CompTIA SY0-701 Bundle

A $6,000 loss would use an exposure factor of 0.03, but the scenario states 30% damage. With an asset value of $200,000, this choice understates the financial impact of one incident by a factor of ten.

The $140,000 amount is the value remaining after a 30% loss, not the damage sustained. Single loss expectancy counts the $60,000 lost portion, rather than the 70% of the asset that survives.

A $200,000 single-event loss assumes destruction of the entire asset, corresponding to a 100% exposure factor. The stated event affects 30% of its value, so treating the incident as a total loss contradicts the scenario.

$200,000 incorrectly multiplies the single-event loss by four years. Annualized loss instead uses the 0.25 annual occurrence rate, because one event is expected in four years. On Two hundred thousand dollars results from multiplying the $50,000 loss by four rather than dividing by the four-year recurrence interval. It treats one event per four years as four events each year, reversing the annual frequency.

$2,000 assumes a far lower event frequency than the scenario supports. The expected rate is one fourth of an event each year, not one twenty-fifth of an event. On Two thousand dollars is not supported by either the loss estimate or the one-in-four-year frequency. An annual estimate requires multiplying $50,000 by 0.25, not introducing an arbitrary lower fraction.

$50,000 is the single-event loss (SLE), and is correct for the damage from one occurrence. However, the question asks for a per-year average across a four-year recurrence interval. On Fifty thousand dollars is the loss if the event occurs once, called SLE. Reporting it as yearly exposure assumes one event per year despite the stated expected frequency of once in four years.

An ARO of 1 means approximately one damaging occurrence in each year. The stated historical recurrence interval is ten years, so an annual rate of one is ten times the supported estimate.

Ten events per year would imply an event roughly every 1.2 months, not once per decade. The number ten describes years between expected occurrences; it is not an annual incident count.

An annualized rate of 0.01 corresponds to an expected frequency of one event in one hundred years. The case specifies a ten-year interval, so this option understates the historical annual rate by a factor of ten.

Its output informs recovery priorities and tolerable downtime. A business impact analysis examines consequences of disrupted business functions, dependencies and acceptable recovery outcomes. Its findings can inform a risk matrix, but simply ranking arbitrary threat scenarios by low/medium/high likelihood and impact is not a complete BIA.

It warns of growing exposure before an incident. An overdue-critical-fix trend is a key risk indicator that signals increasing exposure over time. It is a specific measurable early warning, not the overall qualitative assessment method used to assign the committee's scenario categories.

That directly supports the CFO’s budget comparison. Quantitative risk analysis uses numeric probabilities, loss magnitudes and sometimes exposure frequency to calculate estimated financial risk. The stated low/medium/high descriptions do not provide numbers needed to estimate expected annual loss.

Its output informs recovery priorities and tolerable downtime. A BIA identifies critical services and the consequences of their interruption, such as downtime impact and dependencies, but it may not calculate probability-weighted yearly loss from a specific threat. The CFO's request explicitly asks for that monetary exposure estimate.

It does not require an expected dollar loss. A qualitative matrix helps prioritize severity from relative likelihood and impact, but labels such as high or moderate cannot directly justify the financial comparison between an expensive control and the expected cost of risk.

Impact-based prioritization puts vital business functions ahead of low-consequence findings, which informs remediation sequencing. It does not, by itself, produce the requested annual dollar loss estimate for a mitigation business case. Prioritizing by business harm informs remediation order, whereas the CFO specifically needs monetary expected-loss estimates to compare the proposed mitigation with its cost.

Insurance would only transfer some consequences. Avoidance would stop the risky activity entirely, for example by retiring the application or discontinuing access. The company still permits users to authenticate and use the service; it has strengthened the authentication safeguard instead.

Neglect is not acceptance. Acceptance is a documented decision to tolerate residual exposure within authorization limits without introducing further economically justified controls. Adding FIDO2 or equivalent MFA is an active risk-reduction investment, not simple acknowledgment of the original likelihood. Acceptance would document willingness to tolerate an unmitigated exposure; deploying stronger MFA actively changes the probability of attack success.

