SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A screenshot of the firewall management homepage showing that the system is online.

  Why it's wrong here

  A screenshot of the firewall management homepage only proves that the management interface is reachable and the firewall is powered on at a particular moment. It contains no metadata about who submitted a rule request, who evaluated its risk, or when the change was actually applied to the production rulebase. Because an auditor cannot correlate that image with any specific change ticket, revision number, or timestamp, it fails to demonstrate that any rule modification went through the required review and approval process.

• ✓

  Change tickets showing requester, reviewer approval, implementation date, and rollback plan.

  Why this is correct

  Change tickets are strong audit evidence because they show who requested the change, who approved it, when it was implemented, and how the organization planned to reverse it if needed. That level of documentation demonstrates governance, traceability, and control over configuration changes, which is exactly what an auditor is trying to verify.

• ✗

  An email from the network team stating they remember reviewing the changes.

  Why it's wrong here

  An email from the network team that simply says they remember reviewing the changes is anecdotal and unsupported by verifiable records. Unlike a structured change ticket, the email lacks the requester's identity, an explicit approval decision, an implementation timestamp, and a documented rollback procedure. Memories are fragile and subject to recency bias, so auditors treat such correspondence as hearsay rather than as evidence that a formal change governance workflow was followed for each firewall rule.

• ✗

  A list of the firewall vendor's product features from the company website.

  Why it's wrong here

  A list of the firewall vendor's product features describes the capabilities of the appliance itself, such as stateful filtering, zones, or application control, but it is completely silent on how this organization authorizes and implements rule changes. It cannot show that any specific rule was proposed, risk-assessed, approved, and then deployed with a rollback plan, which is exactly what an external audit needs to verify. Vendor documentation is generic marketing material that would be identical for any customer, proving nothing about this particular organization's internal change control discipline.