SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Mitigate the risk by applying a technical control immediately

  Why it's wrong here

  Mitigation seeks to reduce a risk's likelihood or impact by applying a technical control, which is designed for risks the organization has decided to actively remediate. In this scenario, the department has already judged the software risk to be low likelihood and has chosen not to fix it now, so an immediate technical control would be disproportionate, consume resources, and contradict the leadership's deliberate decision to defer action. The appropriate response under these conditions is not to deploy a control but to formally accept the situation while tracking it.

• ✓

  Accept the risk with documented approval and periodic review

  Why this is correct

  Acceptance is a formal risk response in which the risk owner acknowledges the residual risk and documents the decision to tolerate it, often with a justification such as low likelihood and minimal impact. In this case, because the business has decided not to fix the issue now, the correct step is to record that approval and schedule periodic reviews to ensure the risk remains within the organization's risk appetite. This differs from ignoring the risk; it requires ongoing monitoring and reassessment to detect when the risk level changes and the cost of mitigation eventually becomes justified.

• ✗

  Transfer the risk to an insurer or third party

  Why it's wrong here

  Transference shifts the financial burden of a risk to a third party, typically through insurance or contractual clauses, but it does not reduce the underlying software vulnerability or remove the organization's responsibility for the system's operation. The scenario explicitly says the business is keeping the risk internally and will review it later, so there is no indication that an insurer has been engaged or that transfer would address the root cause or the acceptance decision. Additionally, low-likelihood software risks are often excluded from standard policies or carry premiums that exceed the expected loss, making transfer economically unattractive.

• ✗

  Avoid the risk by stopping the business activity entirely

  Why it's wrong here

  Avoidance is the most drastic risk response because it eliminates the risk entirely by discontinuing the business activity, process, or system that produces it, rather than managing the probability or impact afterward. Here, the scenario describes only a low likelihood software risk that the business has decided not to fix now, so ceasing operations would introduce far greater disruption, lost productivity, and cost than the risk itself. Avoidance should be reserved for high-impact, unacceptable risks that cannot be otherwise controlled, not for a residual risk that the organization is willing to tolerate and monitor.

Go deeper

Related to this question