FirstTry

Objective 5.2

SY0-701

Explain elements of the risk management process

Objective 5.2 sits in Security Program Management and Oversight, which carries 20% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.

Objective title verbatim from the official objectives. CompTIA exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

5-2Security Program Management and Oversight

Which term names the overall process of identifying, assessing, and responding to threats or events that could affect an organization's objectives?

Risk appetite set by senior leadership for the organizationAppetite is a predefined acceptable loss level, not the process of identifying and responding to threats.
Risk register documenting and tracking identified risks over timeA register logs individual risks; it is a tool used within the process, not the process itself.
Risk tolerance thresholds applied to specific systems or processesTolerance is a threshold for variation, not the overall identify-assess-respond process.
Threat modeling performed during the application design phaseThreat modeling is a structured technique focused on system design, narrower than enterprise risk management.
Risk management practiced across the enterprise's business unitsCorrect · your answerCorrect: this is the overarching process being described.

Correct.

Checked against cheatsheetseries.owasp.org, July 2026

Concept

Risk management is the overarching process of identifying, assessing, and responding to threats or events that affect organizational objectives.

Why E

The described activity, spanning identification through response across the enterprise, matches risk management itself rather than any single artifact or subset of it.

Source

Risk management is the process of identifying, assessing, and responding to threats or events that can impact company or customer objectives.

Microsoft Learn: Governance, risk, and compliance, checked July 2026
#risk management#definition#governance

Now you: objective 5.2 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

5-2Security Program Management and Oversight

An online service's engineering team reviews whether existing security controls are properly designed and operating as intended, using methods shared across the company. This best illustrates which risk management element?

Sample question 2 of 3

5-2Security Program Management and Oversight

A governance team updates its control framework after reviewing penetration test results, security incident data, and new regulatory requirements. Which risk management element primarily drove this update?

Sample question 3 of 3

5-2Security Program Management and Oversight

Before ranking any threats, a team builds diagrams showing trust boundaries, data flows, and external entities interacting with a new application. This modeling step primarily supports which later risk management activity?

That’s 3 of the full Security+ bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Security Program Management and Oversight