What Constitutes a Treatment Strategy for Continuous Risk?

SY0-701 By islever Editorial Last updated

Short answer

A Email gateway to block phishing attempts

Question

Which of the following is an example of a treatment strategy for a continuous risk?
  1. Email gateway to block phishing attempts Correct Answer
  2. Background checks for new employees
  3. Dual control requirements for wire transfers
  4. Branch protection as part of the CI/CD pipeline

Key Takeaways

It tests your capacity to differentiate between persistent operational threats requiring always-on technical safeguards and discrete or lifecycle-specific controls, preventing misapplication of DevSecOps concepts to general risk management scenarios.

This question evaluates your ability to match risk treatment strategies with ongoing, persistent threats. The community consensus identifies email gateways blocking phishing as the strongest example, given the automated and continuous nature of the control against frequently recurring attacks.

Common mistake: Many candidates choose CI/CD branch protection due to the word continuous, but this overlooks that branch protection is a development pipeline safeguard rather than a broad, organization-wide continuous risk treatment like anti-phishing infrastructure.

Expert Analysis

Understanding Continuous Risk in CompTIA Security+

In risk management, continuous risks refer to threats that persist over time and require ongoing, automated, or persistent mitigation strategies. Unlike discrete or periodic risks (e.g., annual audits or one-time background checks), continuous risks demand controls that operate without manual intervention to counter ever-evolving attack vectors.

Why Option A is Correct

Email gateways to block phishing attempts perfectly exemplify a continuous risk treatment. Phishing campaigns are relentless, constantly changing, and target users at any time. An email security gateway provides automated, real-time filtering using threat intelligence, URL rewriting, and attachment sandboxing. As noted by community experts, this control operates continuously to mitigate a persistent threat, aligning directly with CompTIA’s emphasis on technical safeguards for ongoing risks.

Why the Other Options Are Incorrect

  • Background checks (B) are a discrete/preventive control applied during hiring. While employee risk is ongoing, the treatment itself is a one-time event, not a continuous monitoring or mitigation strategy.
  • Dual control for wire transfers (C) is a procedural/fraud prevention control. It requires human intervention for each transaction and is designed to catch errors or malicious intent at specific points, rather than operating autonomously against a continuous threat stream.
  • Branch protection in CI/CD (D) is a strong distractor because it operates continuously within software development. However, CompTIA categorizes this under Application Security/SDLC controls rather than general enterprise risk treatment. As community commenters note, while it mitigates ongoing code vulnerabilities, it is scoped to the development pipeline, whereas email gateways address a broader, organization-wide continuous threat vector.

Exam Context & Community Consensus

The split vote (57% A vs. 43% D) highlights how SY0-701 questions sometimes blur lines between operational security and DevSecOps. CompTIA typically expects candidates to prioritize broad, automated technical controls when identifying continuous risk treatments. Phishing remains a top-tier focus area in the exam, making email security the canonical answer for continuous threat mitigation.

Official Reference

  • NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments (Continuous Monitoring)
  • CompTIA SY0-701 Objective 1.3: Threats, Vulnerabilities, and Mitigations

These links open the official vendor documentation in a new tab.

Exam Strategy

When you see keywords like continuous, immediately look for controls that operate automatically and persistently (e.g., firewalls, IDS/IPS, email gateways, EDR) rather than procedural or one-time checks. If multiple options seem valid, prioritize the one that addresses a broad, ongoing threat vector over niche or lifecycle-specific implementations unless the question explicitly focuses on software development.

Community Votes

A
57%
D
43%

57% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. Kamalt 👍 3 Answered A
    CompTIA Security+ Explanation In risk management, a treatment strategy refers to how an organization mitigates, transfers, accepts, or avoids risk. Continuous risks are threats that persist over time and require ongoing security measures. Phishing attacks are a continuous risk because cybercriminals frequently attempt to deceive users via email. An email gateway is a technical control that continuously scans, filters, and blocks malicious emails to reduce phishing attempts. Since phishing is an ongoing (continuous) threat, deploying an email gateway is a proactive treatment strategy to mitigate it. GPT
  2. Konversation 👍 1 Answered D
    Again a poor question by CompTIA. All 4 answers are continuous risks and corresponding treatment strategies. A. E-Mails are always a risk. (Phishing) B. New employees are always a security risk, since you don't know them- C. Dual Control is a must in Finance to reduce fraud. D. CI/CD pipeline reduces risks in code. And code is always vulnerable. The only think I can image is, that CompTIA tries to refer to "Integrated Penetration Testing" where they explain this concept related to CI/CD. Sec+ Student Guide . https://informer.io/resources/continuous-penetration-testing Good luck on the exam!
  3. test_arrow 👍 1 Answered D
    D. Branch protection as part of the CI/CD pipeline Explanation: A continuous risk refers to an ongoing or persistent risk that must be actively managed over time. Branch protection in a CI/CD pipeline helps mitigate continuous risks related to software development, such as unauthorized code changes, vulnerabilities, and misconfigurations. By enforcing rules like required code reviews and automated security checks, organizations continuously manage risks in their development workflow.
  4. MarysSon 👍 1 Answered A
    A is the better answer. Phishing attempts are a continuous risk. Email gateways provide automated and continuous protection. Continuous Integration/Continuous Delivery/Deployment fall under the software development life cycle.
  5. nocwyn 👍 1 Answered D
    Branch protection in a CI/CD pipeline helps prevent: Unauthorized code changes Introduction of insecure or vulnerable code Supply chain attacks

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide