SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The medium-severity missing patch on the isolated lab VM.

  Why it's wrong here

  The isolated lab VM has no network access, so although a missing patch is a weakness, the attack surface is limited to physical or local attackers. The medium severity indicates moderate impact, but because the system is not reachable from the network, the likelihood of exploitation is dramatically reduced. Thus, it should not outrank an internet-exposed system with high-severity issues.

• ✗

  The low-severity outdated browser plug-in on the visitor kiosk.

  Why it's wrong here

  The visitor kiosk is likely a non-administrative, restricted-purpose system, and an outdated browser plug-in is rated low severity, meaning the potential impact is limited. Even if the plug-in has known vulnerabilities, exploitation typically requires user interaction and the kiosk may have software restriction policies. This finding, while worthy of attention, carries far less risk than a default credential on an internet-facing management interface.

• ✓

  The high-severity default credential on the management interface exposed to the internet.

  Why this is correct

  Default credentials on a management interface exposed to the internet represent a critical risk because they are publicly known, easily tested by automated tools, and provide immediate administrative access if successfully used. The internet exposure makes the vulnerability remotely exploitable without authentication, and a management interface often has elevated privileges, enabling full system control. This combination of high severity, high exploitability, and direct internet accessibility must be the top priority.

• ✗

  All three issues have the same priority because they were found in the same scan cycle.

  Why it's wrong here

  Prioritizing findings solely because they were found in the same scan cycle ignores the fundamental principles of risk assessment, where likelihood and impact outweigh scan timing. Severity, asset criticality, network exposure, and the presence of compensating controls all vary among the three findings, so they inherently have different urgency. Treating all findings equally could lead to fixing a low-risk issue while a critical internet-facing flaw remains exploitable.