Explanation/Reference:
Explanation:
It may be appropriate to allow programmers to make emergency changes as long as they are documented and approved after the fact. Restricting release time frame may help somewhat; however, it would not apply to emergency changes and cannot prevent unauthorized release of the programs. Choices C and D are not relevant in an emergency situation.

Section: Governance and Management of IT
Explanation:
Plan - Establish the objectives and processes necessary to deliver results in accordance with the expected output (the target or goals). By establishing output expectations, the completeness and accuracy of the spec is also a part of the targeted improvement. When possible start on a small scale to test possible effects.
For your exam you should know the information below:
PDCA (plan-do-check-act or plan-do-check-adjust) is an iterative four-step management method used in business for the control and continuous improvement of processes and products. It is also known as the Deming circle/cycle/wheel, Stewart cycle, control circle/cycle, or plan-do-study-act (PDSA). Another version of this PDCA cycle is OPDCA. The added "O" stands for observation or as some versions say
"Grasp the current condition."
The steps in each successive PDCA cycle are:

PLAN
Establish the objectives and processes necessary to deliver results in accordance with the expected output (the target or goals). By establishing output expectations, the completeness and accuracy of the spec is also a part of the targeted improvement. When possible start on a small scale to test possible effects.
DO
Implement the plan, execute the process, make the product. Collect data for charting and analysis in the following "CHECK" and "ACT" steps.
CHECK
Study the actual results (measured and collected in "DO" above) and compare against the expected results (targets or goals from the "PLAN") to ascertain any differences. Look for deviation in implementation from the plan and also look for the appropriateness and completeness of the plan to enable the execution, i.e.,
"Do". Charting data can make this much easier to see trends over several PDCA cycles and in order to convert the collected data into information. Information is what you need for the next step "ACT".
ACT
Request corrective actions on significant differences between actual and planned results. Analyze the differences to determine their root causes. Determine where to apply changes that will include improvement of the process or product. When a pass through these four steps does not result in the need to improve, the scope to which PDCA is applied may be refined to plan and improve with more detail in the next iteration of the cycle, or attention needs to be placed in a different stage of the process.
The following answers are incorrect:
DO - Implement the plan, execute the process, make the product. Collect data for charting and analysis in the following "CHECK" and "ACT" steps.
CHECK - Study the actual results (measured and collected in "DO" above) and compare against the expected results (targets or goals from the "PLAN") to ascertain any differences ACT -Request corrective actions on significant differences between actual and planned results. Analyze the differences to determine their root causes. Determine where to apply changes that will include improvement of the process or product Reference:
CISA review manual 2014 page number 107

A preparedness test is performed by each local office/area to test the adequacy of the preparedness of local operations for the disaster recovery.

Section: Protection of Information Assets
Explanation:
The NOT is a keyword used in the question. You need to find out the risks which are NOT associated with PBX. All the risk listed within the options are associated with PBX.
The threat of the PBX telephone system is many, depending on the goals of these attackers, and include:
Theft of service - Toll fraud, probably the most common of motives for attacker.
Disclosure of Information - Data disclosed without authorization, either by deliberate actionably accident.
Examples includes eavesdropping on conversation and unauthorized access to routing and address data.
Data Modification - Data altered in some meaningful way by recording, deleting or modifying it. For example, an intruder may change billing information or modify system table to gain additional services.
Unauthorized access - Actions that permit an unauthorized user to gain access to system resources or privileges.
Denial of service - Actions that prevent the system from functioning in accordance with its intended purpose. A piece of equipment or entity may be rendered inoperable or forced to operate in a degraded state; operations that depend on timeliness may be delayed.
Traffic Analysis - A form of passive attack in which an intruder observes information about calls and make inferences, e.g. from the source and destination number or frequency and length of messages. For example, an intruder observes a high volume of calls between a company's legal department and patent office, and conclude that a patent is being filed.
The following were incorrect answers:
All the risks presented in options are associated with PBX. So other options are not valid.
Reference:
CISA review manual 2014 Page number356