SY0-701 Security Program Management and Oversight Practice Question
A hospital's claims portal has two open risks. Risk A is an internet-facing login page with a low-severity software flaw, but monitoring shows a steady increase in automated login attempts. Risk B is an internal file share with a medium-severity patch gap, but only a small admin group can access it and no exploitation is observed. Leadership can fund only one remediation this month. Which risk should be prioritized first?
⚠ Common exam trap
The trap here is that candidates fixate on severity ratings (low vs. medium) without considering the risk equation, especially the critical factor of active attack interest and internet exposure, which the SY0-701 exam emphasizes in the context of threat intelligence and attack surface management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Prioritize Risk A because it is exposed to the internet and already shows active attack interest.
Risk A should be prioritized because the internet-facing login page is exposed to the public attack surface, and the steady increase in automated login attempts indicates active reconnaissance or credential-stuffing attacks. Even though the software flaw is low severity, the combination of internet exposure and active attacker interest significantly elevates the likelihood of exploitation, making it a higher priority than an internal file share with no observed exploitation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Prioritize Risk A because it is exposed to the internet and already shows active attack interest.
Why this is correct
Risk A has the higher overall business risk because exposure and observed attack activity raise the likelihood of exploitation. Even if the flaw is rated low severity, an internet-facing system is more likely to be targeted quickly and broadly. Prioritization should consider both impact and likelihood, not severity alone. Addressing the public login page first reduces the chance of a successful compromise across a high-value service.
- ✗
Prioritize Risk B because a medium-severity flaw is always more important than a low-severity flaw.
Why it's wrong here
Severity alone does not determine priority. A medium-severity issue on a restricted internal share may present less immediate risk than an externally exposed system with active attack attempts. Risk decisions should weigh exposure, likelihood, and business impact together. This choice ignores those factors and overvalues the label on the vulnerability.
- ✗
Accept Risk A because no confirmed compromise has occurred yet.
Why it's wrong here
Risk acceptance is appropriate only when leadership knowingly tolerates the remaining exposure after considering likelihood, impact, and cost. Here, active probing on an internet-facing application suggests the risk is not yet under control. Accepting it without remediation would be weak risk management and could leave a critical service exposed to attack.
- ✗
Transfer Risk A to an insurer because public-facing exposure cannot be reduced.
Why it's wrong here
Insurance may help with financial loss, but it does not reduce the chance of compromise or protect the service itself. The issue needs operational remediation first, such as patching, hardening, or other mitigation. Transfer is not a substitute for handling a likely attack path on a public system.
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
Key term
Exploitation
Exploitation is the act of using a vulnerability or weakness in a system, network, or application to gain unauthorized access, cause damage, or extract data.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.