SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A compensating control, because it reduces risk while the normal control is unavailable.

  Why this is correct

  A compensating control is an alternative safeguard used when the preferred control is missing, delayed, or not fully effective. Extra log monitoring helps reduce exposure while the vendor review is still in progress. It does not eliminate the underlying vendor risk, but it is a reasonable temporary measure to reduce likelihood of missing suspicious activity.

• ✗

  Residual risk, because all risk is eliminated once monitoring is added.

  Why it's wrong here

  Residual risk is the exposure that remains after all controls are implemented; it is the leftover risk, not a control itself. Adding extra log monitoring does reduce residual risk by increasing visibility into suspicious activity, but it does not eliminate the underlying risks posed by the cloud printing service. Since the question asks what the monitoring is—not what risk remains—identifying it as residual risk conflates the safeguard with the risk that persists.

• ✗

  Risk acceptance, because the business owner has approved continued use of the service.

  Why it's wrong here

  Risk acceptance is a formal decision by management to tolerate a known risk without applying additional mitigations, often documented in a risk register. Here, even if the business owner approved continued use, the department is actively applying extra monitoring as a risk-reduction measure, which is the opposite of pure acceptance. The monitoring is a compensating control introduced to lower risk while the vendor review is ongoing, so it cannot be classified as risk acceptance.

• ✗

  Due diligence, because the company is actively reviewing the vendor.

  Why it's wrong here

  Due diligence is the investigative process of evaluating a vendor's security, compliance, and operational practices before or during a relationship. While reviewing the vendor is a form of due diligence, the extra log monitoring is a technical safeguard, not an investigation step. The question specifically asks about the additional monitoring, which is a risk-mitigating control, not the act of verifying the vendor's posture.