change control should recreate and
analyze the problem.
D: If there are multiple change requests then they must be prioritized in the change control phase.

Conrad, Eric, Seth Misenar and Joshua Feldman, CISSP Study Guide, 2nd Edition, Syngress, Waltham, 2012,
p. 1122