Risk transfer reallocates some financial consequences through insurance or contract; it does not itself make phishing attacks harder. Authentication hardening reduces technical likelihood while the organization retains responsibility for accounts. Buying financial coverage can shift some breach costs, but it cannot replace the phishing-resistant login control that reduces compromise likelihood.

Insurance or another contractual transfer may cover some financial consequences, but it would leave the vulnerable service running. The organization chose to end the activity entirely, so the risk treatment is not transfer. Purchasing insurance would transfer certain costs after failure; shutting the unsupported service eliminates the risky activity rather than compensating its financial aftermath.

Appetite and tolerance set boundaries for deciding which residual exposures may be accepted. They do not describe the operational action of shutting down a risky application; that action is the central evidence in the stem. Appetite and tolerance describe authorized exposure limits, but the organization has made an operational choice to discontinue the unsupported service.

Mitigation would keep the service active while adding restrictions, monitoring or patches to reduce exposure. The company instead terminated the unsupported service, removing the activity that presented the specific attack surface. Hardening or patching would reduce the service risk while operating it; the firm instead removes the service and its exposure entirely.

An analyst should not silently accept it. An owner may still approve and monitor residual loss, but the risk treatment described is purchasing coverage for defined consequences. Escalation is governance around that decision, not the main mechanism by which financial burden is shared.

Insurance would only transfer some consequences. Avoidance would require discontinuing the underlying business or service. The company explicitly retains network operations and technical controls, so the loss event can still occur despite the insurance contract. Avoidance would require discontinuing the activity that creates exposure, whereas this company still operates the network under existing controls.

Technical mitigation lowers likelihood or impact through stronger safeguards such as segmentation or MFA. Those protections remain, but the *new* step is a financial contract allocating residual breach costs rather than a new security control. Mitigation includes controls that reduce compromise likelihood; the scenario instead asks how a separate contractual policy handles financial consequences that remain.

Mitigation introduces controls to lower likelihood or impact. The scenario says further safeguards have no justified economical value for the low-impact test system, so the chosen action is not another protective measure. Installing an expensive new control is not justified solely because a small residual risk exists; the decision must consider proportional benefit.

Appetite and tolerance define limits for decisions; they are not themselves a response to this specific test system. The owner must consciously accept, monitor and document the residual exposure within those limits. Comparing broad appetite with a numerical tolerance is a different governance distinction from this owner’s documented decision to carry a particular low-impact risk.

Insurance would only transfer some consequences. Avoidance means discontinuing the activity, such as shutting down the test platform. Here the organization intends to keep the internal system operating while carrying its small approved residual risk. Shutting the internal test activity would eliminate exposure, whereas the approved owner is explicitly retaining it without adding uneconomic safeguards.

An analyst should not silently accept it. Escalation is triggered when a risk metric breaches a defined threshold, but the question first asks to distinguish strategic posture from a service-level numerical boundary. No actual outage exceeding that limit has been reported yet.

Neglect is not acceptance. Acceptance concerns a particular risk being consciously retained by an authorized owner. Saying leadership is conservative does not automatically approve any specific service outage, and it does not explain why the published limit is a tolerance.

Mitigating through redundancy or resilient architecture might be appropriate to keep downtime within tolerance, but the given facts define concepts rather than describe installation of a new control. Adding a technical safeguard might reduce downtime probability but does not explain the stated difference between strategic appetite and an explicit outage limit.

Technical mitigation may be part of an approved response after escalation, but operating teams should not unilaterally accept or choose the treatment for a supplier risk above board-authorized limits. Governance ownership determines the next decision. Installing safeguards may be one future treatment, but the immediate requirement is to escalate a residual score that already exceeds delegated authority.

Neglect is not acceptance. Documented acceptance can be permitted only within the assigned authority and the company's appetite. The stated residual score exceeds a board-authorized ceiling, so simple acceptance at a lower level violates the defined limit. No owner can accept the exposure merely as routine when its score is above the board-authorized limit; it must return for an authorized decision.

A risk register records the asset, event, likelihood, impact, owner, treatment and review timing. It supports traceability over time. A risk register should record the changed exposure and accountable owner, but creating a record alone does not authorize tolerance above the approved boundary. The threshold breach must be reported to the right decision maker.