SY0-701 Security Architecture Practice Question
The help desk can patch endpoints only after testing on a few pilot systems because one legacy app sometimes breaks after updates. What patching approach is most secure and least disruptive?
⚠ Common exam trap
It's easy for candidates to choose immediate patching (Option C) thinking speed is always best for security, ignoring the real-world need for compatibility testing to prevent operational disruption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply updates to a small pilot group first, then roll them out in stages to the rest of the fleet.
It follows a phased rollout strategy: testing on a small pilot group first validates compatibility with the legacy app, then staged deployment minimizes disruption while ensuring security patches are applied promptly. This balances the need for security updates with the operational requirement to avoid breaking critical legacy software.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply updates to a small pilot group first, then roll them out in stages to the rest of the fleet.
Why this is correct
Deploying to a small pilot group first lets IT validate the update against representative hardware and the legacy application before broader exposure. Staged rings then increase the population gradually, so if a compatibility issue emerges the blast radius is limited and the deployment can be paused or rolled back. This approach balances patch latency with stability, ensuring known vulnerabilities are remediated without risking fleet-wide outages.
- ✗
Wait until all applications are fully modernized before installing any security updates.
Why it's wrong here
Tying all patching to full application modernization is an indefinite delay because legacy applications may never be updated; meanwhile, known vulnerabilities in the OS or other components remain exploitable. Security updates should be prioritized based on risk and deployed in a controlled manner, not withheld until an unrelated project completes. This approach extends the organization's attack surface and conflicts with the principle of reducing the window of exposure.
- ✗
Patch every endpoint immediately at the same time without testing to reduce management overhead.
Why it's wrong here
Simultaneous fleet-wide patching without pilot testing eliminates the ability to detect conflicts with the legacy application or device drivers until the damage is widespread. If the update is defective, every endpoint is affected at once, potentially halting operations and requiring emergency rollback across the entire environment. Proper change management requires testing and staged deployment even if it adds administrative effort.
- ✗
Disable automatic updates permanently and patch only after a confirmed incident.
Why it's wrong here
Patching only after an incident means the organization accepts known exploitable vulnerabilities as a standing condition; attackers can use those flaws before any response is triggered. Automatic updates or at least scheduled proactive patching close vulnerabilities before they are weaponized against the organization. This reactive approach also assumes an incident will be detected promptly, which is not guaranteed, and it contradicts the security framework's emphasis on regular maintenance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.