SY0-701 Security Operations Practice Question
A firewall ACL must be modified in production to allow a vendor update server. The team wants to minimize the chance of accidentally blocking payroll traffic. Which change-management step is best before applying the rule?
⚠ Common exam trap
The SY0-701 exam often tests the misconception that immediate application with monitoring is sufficient, but the trap is that this reactive approach ignores the risk of silently blocking critical traffic until complaints arise, which is unacceptable in a production environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Test the proposed rule in a staged policy set and keep a rollback plan ready.
Testing the proposed rule in a staged policy set allows the team to verify that the new ACL entry does not inadvertently match and drop payroll traffic before it is applied to the production firewall. Keeping a rollback plan ready ensures that if the rule causes unexpected blocking, the previous ACL can be restored immediately, minimizing downtime. This aligns with the change-management principle of validating changes in a controlled environment to prevent service disruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply the rule immediately and monitor the help desk for complaints.
Why it's wrong here
Applying the change first and reacting later increases outage risk. If the rule is wrong, business services may already be affected before anyone notices.
- ✓
Test the proposed rule in a staged policy set and keep a rollback plan ready.
Why this is correct
Testing the rule in a staged or cloned policy set helps confirm that the ACL logic, rule order, and source and destination matching behave as intended before production exposure. A rollback plan provides a fast recovery path if the change still causes an unexpected impact. Together, these practices reduce the likelihood of disrupting payroll traffic and align with safe, controlled change management in operational environments.
- ✗
Remove all deny rules temporarily so the vendor traffic can pass cleanly.
Why it's wrong here
Temporarily removing deny rules is overly broad and can expose far more traffic than intended. It increases risk instead of reducing it.
- ✗
Disable logging during the change to avoid slowing down the firewall.
Why it's wrong here
Disabling logging removes the audit trail needed to verify that the new ACL rule permits vendor traffic without dropping payroll packets; if a misconfiguration silently blocks payroll, the team cannot detect it until a payroll failure is reported. Logging is disabled only when the firewall’s CPU is overloaded by excessive log volume, and in that specific performance-crisis scenario, temporarily suspending logging is the correct step to prevent packet loss.
Visual reference
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.