Question 894 of 1,013
SY0-701 Security Program Management and Oversight Practice Question
A company has two security issues to address this week. One is a public-facing login portal that uses default administrator credentials. The other is an internal lab system used only by one tester. Which issue should be prioritized first?
⚠ Common exam trap
The trap here is that candidates mistakenly prioritize based on ease of fix or treat all vulnerabilities as equal, rather than applying a formal risk assessment that weighs likelihood and impact to determine priority.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The public-facing login portal, because it has a higher likelihood and impact
The public-facing login portal with default administrator credentials is a critical risk because it is exposed to the internet, making it easily discoverable and exploitable by attackers. Default credentials are widely known and often targeted in automated attacks, leading to a high likelihood of compromise and potential impact such as data breach or system takeover. This aligns with risk management principles where priority is given to vulnerabilities with the highest risk score (likelihood × impact).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The internal lab system, because it is easier to fix quickly
Why it's wrong here
The speed of remediation does not determine priority; risk exposure does. An internal lab system is typically isolated from untrusted networks, so even if it contains a vulnerability, the attack surface is limited and the potential business impact is lower. Prioritizing by ease of fix rather than likelihood and impact can leave an internet-facing system exploitable.
- ✓
The public-facing login portal, because it has a higher likelihood and impact
Why this is correct
A public-facing login portal is directly reachable by any internet user, and default credentials mean an attacker can likely authenticate without any additional effort. This combination dramatically increases both the probability of successful exploitation and the business impact, such as unauthorized access, data breach, or account takeover. Immediate remediation is warranted because the system is exposed to untrusted users, making the risk both urgent and severe.
- ✗
Both issues have the same priority because they are both vulnerabilities
Why it's wrong here
Vulnerability severity and business risk are not determined solely by the presence of a vulnerability. Factors like exposure, exploitability, and potential damage differ widely; a lab system may be internal and non-critical, while a public portal is externally reachable and contains sensitive data. Treating all vulnerabilities equally leads to poor resource allocation and leaves the highest-risk systems unprotected.
- ✗
Neither issue should be addressed until the next annual review
Why it's wrong here
Deferring action on a known, exploitable vulnerability for up to a year violates the principle of timely risk mitigation and likely contradicts compliance or security policy requirements. An internet-facing system with default credentials is a critical risk that could be exploited at any moment, so waiting would be irresponsible. Regular reviews are not a substitute for prioritizing emergent high-risk issues that demand immediate attention.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.