Security Program Management and Oversight →hardMultiple ChoiceObjective-mapped

SY0-701 Security Program Management and Oversight Practice Question

Exhibit

Change control evidence:
- CHG-8842: "Allow vendor IP range for maintenance window"
- Requested: 2026-04-18 09:10
- Reviewed by CAB: Approved 2026-04-18 11:40
- Implemented: 2026-04-18 22:05
- Post-change validation: Firewall logs show only the approved destination was opened
- Separate email: "Looks fine to me" from engineer after implementation

Based on the exhibit, which artifact is the strongest evidence that the firewall change was reviewed and approved before implementation?

⚠ Common exam trap

Watch out — candidates often confuse post-implementation verification (Option A) or technical success logs (Option B) with the governance requirement for pre-approval, which is the core of change management oversight.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The change request record with CAB approval timestamp and implementation time.

The change request record with a CAB approval timestamp and implementation time provides a clear, auditable trail that the firewall change was formally reviewed and authorized by the Change Advisory Board before it was executed. This aligns with the change management process required for security program oversight, ensuring that changes are not implemented without proper governance.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The engineer's post-implementation email, because it confirms someone checked the change.
Why it's wrong here
The engineer's post-implementation email is informal, after-the-fact communication, not a controlled change-management artifact. It may confirm that someone observed the change, but it does not contain a pre-authorized approval timestamp or a CAB decision, and it lacks the audit trail required to prove the change was reviewed before deployment.
✗
The firewall logs, because they show the rule was applied successfully on the device.
Why it's wrong here
Firewall logs are technical records that the rule was installed and is passing or implicitly denying traffic, but they are generated by the device during normal operation. They do not capture the governance process, such as who approved the change, when approval was granted, or whether the change was scheduled through change management, so they cannot prove authorization preceded implementation.
✓
The change request record with CAB approval timestamp and implementation time.
Why this is correct
This is the best evidence because it shows formal review and approval occurred before the change was implemented. Auditors want controlled, time-stamped proof of authorization, not just technical confirmation that the firewall rule changed or an informal email afterward. The change record directly supports compliance with change management requirements.
✗
The vendor's maintenance notice, because it explains why the rule was needed.
Why it's wrong here
A vendor maintenance notice is third-party external information that may justify the need for a firewall rule, but it is not evidence of the organization's internal change control process. It does not show that the change was reviewed by the Change Advisory Board, approved with a timestamp, or implemented under controlled procedures—it only provides context for why the rule might have been requested.

Go deeper

SY0-701 Security Program Management and Oversight Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question