SY0-701 Security Program Management and Oversight Practice Question
A cloud-hosted invoicing app has a critical vulnerability, but the vendor says a patch will not be available for six weeks. The team adds a web application firewall rule, restricts access to the app subnet, and increases monitoring until the patch arrives. What is this best described as?
⚠ Common exam trap
Many exam-takers confuse 'compensating control' with 'risk acceptance' because both involve living with a vulnerability, but compensating controls actively reduce risk through temporary safeguards, whereas risk acceptance means no additional controls are applied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compensating control, because temporary safeguards reduce exposure until the patch is available.
The team deployed temporary security measures—a web application firewall (WAF) rule, subnet access restrictions, and enhanced monitoring—to reduce the risk exposure while waiting for the vendor's patch. These are compensating controls, which are alternative safeguards that mitigate a vulnerability when the primary control (the patch) cannot be implemented immediately. The scenario explicitly states the patch is six weeks away, making these interim measures a textbook compensating control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk avoidance, because the system is being shut down permanently.
Why it's wrong here
Risk avoidance would require removing the vulnerable cloud invoicing application from operation entirely, effectively eliminating the attack surface and the business function it supports. Since the system continues to run with added safeguards, the organization is not avoiding the risk but instead attempting to manage it through alternative security measures until a vendor patch is available.
- ✗
Risk transfer, because the vendor is responsible for the vulnerability.
Why it's wrong here
Risk transfer shifts the financial or contractual impact of a loss to a third party, such as through cyber insurance or a vendor indemnification clause. However, the vendor's responsibility for fixing its own product does not remove the technical exposure the organization faces while the vulnerability remains exploitable; the operational risk stays with the cloud tenant, so this is not risk transfer.
- ✓
Compensating control, because temporary safeguards reduce exposure until the patch is available.
Why this is correct
A compensating control is an alternative safeguard deployed when the primary control—here, the vendor's patch—cannot be implemented immediately. Examples include a web application firewall rule to block exploit attempts, network segmentation to isolate the app, or enforced multi-factor authentication to reduce compromise likelihood. These temporary measures reduce residual exposure, which is exactly the correct risk treatment until the official fix is applied.
- ✗
Residual risk acceptance, because the vulnerability is being ignored until next quarter.
Why it's wrong here
Residual risk acceptance requires an explicit, informed decision by management to tolerate the remaining risk after other controls have been applied, typically with periodic review and sign-off. The scenario describes actively adding temporary safeguards and tighter restrictions, not passively ignoring the vulnerability until next quarter, so it does not meet the definition of risk acceptance.
Visual reference
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
Firewall rule
A firewall rule is a set of conditions that tells a firewall which network traffic to allow or block based on attributes like source, destination, port, and protocol.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A department wants to keep using a cloud printing service even though the vendor has not yet completed the company's security questionnaire. The business owner agrees to add extra log monitoring until the review is finished. What is the best term for the added monitoring?
easy- ✓ A.A compensating control, because it reduces risk while the normal control is unavailable.
- B.Residual risk, because all risk is eliminated once monitoring is added.
- C.Risk acceptance, because the business owner has approved continued use of the service.
- D.Due diligence, because the company is actively reviewing the vendor.
Why A: The added log monitoring is a compensating control because it provides an alternative security measure to mitigate risk while the primary control (the vendor's completed security questionnaire) is not yet in place. Compensating controls are temporary or alternative safeguards that reduce risk exposure when the preferred control cannot be implemented immediately. In this scenario, the monitoring does not eliminate the need for the questionnaire but reduces the risk of undetected malicious activity until the vendor's security posture is formally assessed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.