SY0-701 Security Program Management and Oversight Practice Question
After implementing MFA and stronger monitoring, a department still has a small chance of account misuse that could affect a low-value internal tool. The business owner reviews the remaining exposure and agrees it is within tolerance. What should happen next?
⚠ Common exam trap
Many candidates think all risk must be eliminated or that monitoring alone suffices, but CompTIA tests the understanding that residual risk can be accepted when it falls within the organization's risk appetite, especially for low-value assets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the residual risk and obtain formal acceptance from the risk owner.
After implementing MFA and stronger monitoring, the remaining exposure is residual risk that must be formally documented and accepted by the risk owner (the business owner). This aligns with the risk management process in Security Program Management, where residual risk that falls within the organization's risk appetite is accepted rather than eliminated. The business owner's agreement indicates formal acceptance, which should be recorded for audit and compliance purposes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Escalate the issue to legal because all residual risk must be eliminated.
Why it's wrong here
Residual risk is an expected byproduct of any control implementation; eliminating all risk is neither feasible nor necessary. Escalating to legal is only warranted when specific regulatory or contractual obligations are violated, not as a blanket response to residual exposure. Moreover, legal cannot accept risk on the organization's behalf—that responsibility rests with the risk owner, who must formally document and approve the remaining exposure.
- ✓
Document the residual risk and obtain formal acceptance from the risk owner.
Why this is correct
When controls have reduced the likelihood and impact but some exposure remains, the remaining risk should be documented and formally accepted by the appropriate risk owner. This creates accountability, supports governance, and shows that the organization knowingly approved the remaining exposure after considering business value, cost, and tolerance.
- ✗
Remove MFA because the remaining risk is already low.
Why it's wrong here
Removing MFA after observing a low residual risk would unilaterally increase the organization's attack surface, undermining the security posture. A low residual risk means the control is working, not that the control is expendable; re-evaluation should occur only if a new risk assessment shows the control is no longer cost-effective or introduces unacceptable friction. The appropriate action is to keep the control and formally accept the small remaining risk, not revert to a weaker state.
- ✗
Treat the issue as resolved because monitoring alone eliminates all risk.
Why it's wrong here
Monitoring is a detective control that shortens response time and helps contain incidents, but it does not prevent or eliminate the underlying vulnerability. Treating the issue as resolved ignores that a threat event still has a probability of occurrence, and the organization remains exposed to impact. Residual risk persists even with monitoring, so it must be formally identified, documented, and accepted by the risk owner, not simply dismissed.
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Risk management
Risk management is the process of identifying, assessing, and controlling threats to an organization's capital, earnings, and operations, including IT systems and data.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.