Continuous Risk Treatment: Why an Email Gateway Mitigates Phishing

SY0-701 By islever Editorial Last updated

Explain processes used to manage risk. Given a scenario, select mitigation techniques or controls to secure an enterprise environment.

Short answer

A An email gateway that blocks phishing attempts is the always-on mitigation treatment for the continuous risk of phishing.

Question

Which of the following is an example of a treatment strategy for a continuous risk?
  1. Email gateway to block phishing attempts Correct Answer
  2. Background checks for new employees
  3. Dual control requirements for wire transfers
  4. Branch protection as part of the CI/CD pipeline

Key Takeaways

It tests whether you can map a persistent threat such as phishing to an always-on mitigation control rather than a one-time or transaction-specific control.

This SY0-701 practice question asks which control is a treatment strategy for a continuous risk; the email gateway that blocks phishing attempts (A) is the best fit because it continuously mitigates a persistent threat.

Common mistake: The most plausible wrong answer is D, branch protection in the CI/CD pipeline, because “continuous” appears in continuous integration; it is a valid code-change control but not the best example of treating a persistent risk like phishing.

Expert Analysis

The decisive concept is treatment, not tool category. In Security+ risk management, every option is a control, but a treatment strategy explains how the organization handles an identified risk: mitigate, transfer, avoid, or accept. The question adds the qualifier continuous, so the best option must be an always-on way to reduce a risk that persists rather than a one-time or per-transaction check. Phishing is a textbook continuous risk: it arrives constantly and cannot be eliminated by a single event. The email gateway in A is an always-on preventive/mitigating control that filters inbound messages, blocks known malicious senders and links, and reduces the likelihood of compromise. That makes A the clearest treatment strategy for a continuous risk.

Why the other options are weaker. B is a point-in-time control: background checks reduce hiring risk before employment, but they do not continuously treat an ongoing exposure. C is a transaction-level compensating control for wire fraud; dual control is valuable, but it is tied to discrete transfers rather than a continuous risk environment. D is a strong CI/CD safeguard that enforces reviews and prevents unauthorized code changes, but it is a process-specific change-control mechanism. Comments on this item split between A and D because “continuous” can be read as “CI/CD”; that reading confuses the pipeline’s ongoing nature with the risk being treated. If the stem asked for a control protecting the software supply chain or change management, D would be the better answer.

What flips the answer. If the scenario named code integrity, unauthorized commits or deployment risk as the continuous exposure, D becomes defensible. If the risk were fraudulent wire transfers, C would move to the front; if it were insider hiring risk, B. The operational consequence of choosing poorly is real: relying on a one-time check for a persistent phishing campaign leaves an ongoing path into the mailbox, while overfocusing on pipeline controls can leave the email vector untreated.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question uses a qualifier like “continuous,” test each option against that cadence: does it operate always-on, once, or per transaction? Eliminate point-in-time controls such as background checks and per-transaction controls such as dual control, then choose the durable preventive control that maps to the persistent threat. If two options seem continuous, prefer the one tied to a recognized continuous risk like phishing over a process-specific CI/CD safeguard.

Frequently Asked Questions

Why isn't branch protection the answer if CI/CD is continuous?

Branch protection is a strong code-change control, but the question asks for a treatment of a continuous risk like phishing. CI/CD is a process, not the risk being treated in this stem.

What risk treatment strategy does an email gateway represent?

It is mitigation: it reduces the likelihood that phishing reaches users rather than transferring, avoiding, or accepting the risk.

How do continuous and one-time controls differ in risk treatment?

Continuous controls operate whenever the risk is present, while one-time controls such as pre-employment background checks address only a point-in-time exposure.

