SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Accept the risk and wait for the next scheduled scan cycle.

  Why it's wrong here

  Accepting the risk and waiting for the next scheduled scan cycle leaves a known critical remote code execution flaw exposed on an internet-reachable appliance for an extended, indefinite period. A scheduled scan merely re-discloses the issue; it does not reduce exposure, patch the vulnerability, or shorten the window in which an attacker can exploit the flaw. Formal risk acceptance is only defensible when the organization understands the threat, has limited residual risk, and establishes compensating monitoring, not as a passive default.

• ✓

  Apply compensating controls such as strict access filtering, MFA, enhanced logging, and alerting.

  Why this is correct

  When a patch is unavailable, the best short-term treatment is to reduce exposure and add monitoring. Tight access control, MFA, and logging do not remove the vulnerability, but they can meaningfully lower the likelihood of exploitation and improve detection. This is the correct operational response when the service must remain online and a permanent fix is not yet available.

• ✗

  Disable all logging so the appliance performs better under load.

  Why it's wrong here

  Disabling logging on the vulnerable appliance removes your primary source of forensic evidence, making it nearly impossible to determine if the remote code execution was attempted or succeeded, or to scope the damage during incident response. This action provides no security benefit whatsoever and the performance gain is negligible and irrelevant compared to the criticality of the vulnerability. Without logs, alerting also fails, so you lose the very detection capability needed to catch exploitation in progress; this is directly contrary to the compensating-control approach required when a patch is unavailable.

• ✗

  Ignore the issue until the vendor confirms the vulnerability is being actively exploited.

  Why it's wrong here

  Ignoring the issue until the vendor confirms active exploitation is a dangerous misinterpretation of risk because attackers routinely discover and exploit vulnerabilities before any public evidence exists, and the appliance is directly exposed to the internet. The absence of a confirmed exploit today does not mean the flaw is inert; it may simply mean no one has reported it, while threat actors are actively scanning for vulnerable targets. A critical remote code execution flaw should be treated as an imminent threat, and you must assume potential compromise, so proactive mitigation—such as enhanced logging, alerting, access restrictions, and MFA—is essential, not optional.