SY0-701 Security Program Management and Oversight Practice Question
A development team needs to release an urgent fix for a customer portal on Friday evening. The business wants the change to be reversible if something breaks, and security does not want the team to skip release controls. Which requirement should be part of the change process?
⚠ Common exam trap
A common mix-up: candidates think an urgent fix justifies skipping controls (Option A) or that disabling logging is acceptable to avoid disk issues (Option C), but the exam emphasizes that security controls and reversibility must be maintained even for emergency changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require a documented test in a lower environment and a rollback plan before production approval.
It enforces a documented test in a lower environment and a rollback plan, which satisfies both the business requirement for reversibility and the security requirement to maintain release controls. This aligns with the change management process in the SY0-701 domain of Security Program Management and Oversight, ensuring that changes are validated before production deployment and can be undone if issues arise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy directly to production as soon as the patch compiles successfully.
Why it's wrong here
A successful compile confirms only syntax and type correctness, not runtime behavior, integration compatibility, or load tolerance. Deploying directly to production without lower-environment testing and a rollback plan bypasses change-management controls, meaning any undetected defect directly impacts customers while leaving the team with no recovery path. This contradicts standard release management principles and increases the probability of a prolonged outage.
- ✓
Require a documented test in a lower environment and a rollback plan before production approval.
Why this is correct
Testing in a lower environment and documenting a rollback plan are core secure change-management practices. They reduce the chance of introducing an outage and make recovery faster if the fix has unexpected side effects. This approach supports controlled release, accountability, and operational resilience while still allowing urgent changes to move forward in a safe way.
- ✗
Turn off logging during deployment to avoid filling the disk with change records.
Why it's wrong here
Disabling logging during deployment removes the very telemetry needed for real-time monitoring, incident diagnosis, and post-change validation, creating a blind spot when issues are most likely to surface. Disk-fill concerns are properly addressed with log rotation, size limits, and centralized log aggregation, not by turning off audit trails. Without logs, the change lacks evidence for compliance, troubleshooting, and accountability, substantially undermining a controlled release.
- ✗
Allow the release only if the developer verbally confirms the code is safe.
Why it's wrong here
A verbal assurance is non-reproducible and non-auditable; it offers no objective evidence that security scans, functional tests, or integration checks were completed. Controlled change management requires documented artifacts such as test results, sign-off, and rollback steps to enforce separation of duties and to support a defensible go/no-go decision. Relying on informal communication also creates a single point of failure and leaves no trace for post-incident review.
Visual reference
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Change management
Change management is the structured process of planning, approving, implementing, and reviewing changes to IT systems to minimize risk and disruption.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.