SY0-701 Security Program Management and Oversight Practice Question
An external auditor asks for proof that firewall rule changes were reviewed and approved before being implemented during the last quarter. Which evidence is MOST appropriate to provide?
⚠ Common exam trap
Test-takers frequently choose Option C, mistakenly believing that a verbal or informal email confirmation is sufficient evidence, when auditors require documented, formal approval records with a clear audit trail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change tickets showing requester, reviewer approval, implementation date, and rollback plan.
Change tickets provide a formal, auditable record of the entire change management process, including requester identification, reviewer approval, implementation date, and rollback plan. This directly satisfies the auditor's requirement for proof that firewall rule changes were reviewed and approved before implementation, aligning with the principle of separation of duties and change control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A screenshot of the firewall management homepage showing that the system is online.
Why it's wrong here
A screenshot of the firewall management homepage only proves that the management interface is reachable and the firewall is powered on at a particular moment. It contains no metadata about who submitted a rule request, who evaluated its risk, or when the change was actually applied to the production rulebase. Because an auditor cannot correlate that image with any specific change ticket, revision number, or timestamp, it fails to demonstrate that any rule modification went through the required review and approval process.
- ✓
Change tickets showing requester, reviewer approval, implementation date, and rollback plan.
Why this is correct
Change tickets are strong audit evidence because they show who requested the change, who approved it, when it was implemented, and how the organization planned to reverse it if needed. That level of documentation demonstrates governance, traceability, and control over configuration changes, which is exactly what an auditor is trying to verify.
- ✗
An email from the network team stating they remember reviewing the changes.
Why it's wrong here
An email from the network team that simply says they remember reviewing the changes is anecdotal and unsupported by verifiable records. Unlike a structured change ticket, the email lacks the requester's identity, an explicit approval decision, an implementation timestamp, and a documented rollback procedure. Memories are fragile and subject to recency bias, so auditors treat such correspondence as hearsay rather than as evidence that a formal change governance workflow was followed for each firewall rule.
- ✗
A list of the firewall vendor's product features from the company website.
Why it's wrong here
A list of the firewall vendor's product features describes the capabilities of the appliance itself, such as stateful filtering, zones, or application control, but it is completely silent on how this organization authorizes and implements rule changes. It cannot show that any specific rule was proposed, risk-assessed, approved, and then deployed with a rollback plan, which is exactly what an external audit needs to verify. Vendor documentation is generic marketing material that would be identical for any customer, proving nothing about this particular organization's internal change control discipline.
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Firewall rule
A firewall rule is a set of conditions that tells a firewall which network traffic to allow or block based on attributes like source, destination, port, and protocol.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.