To verify a sample of significant changes, which methods should be used?

• A. Interview personnel only.
• B. Change records, interview personnel, and observe the affected systems.
• C. Change records only.
• D. Observe the affected systems only.

Answer: (D)

Direct verification of the post-change state is what matters when verifying a sample of significant changes. By observing the affected systems, you obtain concrete, current evidence that the changes were actually implemented and are functioning as intended, which confirms that the environment reflects the approved changes and meets security requirements. This live view can reveal issues that documents or memories might miss, such as discrepancies between what was authorized and what was deployed, or configurations that aren’t captured in change records. Relying solely on interviews depends on memory and may miss technical details, while change records alone can be outdated or incomplete. Observing the systems provides the strongest evidence of the actual outcome, which is the goal of verification.