SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The medium flaw on the isolated lab system, because all vulnerabilities should be fixed in alphabetical order.

  Why it's wrong here

  Selecting vulnerabilities for remediation alphabetically ignores the core tenet of risk management: prioritize by likelihood of exploitation and magnitude of business impact. A medium-severity flaw on an isolated lab system typically has minimal attack surface and low value at risk, whereas a critical flaw exposed to the internet can be chained into system compromise or data exfiltration. Remediation order should be driven by business risk, not lexicographic order.

• ✓

  The critical flaw on the public-facing server, because it has higher business risk.

  Why this is correct

  The critical flaw on the public-facing server is the clear first priority because the combination of high severity and direct internet exposure dramatically increases both the probability of exploitation and the potential business impact. Critical vulnerabilities often have publicly available proof-of-concept exploits or are leveraged in automated attacks, so the remediation window is short. Addressing this server first reduces the likelihood of a successful attack that could affect customers, brand reputation, or regulatory compliance.

• ✗

  Both systems can wait until the next quarterly patch cycle.

  Why it's wrong here

  Deferring a critical public-facing vulnerability to the next quarterly patch cycle leaves a known exploit avenue open for an extended period, which is contrary to security best practice for high-risk findings. Many critical vulnerabilities are exploited within days or hours of disclosure, making a static quarterly window dangerously slow. Organizations should implement an emergency change advisory or out-of-band patching process for critical internet-facing assets to close the vulnerability before it is weaponized.

• ✗

  The lab system, because internal systems always outrank external systems.

  Why it's wrong here

  The assumption that internal systems always outrank external systems is flawed because risk is a function of exposure, asset value, and existing compensating controls. An internal lab system might be isolated and accessible only to a small set of authenticated users, whereas an external server faces constant scanning and attack attempts. Moreover, the lab system may not hold sensitive data, so the business impact of a compromise could be negligible. Risk prioritization must consider the actual threat landscape and the criticality of the asset to the organization's mission.

Go deeper

Related to this question