What Must Be Done Before Mitigating Production Vulnerabilities?

SY0-701 By islever Editorial Last updated Aug 3, 2026

Short answer

D Refer to the change management policy.

Question

Which of the following steps should be taken before mitigating a vulnerability in a production server?

Escalate the issue to the SDLC team.
Use the IR plan to evaluate the changes.
Perform a risk assessment to classify the vulnerability.
Refer to the change management policy. Correct Answer

Key Takeaways

It tests whether you distinguish between vulnerability prioritization and the mandatory procedural safeguards required before deploying any production change.

This question evaluates understanding of operational procedures before modifying live systems, with community consensus favoring formal change control over technical analysis.

Common mistake: Candidates often choose risk assessment, mistakenly believing that classifying severity replaces the need for formal approval, testing, and rollback planning before touching a production server.

Expert Analysis

Understanding the Core Concept

In enterprise IT operations, change management is the formalized process used to ensure that modifications to systems—especially production servers—are planned, tested, approved, and documented before implementation. When a vulnerability is discovered, the technical fix (patch, configuration change, or workaround) is considered a system change. Therefore, before mitigation begins, administrators must consult the organization’s change management policy.

Why Option D is Correct

CompTIA Security+ consistently emphasizes that any alteration to a live production environment requires strict adherence to change control procedures. Implementing a mitigation without going through change management can lead to unexpected downtime, service disruption, misconfiguration, or failed patches. The change management process ensures the fix is evaluated for business impact, scheduled during maintenance windows, tested in a staging environment, approved by stakeholders, and accompanied by a rollback plan.

Why the Other Options Are Incorrect

Option A (SDLC team): The Software Development Life Cycle applies to building new applications, not patching or securing existing production infrastructure.
Option B (IR plan): Incident Response is triggered when a security breach or active threat occurs. Discovering a vulnerability is a routine operational task, not an incident requiring emergency response.
Option C (Risk assessment): While risk assessment and vulnerability scoring (e.g., CVSS) are essential for prioritizing which flaws to address first, they do not replace the procedural safeguards required before deploying changes to production. As noted by community experts, risk classification happens earlier in the vulnerability management lifecycle; change management is the immediate prerequisite for mitigation execution.

Community Consensus & Exam Tips

The split vote reflects a common test-taking trap: confusing the analysis phase with the execution phase. CompTIA rewards process-aware answers. Whenever you see “production,” “live,” or “deployment,” prioritize change management over technical analysis steps.

Official Reference

CompTIA Security+ SY0-701 Official Study Guide – Change Management & Vulnerability Management
NIST Special Publication 800-40 Rev. 4 – Guide to Enterprise Patch Management Technologies

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question involves deploying fixes, updates, or configurations to a live environment, immediately prioritize change management processes. Look for options mentioning approval, testing, rollback plans, and documentation rather than technical analysis steps. Always separate the identification/prioritization phase from the implementation phase in your mind.

Community Votes

55%

45%

55% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

9149f41 👍 5 Answered C

The correct answer is C. Perform a risk assessment to classify the vulnerability. Before mitigating a vulnerability in a production server, it's crucial to perform a risk assessment to understand the potential impact and severity of the vulnerability. This helps in prioritizing the mitigation efforts and ensuring that the most critical vulnerabilities are addressed first.
Konversation 👍 3 Answered D

Based on the style of this question with focus on "production server", the kind of answers referring to "software development" or "incident response plan", and similar questions by compTIA, where they ask for scheduled downtimes, I would go with answer D.
9149f41 👍 2 Answered D

A is not correct; there is no point to escalate vulnerability and mitigation. No incidents occur here. Vulnerability may be discovered by SIEM tools. B is not correct, because there is no incident occurring, just a vulnerability found that requires mitigation. C is not correct, because during mitigation there is no point to perform risk assessment.
test_arrow 👍 1 Answered D

Should be D Explanation: ✔ Ensures that changes are properly documented, tested, and approved before implementation. ✔ Prevents unintended downtime or issues by evaluating the impact of the mitigation on the production environment. ✔ Aligns with best practices for system stability and compliance.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide