SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Transfer the risk to a third party

  Why it's wrong here

  Transferring this risk to a third party, such as by purchasing cyber insurance or outsourcing the server's management, does not eliminate the underlying technical vulnerability. Insurance only covers financial loss after an incident, and a managed service provider would still need to secure the asset. Given the low likelihood and impact, paying a premium or vendor fees would likely exceed the cost of simply accepting the risk. Thus, transfer is not a financially or operationally appropriate response for a low-severity internal reporting server.

• ✓

  Accept the risk after documenting the decision

  Why this is correct

  When both likelihood and impact are low, and remediation would create more disruption than benefit, accepting the risk can be the most practical choice. The key is to document the rationale, obtain the appropriate approval, and revisit the decision later if the system or threat landscape changes.

• ✗

  Avoid the risk by shutting down the server permanently

  Why it's wrong here

  Avoiding the risk by permanently shutting down the server would eliminate the reporting service entirely, which is a disproportionate response to a low-severity risk. Risk avoidance is intended for situations where the risk exceeds the business benefit and no other cost-effective treatment exists. Here, the server presumably supports internal business functions, and the low likelihood/impact does not justify losing that capability. A permanent shutdown would also be irreversible and would require migrating or rebuilding the service if needed later, making it an impractical choice.

• ✗

  Mitigate the risk by immediately replacing the server

  Why it's wrong here

  Mitigating the risk by immediately replacing the server is an overly aggressive and costly response for such a low-severity finding. Replacing hardware might address a physical or performance issue, but does not necessarily remediate the root cause, which could be misconfiguration, outdated software, or a missing patch. A risk-based approach would first evaluate whether the existing controls already reduce the risk to an acceptable level. Since both likelihood and impact are low, the cost of replacement, downtime, and potential data migration outweigh the marginal security benefit, so acceptance is preferable.