SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Ignore the finding permanently because the package is installed

  Why it's wrong here

  Permanently ignoring the finding simply because the package is installed disregards the possibility that the vulnerable code path could become reachable after a future configuration change, feature toggle, or dependency update. Scanner signatures often rely on version numbers rather than actual exploitability, so a seemingly installed vulnerable library may only be dormant, but a later service restart or network exposure could activate the risk without any change to the software inventory.

• ✓

  Validate whether the issue is a false positive or lower-risk finding before prioritizing remediation

  Why this is correct

  Validating the finding first is the correct initial response because vulnerability scanners use heuristics and version matching that routinely produce false positives or conflate local attack requirements with remote exploitability. You should correlate the report against the actual running services, enabled modules, patch levels, egress/ingress filtering, and existing compensating controls; only then can you assign a realistic severity and decide whether remediation, a rescan, or an exception is warranted.

• ✗

  Immediately shut down the server without further investigation

  Why it's wrong here

  Immediately shutting down the server treats a scanner finding as conclusive evidence of active exploitation, which confuses the vulnerability management process with incident response. A critical-rated scanner finding indicates a condition that may become exploitable, not proof of an ongoing breach; a premature shutdown can cause significant business continuity damage and may also destroy volatile memory or log evidence if a security event had actually occurred.

• ✗

  Apply an exception without documenting any compensating controls

  Why it's wrong here

  Applying an exception without documenting compensating controls is an unjustified risk acceptance that violates standard governance, because exceptions must be based on a validated risk assessment, a written business justification, and defined compensating measures that reduce the risk to an acceptable level. Without this documentation, the organization cannot demonstrate due care in audits or defend the decision during an incident, and the exception will not automatically expire or be re-evaluated when the system or threat environment changes.