SY0-701 Security Program Management and Oversight Practice Question
A project team needs to use an unapproved file-sharing application for two weeks because the approved platform cannot support an external client collaboration feature. What is the best security action?
⚠ Common exam trap
Many exam-takers choose Option D, thinking that a detailed procedure mitigates risk, but CompTIA tests the understanding that procedures without compensating controls do not reduce the inherent risk of using an unapproved application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Approve a documented temporary exception with compensating controls and a review date
It follows the principle of risk acceptance through a formal exception process. By documenting a temporary exception with compensating controls (e.g., data encryption, access logging, and usage monitoring) and setting a review date, the organization maintains security oversight while addressing the legitimate business need. This approach aligns with the SY0-701 domain of Security Program Management, which emphasizes balancing security with operational requirements through managed risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny the request permanently and avoid discussing the business need
Why it's wrong here
Denying the request outright and refusing to discuss the business need transforms security from an enabler into an inflexible gate, which often drives the project team to bypass the approval process altogether and adopt shadow IT. A permanent denial also eliminates any chance to apply compensating controls or a time-bound exception, violating the core security governance principle of balancing risk reduction with operational reality. Instead, the security team should engage the requester, understand the use case, and determine whether a documented, controlled exception is warranted.
- ✓
Approve a documented temporary exception with compensating controls and a review date
Why this is correct
A temporary exception is the best choice when a business need exists and the risk can be managed. Document the reason, identify compensating controls such as encryption or restricted access, assign an owner, and set an expiration date. That approach preserves governance, keeps the risk visible, and avoids turning a temporary deviation into an indefinite shadow process.
- ✗
Immediately rewrite the policy so all users may use the unapproved application
Why it's wrong here
Changing the policy for everyone is too broad for a short-term project need. A policy should not be modified simply to bypass controls for one team when a narrow exception can address the situation more appropriately.
- ✗
Ask the team to create a detailed step-by-step procedure for using the application
Why it's wrong here
Creating a step-by-step procedure only describes how to operate the application; it does not confer governance approval or authorize an unapproved tool. In fact, documenting the exact steps would tacitly legitimize the tool without a formal risk acceptance, which is the opposite of what the organization’s security policy requires. The real gap here is the missing exception with compensating controls and a review date—a procedure is only useful after that approval has been granted, not before.
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.