SY0-701 Security Program Management and Oversight Practice Question
An engineering team requests a 30-day exception to use an unsupported browser plug-in on two workstations so a customer deliverable can be finished. Security agrees the business need is legitimate, but wants to reduce exposure. What must be included before the exception is approved?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A documented exception with an end date, compensating controls, and approval by the risk owner.
A documented exception with a defined end date, compensating controls, and risk-owner approval is the correct approach. Security exceptions should be controlled, reviewable, and temporary whenever possible. That structure shows the business need was acknowledged while ensuring someone has formally accepted the residual risk and the organization can reassess the exception before it becomes indefinite. Why others are wrong: A verbal approval is not enough for auditability or accountability. A standing waiver without a review date can quietly become permanent and increase exposure. A guideline does not authorize deviation from policy or provide the controls required for an exception process. The question is about formal exception handling, not informal advice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A verbal approval from the engineering manager and no additional documentation.
Why it's wrong here
Verbal approval alone is not sufficient for a security exception because it leaves no audit trail, no expiration date, and no evidence of risk acceptance. Temporary exceptions should be documented so they can be reviewed later and tied to specific compensating controls. Informal approval would make follow-up and accountability difficult.
- ✓
A documented exception with an end date, compensating controls, and approval by the risk owner.
Why this is correct
A proper exception should be documented, time-limited, and tied to risk ownership so the organization knows who accepted the exposure and when it must be reviewed again. Compensating controls help reduce the danger while the exception is active. This keeps the exception controlled rather than allowing an open-ended deviation from security requirements.
- ✗
A standing waiver that remains in place until the project finishes, with no review date.
Why it's wrong here
Open-ended waivers are risky because exceptions tend to become permanent when they are not revisited. Without a review date, the organization can lose track of whether the business need still exists or whether the risk has changed. Time-bounded exceptions are a key governance control, especially for unsupported software.
- ✗
A guideline reminding the team to avoid risky behavior when practical.
Why it's wrong here
A guideline is only advisory and does not provide the accountability needed for a formal security exception. This scenario requires an approved deviation from policy, not a suggestion. The organization needs clear ownership, a defined end date, and risk reduction measures so the exception can be managed responsibly.
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Guideline
A guideline is a recommended set of best practices or instructions that provide direction for implementing, managing, or governing IT processes, without being strictly mandatory or enforced like a policy.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.