More SY0-701 FAQ →

Discussion 17 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 17

  1. Konversation 👍 8 Answered D
    Again a poor question by CompTIA. All 4 answers are continuous risks and corresponding treatment strategies. A. E-Mails are always a risk. (Phishing) B. New employees are always a security risk, since you don't know them- C. Dual Control is a must in Finance to reduce fraud. D. CI/CD pipeline reduces risks in code. And code is always vulnerable. The only think I can image is, that CompTIA tries to refer to "Integrated Penetration Testing" where they explain this concept related to CI/CD. Sec+ Student Guide . https://informer.io/resources/continuous-penetration-testing Good luck on the exam!
  2. Kamalt 👍 3 Answered A
    CompTIA Security+ Explanation In risk management, a treatment strategy refers to how an organization mitigates, transfers, accepts, or avoids risk. Continuous risks are threats that persist over time and require ongoing security measures. Phishing attacks are a continuous risk because cybercriminals frequently attempt to deceive users via email. An email gateway is a technical control that continuously scans, filters, and blocks malicious emails to reduce phishing attempts. Since phishing is an ongoing (continuous) threat, deploying an email gateway is a proactive treatment strategy to mitigate it. GPT
  3. MarysSon 👍 3 Answered A
    A is the better answer. Phishing attempts are a continuous risk. Email gateways provide automated and continuous protection. Continuous Integration/Continuous Delivery/Deployment fall under the software development life cycle.
  4. 78834d6 👍 1 Answered D
    Correct answer is D. The key phrase here is “continuous risk” — meaning a risk that persists over time, often due to ongoing processes, environments, or behaviors (like software development, CI/CD pipelines, or dynamic user activity). Why Option A Isn’t the Best Fit? A. Email gateway to block phishing attempts is: - A preventive control, not a treatment strategy. - Designed to stop phishing emails before they reach users, which is episodic — it reacts to individual threats, not a continuous development or operational risk. - While phishing is a recurring threat, the gateway itself doesn’t treat or mitigate the underlying risk behavior (e.g., insecure development practices or misconfigurations in a pipeline). Why Option D Is Better? D. Branch protection in CI/CD pipelines: - Directly addresses continuous risk in software development. - Implements treatment by enforcing secure coding practices, code reviews, and automated testing. - It’s proactive and ongoing, aligning perfectly with the nature of continuous risk.
  5. adea45d 👍 1 Answered D
    The key idea is continuous risk = risk that exists and must be managed on an ongoing, automated, or persistent basis, not just at a single point in time. A. Email gateway → continuous control, but typically categorized as a preventive/detective security control, not specifically tied to continuous risk treatment strategy design in processes. B. Background checks → one-time (point-in-time) control. C. Dual control for wire transfers → transaction-based control, not continuous monitoring. D. Branch protection in CI/CD → automated, always-on enforcement integrated into a continuous process → directly aligns with continuous risk treatment. Correct answer: D. Branch protection as part of the CI/CD pipeline
Show 12 more comments
  1. test_arrow 👍 1 Answered D
    D. Branch protection as part of the CI/CD pipeline Explanation: A continuous risk refers to an ongoing or persistent risk that must be actively managed over time. Branch protection in a CI/CD pipeline helps mitigate continuous risks related to software development, such as unauthorized code changes, vulnerabilities, and misconfigurations. By enforcing rules like required code reviews and automated security checks, organizations continuously manage risks in their development workflow.
  2. oreinn 👍 1 Answered A
    Since the question asks for “an example” of a treatment strategy for a continuous risk, we can select the option that most clearly represents an ongoing, automated, or systemic control. A. Email gateway to block phishing attempts is a strong example because phishing is a well-known continuous threat, and email gateways operate continuously to filter threats in real-time, making it a clear and widely recognized treatment strategy.
  3. itone333 👍 1 Answered A
    In reality D, but for comp tia it’s understandably A. As dual control requirements for wire transfers While this is a control for an ongoing process, CompTIA classifies this as a procedural control for a non-continuous or discrete risk as to where A is an auto preventable control to block phishing daily attempts. If you’re thinking D, you are thinking correctly for irl but you gots to think like CompTIA for now.
  4. trac0420 👍 1 Answered A
    • Why A is correct: A continuous risk is an ongoing, persistent threat that is consistently present in an organization's day-to-day operational environment. Phishing attacks occur constantly and unpredictably at all times of the day. Implementing an email gateway acts as a technical, always-on mitigation control that continuously monitors, filters, and blocks incoming threats before they reach end-users.
  5. Tony322 👍 1 Answered A
    Continuous risks are risks that are persistent and ongoing, such as: Phishing Malware Data leakage Unauthorized access attempts Using an email gateway to filter inbound messages, check for malicious links, and block known bad senders is an example of a proactive, technical control that continuously mitigates the risk of phishing.
  6. marluk 👍 1 Answered A
    Rather A. I found in compita coursebook: "Continuous risk assessments constantly evaluate risks and are supported by specialized tools that produce real-time data, such as agent-based vulnerability scanning platforms and intrusion detection systems. " Email gatway is specialized tools that produce real-time data.
  7. 5a11b63 👍 1 Answered A
    Phishing is an ongoing risk, and an email gateway continuously monitors and blocks malicious emails, making it an active treatment strategy for a continuous threa
  8. nocwyn 👍 1 Answered D
    Branch protection in a CI/CD pipeline helps prevent: Unauthorized code changes Introduction of insecure or vulnerable code Supply chain attacks
  9. VoidDrive 👍 1 Answered D
    It's CI/CD - not for any good reason though. It's just CompTIA's way of testing if you know what CI/CD means. It's a crap question.
  10. Hyper01 👍 1 Answered A
    Continuous risks require continuous defenses — therefore, the email gateway is the best example.
  11. ef74e4b 👍 1 Answered A
    ChatGPT says A.
  12. xcom46 👍 1 Answered A
    A is the answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide