SEC+ SY0-701 V7 Security program management and oversight Runs in your browser · no setup Original practice · Review pending

Decide a supplier risk exception

Evaluate third-party evidence, assign risk ownership, and time-box an exception.

Estimated12 min

DifficultyIntermediate

Points8

Content record

Original practice · Review pending

Mapped to CompTIA SY0-701 objectives · Internal validation 2026-09-30 · Original ITForMe practice mapped to published objectives; not an official exam question. A named independent subject-matter expert has not yet verified the question and answer key.

Community review →

5.2Explain elements of the risk management process. 5.3Explain the processes associated with third-party risk assessment and management. 5.5Explain types and purposes of audits and assessments.

Show review record and official sources

Method: Clean-room scenario and answer key checked against Security+ SY0-701 objectives 5.2, 5.3, and 5.5; independent SME review remains pending.

Current-profile check: 2026-08-12 · Next review due 2026-11-16

Inspect the evidence

Use only the information provided to complete the tasks.

Supplier evidence

table

Item	State
Critical finding	Administrative portal lacks phishing-resistant MFA
Compensating control	Source-IP allowlist proposed
Owner	Payroll director
Retest	Not scheduled

Complete the response

Partial credit is available for matching, ordering, and multi-select tasks.

Changes will save automatically.

multi select

Select the FOUR elements required for a defensible exception decision.

4 pts

Named risk owner with authority to accept the residual risk Specific systems, identities, and allowed source paths Expiration date and remediation milestone Independent validation of the compensating control and a scheduled retest Automatic renewal until the supplier asks to close it Removal of the finding from future assessments

Need a hint?

Evaluate each option independently against the scenario evidence instead of treating the list as one decision.

Show another hint

Choose only options that directly satisfy the prompt; being generally true is not enough.

ordering

Order the exception lifecycle.

4 pts

Drag the rows or use the arrow buttons to reorder.

1 Assess likelihood, impact, scope, and alternatives
2 Document owner approval and compensating controls
3 Monitor the bounded access and remediation milestone
4 Retest and close, revise, or reject before expiry

Use this order as my answer

Need a hint?

Identify the prerequisite that must happen first and the verification or documentation that belongs last.

Show another hint

For the middle steps, ask what must already be true before each action can safely happen.

Ready to check your work?Unanswered tasks and matches earn no points. A partial submission is scored and saved in your history.

Persistent progress

Attempt history

Every submission is retained. Starting another attempt never replaces or unlocks the previous one.

No attempts yet

Your first submitted score and detailed answer review will appear here.

Community quality control

Question or answer look wrong?

Proposals and votes help staff prioritize review. They never change the scoring key automatically.

Full review queue →

No community corrections yet

Be the first to flag unclear wording, an answer-key issue, or a source that needs another look.

Propose a correction

Original practice · Review pending

Inspect the evidence

Complete the response

Review your result

Attempt history

Question or answer look wrong?