SY0-701 Security Program Management and Oversight Practice Question
A vulnerability scan identifies four issues across a small company. Which item should the operations team remediate first?
⚠ Common exam trap
The trap here is that candidates often focus solely on the severity score (critical vs. high) without considering the attack surface and exploitability, leading them to pick the critical flaw on the isolated laptop instead of the high-severity flaw on the internet-facing system.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A high-severity flaw on an internet-facing customer portal with public exploit code available
The internet-facing customer portal with a high-severity flaw and public exploit code presents the highest risk to the organization. The combination of high attack surface (exposed to the internet), high severity, and readily available exploit code means an attacker can easily compromise the system, leading to data breach, financial loss, or reputational damage. Remediation prioritization should follow risk-based principles, where likelihood and impact are both high.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A critical flaw on a disconnected training laptop that is used only in the lab
Why it's wrong here
Although the severity rating is high, the system is isolated and has very limited business exposure. The likelihood of external exploitation is low, so the overall risk is reduced compared with an exposed production system.
- ✓
A high-severity flaw on an internet-facing customer portal with public exploit code available
Why this is correct
This is the best choice because risk is driven by both likelihood and impact. An internet-facing system with public exploit code has a much higher chance of being attacked, and a customer portal can affect sensitive data and business operations. Even if another issue has a higher severity label, exposure and active exploitability make this item the most urgent business risk.
- ✗
A medium-severity flaw on an internal print server that stores no sensitive data
Why it's wrong here
This issue still matters, but its business impact is lower because the system is internal and does not hold valuable data. It is a reasonable remediation item, but not the first priority when compared with a public-facing system that attackers can reach directly.
- ✗
A low-severity flaw on an archive server scheduled for retirement next month
Why it's wrong here
A soon-to-be-retired system with a low-severity issue usually has lower practical risk than an actively used production service. It may still need tracking, but it is not the best first remediation target when more exposed systems are available.
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Vulnerability scan
A vulnerability scan is an automated process that checks systems, networks, and applications for known security weaknesses or misconfigurations.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.