Question 354 of 1,013
SY0-701 Security Operations Practice Question
A firewall rule change was implemented directly in production to allow a new vendor IP range. Within minutes, several internal services became unreachable because the rule order changed unexpectedly. Which change-management practice would have most likely prevented this outage?
⚠ Common exam trap
A common mix-up: candidates confuse 'change management' with 'incident response' or 'documentation,' leading them to choose options that address symptoms (e.g., faster response or post-hoc documentation) rather than the root cause of unvalidated rule order changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Testing the change in a staging environment and approving it through a peer-reviewed change process before production.
Implementing the change in a staging environment first allows validation of the rule order and its impact on traffic flow without affecting production. A peer-reviewed change process ensures that the rule insertion point (e.g., before a deny-all or after a permit statement) is verified, preventing the accidental reordering that caused the outage. This aligns with the change-management principle of testing in a representative environment before production deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Testing the change in a staging environment and approving it through a peer-reviewed change process before production.
Why this is correct
A tested, peer-reviewed change process helps catch rule-order problems, dependency issues, and unintended access impacts before production is affected. Firewall changes can alter traffic flow in subtle ways, so validating them in a nonproduction environment and having a formal approval path reduces the chance of service disruption. A backout plan also gives the team a quick recovery path if the production change behaves differently than expected.
- ✗
Applying the rule during business hours so the team can respond faster if something breaks.
Why it's wrong here
This option assumes that faster response equates to safer change. In reality, implementing a firewall rule during peak hours maximizes the blast radius if the rule is misordered or too broad; users are actively traversing the firewall, so a typo in source/destination can instantly drop legitimate traffic. The presence of on-call staff only accelerates detection and rollback, but does nothing to validate the rule's logic or rule order beforehand. Proper change windows are chosen to minimize business disruption, not to make incident response more convenient.
- ✗
Making the change first in production because that is the only environment that matters.
Why it's wrong here
This conflates 'authoritative' with 'safe'; production is indeed the system that serves users, but that is precisely why unvalidated changes there are dangerous. Firewall rules depend on implicit and explicit order, interface zones, and service objects, any of which can behave differently than a stale diagram suggests. By skipping staging, the change is tested by production users, meaning the first indication of a problem is an outage or security hole. A reproducible staging environment that mirrors the production topology is the only way to safely observe the behavior of a rule before it is exposed to live traffic.
- ✗
Documenting the outage after the vendor confirms their IP range is valid.
Why it's wrong here
This is a post-mortem activity, not a preventive control; writing down what broke after the vendor clarifies an IP range does nothing to undo the outage or restore affected traffic. A valid vendor IP range is only one input into a rule; the rule's source, destination, policy, and placement still need to be tested before deployment. This option also reveals a process failure: the change should have had a complete specification and a peer review before being applied, not after an incident forces documentation. Documentation is important, but it is an output of a controlled change process, not a substitute for pre-change validation.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A firewall rule must be changed to allow a vendor update server. Which step best reduces the chance of an unexpected outage?
easy- A.Make the change directly in production without review to save time.
- ✓ B.Document the change, get approval, and include a rollback plan.
- C.Disable the firewall temporarily while the update is tested.
- D.Apply the rule but do not tell anyone so there is less paperwork.
Why B: Following a formal change management process—documenting the change, obtaining approval, and including a rollback plan—ensures that the firewall rule modification is reviewed for potential impacts, authorized by stakeholders, and can be reverted if it causes an outage. This structured approach minimizes the risk of unexpected downtime by validating the change in a controlled manner and providing a safety net.
Variation 2. A firewall rule was changed in production to allow a new vendor IP range, and payroll users immediately lost access to an internal service. Which two change-management practices would have reduced the risk of this outage? Select two.
medium- ✓ A.Test the rule in a staging environment with representative traffic before production deployment.
- ✓ B.Require a rollback or backout plan that can quickly restore the previous rule set.
- C.Make the change during the busiest business hour so the team can observe the effect immediately.
- D.Remove logging on the firewall so only the new rule is visible during troubleshooting.
- E.Skip approval because the vendor was already known to the organization.
Why A: Testing the firewall rule in a staging environment with representative traffic allows you to validate that the new vendor IP range does not inadvertently block or conflict with existing rules before impacting production. This practice catches misconfigurations—such as an overly broad permit that shadows a deny rule for payroll users—without risking service disruption. Staging mirrors production ACL logic, so you can verify that the rule order and match criteria (e.g., source IP, destination port) behave as intended.
Variation 3. A firewall ACL must be modified in production to allow a vendor update server. The team wants to minimize the chance of accidentally blocking payroll traffic. Which change-management step is best before applying the rule?
medium- A.Apply the rule immediately and monitor the help desk for complaints.
- ✓ B.Test the proposed rule in a staged policy set and keep a rollback plan ready.
- C.Remove all deny rules temporarily so the vendor traffic can pass cleanly.
- D.Disable logging during the change to avoid slowing down the firewall.
Why B: Testing the proposed rule in a staged policy set allows the team to verify that the new ACL entry does not inadvertently match and drop payroll traffic before it is applied to the production firewall. Keeping a rollback plan ready ensures that if the rule causes unexpected blocking, the previous ACL can be restored immediately, minimizing downtime. This aligns with the change-management principle of validating changes in a controlled environment to prevent service disruption.
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.