SY0-701 Security Program Management and Oversight Practice Question

• A.Accept the risk without any additional controls
• ✓ B.Apply a compensating control, such as restricting access and monitoring traffic
• C.Delete the application so the vulnerability no longer exists
• D.Transfer the risk by telling users to work faster

Why B: Option B is correct because when a known vulnerability cannot be patched immediately, applying a compensating control—such as restricting network access via firewall rules (e.g., allowing only specific source IPs) and enabling deep packet inspection (DPI) or an intrusion prevention system (IPS) to monitor for exploit attempts—reduces the risk to an acceptable level without taking the application offline. This approach aligns with the principle of defense in depth, buying time until the vendor patch is available.

• ✓ A.Assign a named risk owner who is authorized to accept the residual risk.
• ✓ B.Set a clear expiration date and mandatory review point before renewal.
• ✓ C.Implement a compensating control such as network restriction or added monitoring.
• D.Rely on the vendor's promise that a better version will be available eventually.
• E.Approve an unlimited waiver so operations do not need to revisit the issue.

Why A: Assigning a named risk owner who is authorized to accept residual risk is a fundamental requirement for any risk exception. This ensures accountability and that a specific individual with the authority to accept the potential consequences of running an unsupported system is identified. Without a designated owner, the exception lacks governance and could lead to unmanaged exposure.

• A.Avoid the risk by shutting down the finance application immediately.
• ✓ B.Mitigate the risk by adding compensating controls and tracking residual risk until the patch is available.
• C.Transfer the risk by asking the vendor to guarantee that no incident will occur.
• D.Accept the risk because any delay in patching is automatically low priority.

Why B: Option B is correct because when a known vulnerability exists in a third-party component and patching is delayed, the best risk treatment is to implement compensating controls (such as network segmentation, WAF rules, or input validation) to reduce the likelihood or impact of exploitation. This approach allows the business to continue operations while actively tracking residual risk until the vendor releases the patch. It aligns with the NIST risk management framework, which prioritizes mitigation when avoidance is not feasible.

• A.Accept the risk without making any changes because the patch is not available yet.
• B.Avoid the risk by permanently shutting down the application.
• C.Transfer the risk to an insurance policy and wait for the patch.
• ✓ D.Implement compensating controls, such as tighter filtering and temporary restrictions, until the patch is released.

Why D: Option D is correct because when a critical patch is unavailable, the best short-term risk treatment is to implement compensating controls that reduce the likelihood or impact of exploitation. For a public-facing application, this could include deploying a web application firewall (WAF) with tighter rule sets, rate limiting, IP allowlisting, or temporarily disabling non-essential functionality. These controls provide a defense-in-depth layer until the vendor releases the patch, keeping the service online while reducing risk.

• A.Deny the request permanently and avoid discussing the business need
• ✓ B.Approve a documented temporary exception with compensating controls and a review date
• C.Immediately rewrite the policy so all users may use the unapproved application
• D.Ask the team to create a detailed step-by-step procedure for using the application

Why B: Option B is correct because it follows the principle of risk acceptance through a formal exception process. By documenting a temporary exception with compensating controls (e.g., data encryption, access logging, and usage monitoring) and setting a review date, the organization maintains security oversight while addressing the legitimate business need. This approach aligns with the SY0-701 domain of Security Program Management, which emphasizes balancing security with operational requirements through managed risk.