Preventing Firewall ACL Changes from Breaking Production

Explain the importance of change management processes and the impact to security.

While troubleshooting a firewall configuration, a technician determines that a “deny any” policy should be added to the bottom of the ACL. The technician updates the policy, but the new policy causes several company servers to become unreachable. Which of the following actions would prevent this issue?

  1. Documenting the new policy in a change request and submitting the request to change management
  2. Testing the policy in a non-production environment before enabling the policy in the production network Correct Answer
  3. Disabling any intrusion prevention signatures on the “deny any” policy prior to enabling the new policy
  4. Including an “allow any” policy above the “deny any” policy
Answer Correct answer: B — Testing the policy in a non-production environment before enabling the policy in the production network prevents accidental blocking of legitimate traffic caused by misconfigured access control lists.

Community Votes

B
71%
A
29%

71% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests the distinction between procedural governance (Change Management) and technical risk mitigation (Testing); the trap is choosing Change Management as the primary technical safeguard against misconfiguration errors.

This question explores the critical role of non-production testing in preventing service disruptions during firewall configuration changes. It establishes that while change management is required, only rigorous testing can validate technical correctness before production deployment.

Many learners select 'Documenting the new policy in a change request' because it is a mandatory process step; however, approving a request does not technically prevent the error if the configuration itself is flawed or untested.

Community Discussion (23 comments)

Examplary 👍 15
Frankly it should be both A and B. Submitting it to change management does not prevent the issue if it isn't caught by change management, and testing it in non-prod would but also shouldn't be done without a request to change management. It's a different question than the previous one regarding change management: Yes the technician SHOULD put in a change management request first, but that's not the question, the question is what would prevent it and the change management request does not prevent an issue, rather it lets everyone know what is happening and provides a backout plan if issues come up. That still does not PREVENT the issue though so /shrug
SHADTECH123 👍 13 Selected: B
Testing the policy in a non-production environment allows for the identification and resolution of any unforeseen issues, such as servers becoming unreachable, before implementing the policy in the production network. This ensures that any potential impact on business operations is minimized.
slackbot 👍 1 Selected: A
you got this wrong. change management is not about documenting, it is about evaluating the request. if properly reviewed - it will not be allowed. and we are not talking about who does their work well and not - we cannot speculate if change management fails and this is approved. change manamgement (A) should be correct
MarysSon 👍 1 Selected: B
B is the best answer. A change request can be submitted and approved, but problems will arise if the approved change is not applied correctly. Testing the change in a non-production environment will reveal errors before they can affect production.
prabh1251 👍 1 Selected: B
After successful testing and change approval, apply the policy in the production environment.
Andyhung1303 👍 1 Selected: A
Maybe i guess
TECHBOSS 👍 1 Selected: B
Answer: B Procedurally "A" should and needs to occur first, However those 2 steps by themselves won't prevent this Even though those changes will still have to be tested in a non-production environment. Even if the CAB approves the request, ONLY seeing it in action will let anyone know that it will interfere with servers. Testing is the ACTION that will prevent it.
darpanne 👍 1 Selected: B
Testing the policy in a non-production environment allows the technician to identify and fix any unintended consequences before implementing the rule in the production network. This ensures the servers and critical services remain reachable while maintaining security.
MaxiPrince 👍 1 Selected: B
. Testing the policy in a non-production environment before enabling the policy in the production network
MaxiPrince 👍 1 Selected: B
Test policy in no prod environment
43a41d4 👍 1 Selected: B
Since the question mentions that the technician has already updates the policy, we can assume that he got approval first to implement the solution. But, for a good technician to perform well and avoid any issues, he should test the changes in a non-production environment. Both questions A and B are good answers, but B est is the best one in this case.
3dk1 👍 1 Selected: A
B is something that should have been done. HOWEVER, if we documented the new change and submitted a change request this issue could have been prevented as well.
Bito808 👍 2 Selected: A
The answer is "A"! You will get fired if you did not put in a change request before testing or implementing anything! It needs to be documented and approved FIRST! This will determine if you need equipment, resources, special access, or if there's even budget!
Bito808 👍 1
The answer is "A"! You will get fired if you did not put in a change request before testing or implementing anything! It needs to be documented and approved FIRST! This will determine if you need equipment, resources, special access, or if there's even budget!
User92 👍 1 Selected: A
Should be A, check Question #30
User92 👍 2 Selected: A
Change Management Processes: Schedule maintenance windows, Thorough backout plans, Consistent “testing” post-implementation
Gigz_77 👍 1 Selected: A
A. Documenting the new policy in a change request and submitting the request to change management
linuxer 👍 1 Selected: A
change management request will include testing the updated policy before implementing it
Twphill 👍 2
Answer A: Before any changes are made, the request should be submitted to Change Management. As part of Change Management, the change will be tested in a non-production environment. This is not the responsibility of the technician that decided to make the change. His job is to request the change.
tamdod 👍 4
Shouldn't a change management be submitted before changing the firewall? That way other people have a change to look at it, and more than likely someone would have caught the problem before it occurred.
TrebleSmith 👍 1
D would work in a chaotic way lol
dbrowndiver 👍 2 Selected: B
By testing the policy in a non-production environment, the technician can identify potential issues, such as legitimate traffic being blocked, before applying the changes to the production network. This approach allows for adjustments and troubleshooting in a safe setting, minimizing the risk of disruption to business operations.
Zach123654 👍 2 Selected: B
GPT!!!

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The correct action to prevent this specific issue is B: Testing the policy in a non-production environment before enabling it in the production network. The scenario describes a technical failure where a blanket deny rule blocked legitimate traffic due to missing allow rules or incorrect ordering. A non-production (staging) environment allows the technician to verify that the ACL behaves as intended without impacting live business services. This directly addresses the root cause—the lack of validation—whereas administrative processes do not fix technical errors.

Why the Other Options Are Wrong

Option A is incorrect because submitting a change request is a governance requirement, but it does not guarantee technical success; a change manager may approve a request based on documentation without verifying the code's logic. Option C is irrelevant because intrusion prevention signatures are not the cause of connectivity loss from a deny-all rule. Option D creates a security vulnerability by allowing all traffic, defeating the purpose of the deny-all policy and exposing the network to threats.

Community Comment Notes

The community was divided between strict adherence to ITIL processes (Change Management) and practical engineering controls (Testing). Several users argued that you should never touch production without a ticket (User92, slackbot), while others emphasized that the test phase is what actually catches bugs (SHADTECH123, MarysSon). One commenter noted that while A is necessary, B is the specific control that prevents the outage described (Examplary). Another user pointed out that Change Management often relies on the technician providing evidence of testing, making B the foundational step for a valid request (Twphill).

Exam Strategy

Always look for the option that provides technical verification when a question involves a configuration error causing downtime. If an option offers a way to simulate or validate the change safely (like staging or testing), it is usually superior to purely administrative options like documentation or approval.

Frequently Asked Questions

Is Change Management (A) wrong?

No, it is required, but it is not the technical control that prevents the specific outage described. Testing validates the configuration.

Why is adding Allow Any (D) wrong?

It defeats the security purpose of the firewall by permitting all traffic, leaving the enterprise exposed to external threats.

More SY0-701 FAQ →

Related Analysis

Which of the following would be the best way to test resilie

S-Grade

A company is concerned about employees unintentionally intro

S-Grade

In order to strengthen a password and prevent a hacker from

S-Grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide