問40
頻出度★★★
ソフトウェアベンダから提供されたセキュリティパッチの内容を確認し, 自社システムに適用する場合の影響を評価した。この作業はシステムの運用管理業務のうちどれに該当するか。
平成22年度 秋期 ITパスポート試験 問40
マネジメント系サービスマネジメント › サービスマネジメントシステム
This question's explanation and your answers so far.
解説
問 40
Incorrectア
Incident management is the activity of restoring service as quickly as possible in response to an incident that has actually occurred, such as a system failure or a service outage. In this question no failure has occurred yet; the content and impact of a planned change, namely the patch, are being evaluated in advance, so this is not incident management.
Incorrectイ
Configuration management is the activity of accurately recording configuration items (CIs) such as hardware, software, and documents together with their versions and relationships, and keeping that information up to date. Updating the configuration information after a patch has been applied is indeed configuration management, but what this question describes is the content review and impact assessment done to judge whether the patch may be applied, not the recording and maintenance of configuration information.
- ウ
正解 Change management is the activity of reviewing the content of a change to be made to a system (applying a patch, changing settings, adding a function, and so on), evaluating the impact and risk of carrying it out, and then deciding whether or not to approve the change. The work in this question is at the stage of reviewing the content of the security patch provided by the vendor and evaluating the impact of applying it to the company's own system; the patch has not actually been applied to the production environment yet. In other words, it is exactly the content review and impact assessment done to judge whether the change should be allowed, so it falls under change management among system operations management tasks. Therefore the correct answer is ウ.
Incorrectエ
Release management (release and deployment management) is the activity of distributing and installing an approved change into the production environment in a planned way and bringing it into operation. The work in this question stops before that, at the evaluation stage used to judge whether to apply the patch; the release (deployment) has not been carried out yet, so it does not apply.
ここがポイント
- Change management is responsible for reviewing the content of a change, assessing its impact, and approving it, while release management is responsible for actually deploying an approved change into the production environment. In a patch-application scenario, remember the split this way: everything up to evaluation and approval is change management, and the actual distribution and installation is release management.
- Incident management is the quick recovery from a failure that has occurred, and configuration management is the activity of accurately recording and maintaining information about configuration items (CIs); neither has the role of evaluating in advance whether a change may be made.
用語