Security Program Management and Oversight →easyMultiple ChoiceObjective-mapped

SY0-701 Security Program Management and Oversight Practice Question

A development team wants to skip testing and deploy a major application change directly to production to meet a release date. What should the security team require?

⚠ Common exam trap

A common mix-up: candidates think a phased rollout (Option C) is an acceptable compromise, but the SY0-701 exam emphasizes that change approval and testing in a nonproduction environment are mandatory before any production deployment, regardless of scale.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Require change approval and testing in a nonproduction environment first.

Security policy requires that all changes to production systems undergo formal change management, including approval and testing in a nonproduction environment first. Skipping testing violates the principle of change control and could introduce vulnerabilities or misconfigurations that compromise confidentiality, integrity, or availability. The security team must enforce this process to ensure the change is reviewed for security impact and validated before deployment.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Disable logging temporarily so the release is less likely to fail.
Why it's wrong here
Temporarily disabling logging to reduce failure risk is misguided because logging does not directly cause release failures; it actually provides essential observability. Without logs, if the release encounters errors, security incidents, or performance issues, the team lacks the telemetry needed to diagnose and respond quickly. Moreover, disabling security logs may violate compliance requirements and leave the organization blind to intrusions during the change window, increasing overall risk.
✓
Require change approval and testing in a nonproduction environment first.
Why this is correct
Change approval and testing in a separate environment are basic controls that reduce the chance of introducing defects or security issues into production. This approach supports safe deployment while still allowing the project to move forward in a controlled way.
✗
Deploy only to one server and monitor from there before deciding.
Why it's wrong here
Deploying to a single production server without prior nonproduction testing is an uncontrolled canary that still violates change management. While it limits blast radius, it does not provide the formal risk assessment, rollback planning, or validation that change approval and testing in a staging environment would. Additionally, a one-server sample may not represent the full environment, and if that server has different configuration or load, monitoring it can give false confidence.
✗
Let developers decide without review because they understand the code best.
Why it's wrong here
Even the most experienced developer can overlook subtle security vulnerabilities, configuration dependencies, or operational impacts. Skipping review removes a critical control—the independent verification that the change aligns with security policies, architecture standards, and business requirements. It also destroys the audit trail and separation of duties that regulatory frameworks and incident investigations rely on, making any future security issue harder to attribute or remediate.

Visual reference

Go deeper

SY0-701 Security Program Management and Oversight Practice Question

Why each option matters

Option-by-option breakdown

Related to this question