SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Avoid the risk by shutting down the finance application immediately.

  Why it's wrong here

  Avoidance would eliminate the vulnerability's exposure by taking the application offline, but that action would also halt a critical business service that the organization has determined must remain available for the next six months. In this scenario, the availability impact of a shutdown exceeds the security impact of the known vulnerability. Compensating controls are preferable because they preserve the service while actively reducing the likelihood or blast radius of an exploit.

• ✓

  Mitigate the risk by adding compensating controls and tracking residual risk until the patch is available.

  Why this is correct

  This approach reduces the likelihood or impact of exploitation while keeping the business service running. Compensating controls such as increased monitoring, segmentation, additional access restrictions, and temporary workarounds are appropriate when a patch is unavailable. The organization can then document the remaining risk, assign an owner, and revisit the issue when the vendor releases the fix.

• ✗

  Transfer the risk by asking the vendor to guarantee that no incident will occur.

  Why it's wrong here

  Risk transfer does not mean obtaining a promise of perfect security; it typically shifts the financial impact of a loss to an insurer or a vendor through a contract, yet the actual technical vulnerability remains exploitable. A vendor guarantee cannot prevent an attack or protect the finance application's data, and no vendor will accept unlimited liability. Furthermore, the organization retains responsibility for safeguarding its own assets, so this proposed 'transfer' is neither practical nor effective as a risk treatment.

• ✗

  Accept the risk because any delay in patching is automatically low priority.

  Why it's wrong here

  Risk acceptance is a formal decision made only after a thorough assessment shows that the residual risk is within the organization's risk appetite, and it must be documented and approved by management. A known vulnerability in a finance application directly affects confidentiality and integrity, so classifying it as automatically low priority just because the patch is delayed is unsound. Without compensating controls or a risk-based justification, unwarranted acceptance leaves the organization exposed to potential financial fraud or data loss, violating security governance principles.