SY0-701 Security Program Management and Oversight Practice Question
A developer finds a critical bug in a customer portal on Friday afternoon. The fix must be released quickly, but the team needs a way to reverse the change if testing reveals a problem and wants the release to follow the normal approval process. Which two practices should be used? Select two.
⚠ Common exam trap
It's easy for candidates to assume speed is the only priority in an emergency fix, overlooking the requirement for a controlled reversal mechanism and the need to follow the normal approval process even under time pressure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a documented rollback plan
A documented rollback plan ensures that if the emergency fix introduces new issues during testing, the team can quickly and safely revert to the previous stable state. This aligns with the principle of change management, which requires a recovery procedure for any emergency change to minimize downtime and risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy the fix directly to production without approval
Why it's wrong here
Deploying directly to production without approval bypasses change management governance and removes the independent risk assessment that would catch integration or security issues. While a critical bug creates time pressure, the correct response is to use an emergency change process with expedited CAB authorization, not to skip it entirely. An unapproved deployment also leaves no approved back-out plan, making a small failure harder to recover.
- ✓
Create a documented rollback plan
Why this is correct
A documented rollback plan identifies the exact steps to restore the previously known-good version if the hotfix performs poorly, including database rollback procedures, configuration file reversions, and responsible personnel. It also specifies the verification criteria that indicate whether rollback is needed and the decision authority to trigger it. This plan directly reduces downtime and risk, which is why it is the most appropriate immediate action.
- ✗
Skip testing to meet the deadline
Why it's wrong here
Skipping testing to meet the deadline removes the verification step that ensures the fix actually works without breaking existing functionality or exposing security gaps. A critical bug demands speed, but targeted regression tests or a test tier can be executed in minutes, providing evidence before production. Shipping untested code often turns a known bug into an unknown, potentially larger incident.
- ✓
Follow the normal change approval and testing process
Why this is correct
Following the normal change approval and testing process keeps the urgent fix within the organization's defined change control framework, ensuring the change is documented, impact-assessed, and reviewed. Even under pressure, processes such as an emergency change advisory board (eCAB) allow for abbreviated but still real authorization and testing. This maintains audit trails and accountability while satisfying the need for a rapid response.
- ✗
Rename the release package to reduce risk
Why it's wrong here
Renaming a release package does not alter its code, dependencies, or runtime behavior, so it cannot reduce technical risk or improve reliability. Release naming and versioning help with tracking, but they are cosmetic and do not substitute for proper rollback planning and testing. Risk in a release comes from changes to functionality, security posture, or infrastructure, none of which are affected by the file name.
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Change management
Change management is the structured process of planning, approving, implementing, and reviewing changes to IT systems to minimize risk and disruption.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.