SY0-701 Security Program Management and Oversight Practice Question
An operations manager states that the customer portal may be unavailable for no more than 15 minutes in a month before the issue must be escalated to executives. Which risk management concept does this statement describe?
⚠ Common exam trap
CompTIA often tests the distinction between risk appetite (broad willingness) and risk tolerance (specific measurable threshold), causing candidates to confuse the two when a numeric value is given.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk tolerance, because it sets a specific measurable threshold for acceptable impact.
Risk tolerance defines the specific, measurable deviation from risk appetite that an organization is willing to accept. The operations manager's statement sets a precise threshold—15 minutes of unavailability per month—before escalation is required, which is a classic example of risk tolerance in IT service management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk appetite, because it describes the organization’s overall willingness to take risk.
Why it's wrong here
Risk appetite is the broad, high-level amount of risk an organization is willing to take in pursuit of its overall objectives, expressed as a general statement of strategic direction. It is not calibrated to a specific service or metric, so a precise 15-minute outage threshold for the customer portal is a much narrower, objective boundary. Thus, while appetite may influence tolerance, the given threshold is a tolerance statement, not an appetite statement.
- ✓
Risk tolerance, because it sets a specific measurable threshold for acceptable impact.
Why this is correct
Risk tolerance is the specific, measurable limit an organization is willing to accept for a particular risk or service. In this case, the 15-minute outage threshold is a clear boundary that triggers escalation, so it is a tolerance statement.
- ✗
Risk transfer, because the business is moving the outage risk to another party.
Why it's wrong here
Risk transfer involves shifting the financial or operational burden of a risk to a third party, such as through insurance, indemnification clauses, or outsourcing, so that a loss experienced by the organization is borne by someone else. A downtime threshold that triggers escalation does not move any of the portal outage risk to another party; the organization still experiences the outage and its consequences. Consequently, this is an internal acceptance threshold, not a transfer treatment.
- ✗
Risk avoidance, because the organization is eliminating the portal risk completely.
Why it's wrong here
Risk avoidance means intentionally eliminating the activity or condition that generates the risk, such as decommissioning the customer portal or redesigning it to remove the failure mode entirely, thereby making the risk nonexistent. Allowing the portal to remain operational with a 15-minute outage limit and an escalation procedure explicitly accepts a finite amount of residual risk rather than removing it. Therefore, this scenario is the opposite of risk avoidance, which would require ceasing the portal service altogether.
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Risk tolerance
Risk tolerance is the amount of risk an organization or individual is willing to accept in pursuit of its objectives, defining the boundary between acceptable and unacceptable losses.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.