The answer is to mitigate the risk by replacing or isolating the appliance and removing its direct internet exposure. This is correct because risk treatment mitigation directly reduces the likelihood of exploitation by eliminating the attack surface—in this case, the unpatched legacy file transfer appliance—which aligns with the defense-in-depth principle of layering controls. On the Security+ SY0-701 exam, this scenario tests your ability to prioritize immediate, actionable steps over passive options like acceptance or transfer; a common trap is choosing to accept the risk too early without first attempting to reduce it. Remember the mnemonic "MAAT" for the order of risk treatment options: Mitigate first, then Accept, Avoid, or Transfer—always look for a way to reduce the threat before deciding to live with it.
SY0-701 Security Program Management and Oversight Practice Question
This SY0-701 practice question tests your understanding of security program management and oversight. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Risk register excerpt:
- Risk ID: R-22
- Asset: Internet-facing file transfer appliance
- Finding: Unsupported firmware; vendor end-of-support was announced 9 months ago
- Likelihood: High
- Impact: High
- Current control: Basic password policy only
- Estimated cost to replace: $9,500 one-time
- Estimated cost to add WAF rules: $2,000
- Business note: The system processes customer tax documents and cannot be left exposed for a full quarter.
Based on the exhibit, which risk treatment should the security manager recommend first?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Risk register excerpt:
- Risk ID: R-22
- Asset: Internet-facing file transfer appliance
- Finding: Unsupported firmware; vendor end-of-support was announced 9 months ago
- Likelihood: High
- Impact: High
- Current control: Basic password policy only
- Estimated cost to replace: $9,500 one-time
- Estimated cost to add WAF rules: $2,000
- Business note: The system processes customer tax documents and cannot be left exposed for a full quarter.
A
Accept the risk and document it for the next quarterly review.
Why wrong: Acceptance leaves a high-likelihood, high-impact exposed system in place. That is hard to justify here.
B
Avoid the risk by permanently shutting down the file transfer service.
Why wrong: Avoidance removes exposure, but it also eliminates a business service that still has a stated operational need.
C
Mitigate the risk by replacing or isolating the appliance and removing direct internet exposure.
Mitigation is best because the asset is unsupported, internet-facing, and processes sensitive tax data. The cost to replace is manageable compared with the exposure. A WAF alone does not adequately protect an unsupported service, so the manager should reduce the vulnerability and exposure directly.
D
Transfer the risk by purchasing cyber insurance and keeping the current configuration.
Why wrong: Insurance can offset losses, but it does not reduce the vulnerable attack surface or stop exploitation.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mitigate the risk by replacing or isolating the appliance and removing direct internet exposure.
The exhibit shows a legacy file transfer appliance with direct internet exposure and known unpatched vulnerabilities. The most immediate and effective risk treatment is to mitigate the risk by replacing or isolating the appliance and removing its direct internet exposure. This directly reduces the likelihood of exploitation by eliminating the attack surface, which aligns with the principle of defense-in-depth and is the first step before considering acceptance, avoidance, or transfer.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Accept the risk and document it for the next quarterly review.
Why it's wrong here
Acceptance leaves a high-likelihood, high-impact exposed system in place. That is hard to justify here.
✗
Avoid the risk by permanently shutting down the file transfer service.
Why it's wrong here
Avoidance removes exposure, but it also eliminates a business service that still has a stated operational need.
✓
Mitigate the risk by replacing or isolating the appliance and removing direct internet exposure.
Why this is correct
Mitigation is best because the asset is unsupported, internet-facing, and processes sensitive tax data. The cost to replace is manageable compared with the exposure. A WAF alone does not adequately protect an unsupported service, so the manager should reduce the vulnerability and exposure directly.
Clue confirmation
The clue word "first" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Transfer the risk by purchasing cyber insurance and keeping the current configuration.
Why it's wrong here
Insurance can offset losses, but it does not reduce the vulnerable attack surface or stop exploitation.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse 'transfer the risk' (Option D) with a proactive security measure, when in fact cyber insurance is a financial risk transfer that does not address the technical vulnerability, whereas mitigation (Option C) directly reduces the likelihood of exploitation.
Detailed technical explanation
How to think about this question
In practice, legacy file transfer appliances often use protocols like FTP or SMB over the internet, which transmit credentials in cleartext or rely on outdated authentication mechanisms. Removing direct internet exposure can be achieved by placing the appliance behind a reverse proxy or VPNgateway that enforces modern encryption (e.g., TLS 1.3) and access controls, effectively reducing the attack surface without disrupting internal file transfers. This aligns with NIST SP 800-53 control SC-7 (Boundary Protection) and is a common first step in vulnerability management workflows.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
Security Program Management and Oversight — This question tests Security Program Management and Oversight — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Mitigate the risk by replacing or isolating the appliance and removing direct internet exposure. — The exhibit shows a legacy file transfer appliance with direct internet exposure and known unpatched vulnerabilities. The most immediate and effective risk treatment is to mitigate the risk by replacing or isolating the appliance and removing its direct internet exposure. This directly reduces the likelihood of exploitation by eliminating the attack surface, which aligns with the principle of defense-in-depth and is the first step before considering acceptance, avoidance, or transfer.
What should I do if I get this SY0-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "first". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.