SY0-701 Security Operations Practice Question
An administrator wants to add a new vendor IP range to a firewall rule in production. What is the best change-management step to reduce risk?
⚠ Common exam trap
A common mix-up: candidates think immediate implementation (Option A) is acceptable for urgent security fixes, but the question specifies adding a new vendor IP range, which is a planned change that must follow proper change management procedures to avoid unintended access or downtime.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Test and approve the change before implementing it in production.
Change management requires testing and approval before applying changes to production systems. Adding a new vendor IP range to a firewall rule without validation could inadvertently allow malicious traffic or block legitimate traffic, leading to a security breach or service disruption. Testing in a non-production environment or using a change window ensures the rule behaves as intended and aligns with the organization's security policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply the change immediately during peak business hours.
Why it's wrong here
Applying the change immediately during peak business hours maximizes exposure to a fault. Under production load, a misconfigured rule could block legitimate traffic company-wide or silently permit malicious flows, and the high traffic volume makes diagnosing and rolling back the change far more difficult. Change management processes exist specifically to place high-risk firewall changes into maintenance windows with validation and a defined back-out plan.
- ✓
Test and approve the change before implementing it in production.
Why this is correct
Change management should include review, approval, and testing before production deployment. This reduces the chance of outages, misconfigurations, and unintended access. A controlled change window and validation steps are especially important for firewall rules because small mistakes can break connectivity or create security gaps.
- ✗
Allow the entire vendor subnet permanently without review.
Why it's wrong here
Permanently granting the entire vendor subnet without review violates the principle of least privilege and expands the attack surface indefinitely. It assumes every host in that subnet is equally trusted, which may allow a compromised vendor machine to reach internal systems that should never be exposed. Firewall changes require scoping to the specific IPs and ports that support the business need, plus a scheduled review or expiry to keep access current and auditable.
- ✗
Skip documentation to speed up the rollout.
Why it's wrong here
Skipping documentation makes the firewall rule unaccountable and unmaintainable, because no one later can determine why the rule exists, what it was intended to allow, or when it can be removed. Audit and compliance frameworks such as PCI DSS require a record of change for every rule modification, and documentation provides the basis for troubleshooting, rollback, and rule-base cleanup. Without it, an orphaned rule can go unnoticed for years and become a security gap.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Security policy
A security policy is a formal set of rules and guidelines that an organization establishes to protect its information assets and technology resources.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.