ITForMe Sign in
SEC+ SY0-701 V7 Security operations Runs in your browser · no setup Preview · not independently reviewed

Drive a vulnerability remediation sprint

Prioritize risk with business context, choose defensible treatments, and prove remediation worked.

Estimated15 min
DifficultyAdvanced
Points12
Scenario brief

Northwind Print Cooperative has one four-hour maintenance window. The scanner severity is only one input: use exposure, active exploitation, asset function, compensating controls, and validation evidence to plan the work.

Content record

Preview · not independently reviewed

Mapped to CompTIA SY0-701 objectives · Internal validation 2026-08-13 · Available as preview practice, but a named independent subject-matter expert has not yet verified the question and answer key.

Community review →
4.3Explain various activities associated with vulnerability management.
Show review record and official sources

Method: Mapped to SY0-701 vulnerability-management objective 4.3; prioritization, remediation, exception, and validation logic were checked against NIST and CISA guidance.

Current-profile check: 2026-08-12 · Next review due 2026-12-15

01

Inspect the evidence

Use only the information provided to complete the tasks.

Validated findings

table
AssetFindingContextAvailable action
VPN-01Critical; vendor confirms active exploitationInternet-facing; employee remote access; no IPS signatureSupported security update
PRINT-04Critical; no known exploitationInternal printer VLAN; ACL blocks user-initiated accessFirmware update next quarter
CAD-17High local privilege escalationRestricted engineering workstation; standard user operates itSupported OS update
ARCHIVE-02Scanner reports old library versionPackage vendor backported the fix; advisory lists installed build as fixedDocument validated false positive

Change constraints

list
  • ›VPN-01 can fail over to VPN-02 during the window.
  • ›A tested configuration backup exists for VPN-01.
  • ›The security team can rescan assets and review logs after each change.
  • ›Risk acceptance requires an owner, expiration date, and compensating controls.
02

Complete the response

Partial credit is available for matching, ordering, and multi-select tasks.

01
single choice

Which finding should be the first remediation priority?

3 pts
Need a hint?

Restate the exact outcome or failure the prompt asks about before comparing choices.

Show another hint

Eliminate choices that solve a nearby problem, change more than requested, or do not fit the evidence.

02
matching

Match each finding to the most defensible immediate treatment.

4 pts
Need a hint?

Start with the row and choice that have the most distinctive purpose, then use that pair to narrow the rest.

Show another hint

For each remaining pair, explain the relationship in one sentence before selecting it.

03
ordering

Order the VPN-01 remediation workflow.

5 pts

Drag the rows or use the arrow buttons to reorder.

  1. 1 Confirm the finding, affected version, exposure, and vendor fix
  2. 2 Approve the change, backup, failover, test, and rollback plan
  3. 3 Fail over traffic and install the supported security update
  4. 4 Test remote access, confirm the running build, rescan, and review logs
  5. 5 Attach evidence, document residual risk, and close or reassign the finding
Need a hint?

Identify the prerequisite that must happen first and the verification or documentation that belongs last.

Show another hint

For the middle steps, ask what must already be true before each action can safely happen.

Ready to check your work?Submit to finish this session and review your feedback. Extra practice is optional.
Persistent progress

Attempt history

Every submission is retained. Starting another attempt never replaces or unlocks the previous one.

No attempts yet

Your first submitted score and detailed answer review will appear here.

Community quality control

Question or answer look wrong?

Proposals and votes help staff prioritize review. They never change the scoring key automatically.

Full review queue →
No community corrections yet

Be the first to flag unclear wording, an answer-key issue, or a source that needs another look.

Propose a correction