SY0-701 Security Operations Practice Question
A firewall rule was changed in production to allow a new vendor IP range, and payroll users immediately lost access to an internal service. Which two change-management practices would have reduced the risk of this outage? Select two.
⚠ Common exam trap
It's easy for candidates to think testing in staging is unnecessary if the change seems small, or they confuse 'testing' with 'monitoring in production'—but the question specifically asks for practices that reduce risk before the outage occurs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Test the rule in a staging environment with representative traffic before production deployment.
Testing the firewall rule in a staging environment with representative traffic allows you to validate that the new vendor IP range does not inadvertently block or conflict with existing rules before impacting production. This practice catches misconfigurations—such as an overly broad permit that shadows a deny rule for payroll users—without risking service disruption. Staging mirrors production ACL logic, so you can verify that the rule order and match criteria (e.g., source IP, destination port) behave as intended.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Test the rule in a staging environment with representative traffic before production deployment.
Why this is correct
Staging validation helps reveal rule-order problems, unintended blocks, and missing dependencies before users are affected. A representative test environment is especially important for firewall changes because small syntax or sequencing errors can have large business impacts. Testing reduces the chance that a production change will break unrelated services.
- ✓
Require a rollback or backout plan that can quickly restore the previous rule set.
Why this is correct
A rollback plan limits outage duration when a change causes unexpected failure. For firewall rules, it should specify exactly how to revert safely, who is authorized to do it, and how to verify service restoration. Backout planning is a core change-management control because even well-tested changes can fail in production.
- ✗
Make the change during the busiest business hour so the team can observe the effect immediately.
Why it's wrong here
Changing critical access rules during peak usage increases business risk and leaves less room to recover gracefully. Good change management typically uses low-impact windows or approved maintenance periods for risky updates. Immediate observation is not worth the potential outage during high-demand periods.
- ✗
Remove logging on the firewall so only the new rule is visible during troubleshooting.
Why it's wrong here
Suppressing logs weakens troubleshooting and reduces visibility into what the change actually did. Audit and event logs are essential for understanding rule behavior, diagnosing outages, and documenting the fix. Logging should be preserved or improved, not disabled.
- ✗
Skip approval because the vendor was already known to the organization.
Why it's wrong here
Known vendors can still introduce configuration errors or unexpected network paths. Skipping approval removes a key control that helps catch mistakes before they reach production. Even routine changes should be reviewed, especially when they affect traffic flow for critical business services.
Visual reference
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.