SY0-701 Security Operations Practice Question
A firewall rule must be changed to allow a vendor update server. Which step best reduces the chance of an unexpected outage?
⚠ Common exam trap
CompTIA often tests the misconception that speed or convenience (like disabling the firewall or skipping approval) is acceptable for urgent changes, but the exam emphasizes that proper change management is always required to prevent outages and maintain security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the change, get approval, and include a rollback plan.
Following a formal change management process—documenting the change, obtaining approval, and including a rollback plan—ensures that the firewall rule modification is reviewed for potential impacts, authorized by stakeholders, and can be reverted if it causes an outage. This structured approach minimizes the risk of unexpected downtime by validating the change in a controlled manner and providing a safety net.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Make the change directly in production without review to save time.
Why it's wrong here
Bypassing the change review process in a production firewall removes the technical and managerial validation that would catch typos in source/destination ports, overlapping rules, or misordered rule placement. An unreviewed rule can conflict with existing policies and cause an unintended denial of service while the vendor update is in progress, and without a rollback plan the network team has no pre-tested path to remove or correct the rule quickly.
- ✓
Document the change, get approval, and include a rollback plan.
Why this is correct
This is the best answer because secure change management uses approval and rollback planning to reduce operational risk. Documenting the requested change ensures the impact is reviewed, and a rollback plan gives the team a way to quickly restore service if the update causes problems. These controls help prevent outages caused by rushed or poorly understood production changes.
- ✗
Disable the firewall temporarily while the update is tested.
Why it's wrong here
Disabling the firewall turns off the entire security control plane for the whole traffic path, not just the vendor-specific IP/port conversation. During that window, the organization loses stateful filtering, user-defined allow/deny logic, and logging, which could let malware or exploitation reach any service accessible through that interface; the vendor update itself likely only needs a narrowly scoped allow rule, not a complete shutdown of the security boundary.
- ✗
Apply the rule but do not tell anyone so there is less paperwork.
Why it's wrong here
Applying the rule silently leaves no entry in the change record, so when the vendor communication fails or another rule is later added, no one knows the rule was intentional. Without documentation, the rule might be flagged as a security anomaly, reverted by another administrator, or blamed for a performance issue, and there is no rollback point to restore the previous configuration with confidence.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.