1.3 - Change management in security
Security+ SY0-701 objective 1.3 covers the security importance of change management. Before any change - such as a firewall rule - reaches production, a ticket must be reviewed, tested and approved, so risky edits are caught before they cause an outage or open a hole. A rollback capability lets an automation pipeline revert to the last approved state whenever a rule drifts, keeping configurations in a known-good condition. An emergency change lets an admin bypass normal approval to stop an active attack, but it still requires post-approval and documentation afterward. Change management also covers versioning, maintenance windows, stakeholder communication and updating diagrams. Expect scenario questions that describe a proposed or emergency change and ask which change-management practice - approval workflow, rollback, or emergency change with post-review - applies to keep the environment stable and secure.
Change to production = review, test, approve first. Auto-revert to last approved state = rollback. Stop an active attack now = emergency change (with post-approval). Change management keeps configs known-good and documented.
Practice questions
1. Before any firewall rule change reaches production, a ticket must be reviewed, tested, approved, and scheduled. This process is:
- Continuous integration
- Change management (correct answer)
- A tabletop exercise
- Configuration baselining
Formal review, testing, approval, scheduling and rollback planning for modifications is change management. It reduces outages and security regressions from unvetted changes and preserves an auditable trail.
2. An automation pipeline reverts a firewall to its last approved state whenever a rule drifts, and a rejected change never reaches production. This capability MOST supports:
- Data-at-rest encryption of the config
- Certificate pinning
- Change management with rollback (correct answer)
- Biometric authentication
Enforcing an approved baseline, blocking unvetted edits and auto-reverting drift is automated change management with rollback. It preserves an auditable, controlled path from request to production.
3. Before an emergency firewall fix, an admin bypasses normal approval to stop an active attack, then documents and reviews it right afterward. This is BEST described as:
- A standard change request
- A routine baseline update
- An emergency change (with post-approval) (correct answer)
- An untracked shadow change with no record
An urgent modification made outside the normal flow to address an active threat, then documented and reviewed after the fact, is an emergency change. It's still tracked and retro-approved — not an untracked shadow change.