The correct answer is to mitigate the risk with compensating controls. This recommendation is strongest because the portal must remain available for 90 more days despite a high risk score and limited existing controls; mitigation reduces both likelihood and impact through measures like tighter access restrictions or additional monitoring, preserving business function while lowering exposure until migration is complete. On the Security+ SY0-701 exam, this scenario tests your ability to apply risk treatment options—mitigate, accept, avoid, transfer—to a real-world constraint where availability is non-negotiable. A common trap is choosing acceptance, which leaves a high-likelihood, high-impact exposure unprotected, or avoidance, which would shut down a required service. Remember the mnemonic “MACAT” for risk treatment: Mitigate, Accept, Compensate, Avoid, Transfer—and when a business function must continue but risk is high, compensating controls are your bridge.
SY0-701 Security Program Management and Oversight Practice Question
This SY0-701 practice question tests your understanding of security program management and oversight. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Risk register excerpt
--------------------------------------------------
Risk ID: R-19
Asset: Partner self-service portal on legacy VM
Likelihood: 4/5
Impact: 5/5
Current controls: firewall ACL, nightly backups
Business note: Portal must remain online for 90 more days until migration completes
Available budget: Compensating controls approved for this quarter
Based on the exhibit, what is the best risk treatment recommendation for the security manager?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Risk register excerpt
--------------------------------------------------
Risk ID: R-19
Asset: Partner self-service portal on legacy VM
Likelihood: 4/5
Impact: 5/5
Current controls: firewall ACL, nightly backups
Business note: Portal must remain online for 90 more days until migration completes
Available budget: Compensating controls approved for this quarter
A
Accept the risk because backups are already enabled.
Why wrong: Backups help recovery, but they do not reduce the likelihood or impact of a live compromise while the portal remains exposed.
B
Mitigate the risk with compensating controls until the migration is complete.
This is the best fit because the business must keep the service running, and approved budget exists for additional controls. Compensating controls can reduce exposure without shutting the portal down.
C
Avoid the risk by immediately retiring the portal.
Why wrong: Avoidance would remove the exposure, but it would also break a required business service before the planned migration is ready.
D
Transfer the risk by purchasing cyber insurance only.
Why wrong: Insurance can offset financial loss, but it does not lower the operational or technical risk of a portal compromise.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mitigate the risk with compensating controls until the migration is complete.
Mitigation is the strongest recommendation here because the portal must stay available for 90 more days, yet the risk score is high and existing controls are limited. Since the organization has budget for compensating controls, the manager should reduce likelihood and impact through measures such as tighter access restrictions, additional monitoring, or isolation. That preserves the business function while lowering exposure until migration is complete.
Why others are wrong: Accepting the risk leaves a high-likelihood, high-impact exposure in place without additional protection. Avoiding the risk would effectively shut down a required business service before the replacement is ready. Transferring the risk through insurance may help with financial loss, but it does not actually reduce the portal’s attack surface or the chance of disruption.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Accept the risk because backups are already enabled.
Why it's wrong here
Backups help recovery, but they do not reduce the likelihood or impact of a live compromise while the portal remains exposed.
✓
Mitigate the risk with compensating controls until the migration is complete.
Why this is correct
This is the best fit because the business must keep the service running, and approved budget exists for additional controls. Compensating controls can reduce exposure without shutting the portal down.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Avoid the risk by immediately retiring the portal.
Why it's wrong here
Avoidance would remove the exposure, but it would also break a required business service before the planned migration is ready.
✗
Transfer the risk by purchasing cyber insurance only.
Why it's wrong here
Insurance can offset financial loss, but it does not lower the operational or technical risk of a portal compromise.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Many certification questions include familiar terms but test a specific constraint. Read the exact wording before choosing an answer that is generally true but wrong for this case.
Detailed technical explanation
How to think about this question
This question should be treated as a scenario, not a definition check. Identify the problem, the constraint and the best action. Then compare each option against those facts.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
Use explanations to understand the rule behind the answer.
TExam Day Tips
→Underline the problem statement mentally.
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
Identify which SY0-701 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
Security Program Management and Oversight — This question tests Security Program Management and Oversight — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Mitigate the risk with compensating controls until the migration is complete. — Mitigation is the strongest recommendation here because the portal must stay available for 90 more days, yet the risk score is high and existing controls are limited. Since the organization has budget for compensating controls, the manager should reduce likelihood and impact through measures such as tighter access restrictions, additional monitoring, or isolation. That preserves the business function while lowering exposure until migration is complete.
Why others are wrong: Accepting the risk leaves a high-likelihood, high-impact exposure in place without additional protection. Avoiding the risk would effectively shut down a required business service before the replacement is ready. Transferring the risk through insurance may help with financial loss, but it does not actually reduce the portal’s attack surface or the chance of disruption.
What should I do if I get this SY0-701 question wrong?
Identify which SY0-701 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, what is the best risk response for the security team to recommend before the customer portal goes live?
medium
A.Accept the risk now, because the WAF rule lowers exposure enough for launch.
✓ B.Mitigate the risk by remediating the vulnerability before production release.
C.Transfer the risk to the hosting provider through a service-level agreement.
D.Avoid the risk by permanently canceling the customer portal project.
Why B: The exhibit shows a critical SQL injection vulnerability in the customer portal that has been partially mitigated by a WAF rule. However, WAF rules can be bypassed (e.g., through encoding tricks or HTTP parameter pollution), so the residual risk remains high. The best response is to remediate the vulnerability in the application code before launch, which directly removes the root cause and aligns with the principle of defense in depth.
Last reviewed: May 17, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.