Preventing Firewall ACL Changes from Breaking Production

SY0-701 By islever Editorial Last updated

Explain the importance of change management processes and the impact to security.

Short answer

B Testing the policy in a non-production environment before enabling the policy in the production network prevents accidental blocking of legitimate traffic caused by misconfigured access control lists.

Question

While troubleshooting a firewall configuration, a technician determines that a “deny any” policy should be added to the bottom of the ACL. The technician updates the policy, but the new policy causes several company servers to become unreachable. Which of the following actions would prevent this issue?
  1. Documenting the new policy in a change request and submitting the request to change management
  2. Testing the policy in a non-production environment before enabling the policy in the production network Correct Answer
  3. Disabling any intrusion prevention signatures on the “deny any” policy prior to enabling the new policy
  4. Including an “allow any” policy above the “deny any” policy

Key Takeaways

The exam tests the distinction between procedural governance (Change Management) and technical risk mitigation (Testing); the trap is choosing Change Management as the primary technical safeguard against misconfiguration errors.

This question explores the critical role of non-production testing in preventing service disruptions during firewall configuration changes. It establishes that while change management is required, only rigorous testing can validate technical correctness before production deployment.

Common mistake: Many learners select 'Documenting the new policy in a change request' because it is a mandatory process step; however, approving a request does not technically prevent the error if the configuration itself is flawed or untested.

Expert Analysis

Why the Answer Is Correct

The correct action to prevent this specific issue is B: Testing the policy in a non-production environment before enabling it in the production network. The scenario describes a technical failure where a blanket deny rule blocked legitimate traffic due to missing allow rules or incorrect ordering. A non-production (staging) environment allows the technician to verify that the ACL behaves as intended without impacting live business services. This directly addresses the root cause—the lack of validation—whereas administrative processes do not fix technical errors.

Why the Other Options Are Wrong

Option A is incorrect because submitting a change request is a governance requirement, but it does not guarantee technical success; a change manager may approve a request based on documentation without verifying the code's logic. Option C is irrelevant because intrusion prevention signatures are not the cause of connectivity loss from a deny-all rule. Option D creates a security vulnerability by allowing all traffic, defeating the purpose of the deny-all policy and exposing the network to threats.

Community Comment Notes

The community was divided between strict adherence to ITIL processes (Change Management) and practical engineering controls (Testing). Several users argued that you should never touch production without a ticket (User92, slackbot), while others emphasized that the test phase is what actually catches bugs (SHADTECH123, MarysSon). One commenter noted that while A is necessary, B is the specific control that prevents the outage described (Examplary). Another user pointed out that Change Management often relies on the technician providing evidence of testing, making B the foundational step for a valid request (Twphill).

Exam Strategy

Always look for the option that provides technical verification when a question involves a configuration error causing downtime. If an option offers a way to simulate or validate the change safely (like staging or testing), it is usually superior to purely administrative options like documentation or approval.

Frequently Asked Questions

Is Change Management (A) wrong?

No, it is required, but it is not the technical control that prevents the specific outage described. Testing validates the configuration.

Why is adding Allow Any (D) wrong?

It defeats the security purpose of the firewall by permitting all traffic, leaving the enterprise exposed to external threats.

More SY0-701 FAQ →

Community Votes

B
71%
A
29%

71% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 22 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 22

  1. Examplary 👍 15
    Frankly it should be both A and B. Submitting it to change management does not prevent the issue if it isn't caught by change management, and testing it in non-prod would but also shouldn't be done without a request to change management. It's a different question than the previous one regarding change management: Yes the technician SHOULD put in a change management request first, but that's not the question, the question is what would prevent it and the change management request does not prevent an issue, rather it lets everyone know what is happening and provides a backout plan if issues come up. That still does not PREVENT the issue though so /shrug
  2. SHADTECH123 👍 13 Answered B
    Testing the policy in a non-production environment allows for the identification and resolution of any unforeseen issues, such as servers becoming unreachable, before implementing the policy in the production network. This ensures that any potential impact on business operations is minimized.
  3. tamdod 👍 4
    Shouldn't a change management be submitted before changing the firewall? That way other people have a change to look at it, and more than likely someone would have caught the problem before it occurred.
  4. dbrowndiver 👍 2 Answered B
    By testing the policy in a non-production environment, the technician can identify potential issues, such as legitimate traffic being blocked, before applying the changes to the production network. This approach allows for adjustments and troubleshooting in a safe setting, minimizing the risk of disruption to business operations.
  5. Twphill 👍 2
    Answer A: Before any changes are made, the request should be submitted to Change Management. As part of Change Management, the change will be tested in a non-production environment. This is not the responsibility of the technician that decided to make the change. His job is to request the change.
Show 17 more comments
  1. Bito808 👍 2 Answered A
    The answer is "A"! You will get fired if you did not put in a change request before testing or implementing anything! It needs to be documented and approved FIRST! This will determine if you need equipment, resources, special access, or if there's even budget!
  2. User92 👍 2 Answered A
    Change Management Processes: Schedule maintenance windows, Thorough backout plans, Consistent “testing” post-implementation
  3. TECHBOSS 👍 1 Answered B
    Answer: B Procedurally "A" should and needs to occur first, However those 2 steps by themselves won't prevent this Even though those changes will still have to be tested in a non-production environment. Even if the CAB approves the request, ONLY seeing it in action will let anyone know that it will interfere with servers. Testing is the ACTION that will prevent it.
  4. 43a41d4 👍 1 Answered B
    Since the question mentions that the technician has already updates the policy, we can assume that he got approval first to implement the solution. But, for a good technician to perform well and avoid any issues, he should test the changes in a non-production environment. Both questions A and B are good answers, but B est is the best one in this case.
  5. slackbot 👍 1 Answered A
    you got this wrong. change management is not about documenting, it is about evaluating the request. if properly reviewed - it will not be allowed. and we are not talking about who does their work well and not - we cannot speculate if change management fails and this is approved. change manamgement (A) should be correct
  6. darpanne 👍 1 Answered B
    Testing the policy in a non-production environment allows the technician to identify and fix any unintended consequences before implementing the rule in the production network. This ensures the servers and critical services remain reachable while maintaining security.
  7. MarysSon 👍 1 Answered B
    B is the best answer. A change request can be submitted and approved, but problems will arise if the approved change is not applied correctly. Testing the change in a non-production environment will reveal errors before they can affect production.
  8. 3dk1 👍 1 Answered A
    B is something that should have been done. HOWEVER, if we documented the new change and submitted a change request this issue could have been prevented as well.
  9. MaxiPrince 👍 1 Answered B
    . Testing the policy in a non-production environment before enabling the policy in the production network
  10. Gigz_77 👍 1 Answered A
    A. Documenting the new policy in a change request and submitting the request to change management
  11. prabh1251 👍 1 Answered B
    After successful testing and change approval, apply the policy in the production environment.
  12. linuxer 👍 1 Answered A
    change management request will include testing the updated policy before implementing it
  13. MaxiPrince 👍 1 Answered B
    Test policy in no prod environment
  14. TrebleSmith 👍 1
    D would work in a chaotic way lol
  15. User92 👍 1 Answered A
    Should be A, check Question #30
  16. Zach123654 👍 2 Answered B
    GPT!!!
  17. Andyhung1303 👍 1 Answered A
    Maybe i guess

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide