SY0-701 Question 405
Single answerA company is preparing to roll out a security patch to the web application that handles customer orders. The patch fixes a serious vulnerability, but the application is tied to inventory, payment processing, and shipping systems. During a planning meeting, the security analyst warns that applying the patch directly to production could interrupt order processing if an integration issue occurs. Which policy or process would BEST ensure the patch is reviewed, tested, approved, and implemented with rollback planning before deployment?
- A
Acceptable use policy (AUP)
- B
Incident response procedure
- C
Change management process
- D
Disaster recovery plan
Show answer and explanation
Correct answer: C
Explanation
The best answer is change management process because the scenario centers on a planned production change that could affect availability and business operations. In Security+ terms, change management helps reduce operational and security risk by requiring documented requests, impact analysis, testing, approvals, scheduling, and rollback planning before implementation. This is especially important when patching interconnected systems. An AUP governs user behavior, not system modifications. Incident response is used when responding to active security events, not for routine controlled changes. Disaster recovery addresses restoration after significant disruption, not the approval workflow for a planned patch. This aligns with common security and IT governance best practices, including formal change control to protect confidentiality, integrity, and availability while minimizing business disruption.
- A. Incorrect.
Incorrect. An acceptable use policy defines how users are permitted to use company systems, devices, data, and network resources. It may prohibit unsafe behavior or unauthorized software installation, but it does not govern the formal review, testing, approval, scheduling, and rollback of production changes.
- B. Incorrect.
Incorrect. An incident response procedure is used to identify, contain, eradicate, and recover from security incidents. Although emergency changes can sometimes occur during incident handling, the scenario is about planned deployment of a patch and the need for assessment and controlled implementation, which is primarily handled through change management.
- C. Correct.
Correct. Change management is the formal process used to review, test, approve, document, schedule, and implement changes to production systems. In this scenario, it is the best fit because the patch affects a business-critical application with multiple dependencies. A proper change management process would require impact analysis, testing in a non-production environment, stakeholder approval, implementation planning, communication, and rollback procedures if the patch causes issues.
- D. Incorrect.
Incorrect. A disaster recovery plan focuses on restoring systems and operations after a major outage or destructive event, such as hardware failure, ransomware, or a natural disaster. While disaster recovery supports restoration after a failed change, it is not the primary process for governing normal patch deployment and pre-implementation approval.