SY0-701 · Objective 1.3 · General Security Concepts
1.3 Change management explained
The official objective: “Explain the importance of change management processes and the impact to security.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 1.3 covers
Change management can feel like an operations topic, but Security+ treats it as security because unmanaged change is one of the most common causes of outages and of holes nobody noticed opening. Objective 1.3 asks you to know both the business process and its technical consequences.
On the business side, a change starts with a request that explains what will change and why. Someone owns the change and someone with authority approves it. The stakeholders who will be affected are identified and told. An impact analysis looks at what could break. The change is tested before it reaches production, scheduled into a maintenance window when the impact is lowest, and comes with a backout plan: the exact steps to return to the previous state if it goes wrong. Standard operating procedures make routine changes repeatable.
On the technical side, the exam wants you to think about what a change actually touches. A change may need a service or application restart, which means downtime. It may affect legacy applications that nobody fully understands, or dependencies that aren't obvious until something fails. It may require updates to allow lists and deny lists, firewall rules or other restrictions. Each of these is a place where a careful change process catches a problem that a hurried one misses.
Documentation closes the loop. Diagrams, policies and procedures should be updated when the change is made, not months later, and configuration files should be under version control so you can see who changed what and when, and roll back to a known good version.
Emergencies don't remove the process; they shorten it. If a critical fix can't wait for the normal approval board, an emergency change path lets an authorised person approve it quickly, and the change is documented and reviewed after the fact. Questions on this objective often offer a tempting answer that skips the process entirely because the situation is urgent. That answer is almost always wrong.
The security benefit is visibility. If every change is requested, approved, tested and recorded, an unexpected change stands out, which is useful for detecting both mistakes and attackers.
What candidates mix up
- Backout plan versus rollback in version control: the backout plan is the documented procedure for the whole change; version control is one tool it may use.
- Emergency change versus no change control: an emergency change is still approved and documented, just faster and afterward.
- Impact analysis versus testing: analysis predicts what might break; testing shows what does break in a safe environment.
Practice questions for 1.3
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
During an active outage, an engineer determines that a critical firewall rule must be changed immediately, outside the normal review cycle. Which approach best aligns with sound change management practice?
- AUse the emergency change process with streamlined approval, then fully document and review the change afterward
- BSubmit a normal request for change and wait for the next scheduled CAB meeting and maintenance window
- CClassify it as a standard change so it is treated as pre-approved and needs no separate review
- DHave the engineer apply the fix right away and record it in the change log only if it fails
Show answer and explanation
Answer: A) Use the emergency change process with streamlined approval, then fully document and review the change afterward
Urgent fixes go through the emergency change process: they get streamlined approval (often from an ECAB) so they can be made quickly, but they are still documented and reviewed afterward.
- AEmergency changes exist to restore operations quickly. They still follow a documented procedure and get approval from a smaller emergency body (often an ECAB), and the change is recorded and reviewed afterward for accountability and side effects.
- BThe normal change path is meant for planned changes. Waiting for the routine cycle would prolong an outage that the emergency process is designed to handle.
- CStandard changes are routine, low-risk, well-understood changes. An unplanned change to a critical firewall rule doesn't fit that category, and treating it as one would bypass the approval it needs.
- DEvery change needs to be recorded, whether it succeeds or fails. Skipping documentation undermines auditability, configuration tracking, and future troubleshooting or rollback.
Question 2
Before a firewall rule change is applied to production, the team documents the reason, assesses the impact on other systems, schedules a maintenance window, gets sign-off, and writes a backout plan. Which process is this?
- AChange management
- BIncident response
- CBusiness continuity planning
- DPenetration testing
Show answer and explanation
Answer: A) Change management
- AFormal change management requires impact analysis, approval, a scheduled window, communication, and a documented rollback (backout) plan so changes are controlled and reversible.
- BIncident response handles active security events, not planned configuration changes.
- CBCP is about keeping the business running through disruptions, not approving routine changes.
- DPen testing probes for weaknesses; it isn't a change-approval workflow.
Question 3
A change request for a core router upgrade includes step-by-step instructions to restore the previous firmware and configuration if the upgrade fails. What is this section called?
- AA backout plan
- BAn impact analysis
- CA maintenance window
- DA test result report
Show answer and explanation
Answer: A) A backout plan
- AA backout plan defines how to reverse a change and return to a known good state if it causes problems.
- BAn impact analysis assesses what the change could affect, not how to reverse it.
- CA maintenance window is the scheduled time for the change, not the reversal procedure.
- DTest results show how the change behaved in testing, not how to undo it.
Other General Security Concepts objectives
Also: the General Security Concepts domain page (12% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.