What Operational Risk Is Associated With Conducting a Vulnerability Assessment?

SY0-701 By islever Editorial Last updated

Short answer

A A disruption of business operations

Question

Which of the following is a risk of conducting a vulnerability assessment?
  1. A disruption of business operations Correct Answer
  2. Unauthorized access to the system
  3. Reports of false positives
  4. Finding security gaps in the system

Key Takeaways

The question tests your ability to distinguish between a data quality outcome (false positives) and a direct operational impact (service disruption) when executing vulnerability scans.

This question evaluates understanding of the operational side effects caused by active security scanning. Community consensus confirms that while false positives are common reporting artifacts, the primary execution risk is unintended disruption to business availability.

Common mistake: Candidates often choose false positives because they are a frequent characteristic of automated tools, but they incorrectly classify a reporting inaccuracy as an operational risk rather than a triage challenge.

Expert Analysis

Core Concept: Availability Impact During Scanning

Conducting a vulnerability assessment involves actively probing systems, networks, and applications to identify weaknesses. Depending on the scanning tools and techniques employed, these processes can inadvertently consume significant bandwidth, CPU, or memory resources. As one community member highlighted, a poorly configured scanner targeting printers for vulnerabilities once triggered mass printing jobs, demonstrating how easily scans can spill over into operational chaos. Another candidate emphasized that technicians must inform clients before scanning precisely to manage these availability expectations. This directly threatens the availability pillar of the CIA triad, making business operation disruption the most accurate description of an execution risk.

Why the Other Options Are Incorrect

False positives represent a reporting accuracy issue rather than an operational risk. While they increase analyst workload and require careful validation, they do not interrupt live services or degrade performance. Community feedback correctly notes that false positives are evaluated and filtered out during the subsequent remediation phase, whereas service disruption requires immediate incident response. Unauthorized access is a potential consequence of a successful penetration test or credential compromise, not a standard vulnerability assessment, which is typically non-destructive and read-only. Finally, finding security gaps is the explicit objective and desired outcome of the assessment, not a risk.

Exam Context & Mitigation Strategies

CompTIA frequently tests the balance between security posture improvement and operational continuity. In real-world scenarios, administrators schedule vulnerability scans during maintenance windows, throttle scan rates, and exclude critical production systems from certain test types to prevent downtime. Recognizing that "risk" in this context refers to tangible business impact helps eliminate distractors focused on data accuracy or theoretical threats.

Official Reference

https://csrc.nist.gov/publications/detail/sp/800-115/final

This link opens the official vendor documentation in a new tab.

Exam Strategy

When CompTIA asks for a "risk" of a security activity, immediately map each option to the CIA triad to see which one threatens confidentiality, integrity, or availability. Avoid selecting answers that describe expected outcomes, analytical challenges, or theoretical attack vectors unless the question explicitly focuses on attacker perspectives.

Community Votes

A
67%
C
33%

67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. fab34 👍 5 Answered A
    Its A because it asks specically for the RISK in a vunerability assessment. A False Positive is just a result of a vulnerability assessment.
  2. laternak26 👍 4 Answered C
    NOT A disruption of business operations: Vulnerability assessments, when properly conducted, should not cause significant disruptions to business operations.
  3. AndyK2 👍 2 Answered C
    A false positive in a vulnerability assessment occurs when the assessment tool incorrectly identifies a security vulnerability that doesn't actually exist. This is a common risk in vulnerability assessments for several reasons: Vulnerability scanning tools can sometimes misinterpret system configurations or software characteristics Automated tools may not have perfect accuracy in detecting real security weaknesses A. A disruption of business operations: Vulnerability assessments are typically designed to minimize operational disruption and are usually conducted with minimal impact on ongoing business activities.
  4. 9ef4a35 👍 2
    A. A disruption of business operations. Conducting a vulnerability assessment involves actively scanning and probing systems for weaknesses. This process can sometimes result in unintended consequences, such as: System instability. Network performance degradation. Disruption of critical business operations due to overly aggressive scanning. This makes disruption of business operations a key risk associated with vulnerability assessments.
  5. 585402e 👍 2 Answered A
    Having FP in your report does not constitute a risk as you will later evaluate the findings from the VA. On the other hand, VA can cause business disruption. A characteristic example is the VA that was performed on our company’s printers, which caused all the printer’s pages to be printed while the scanner was checking for Log4j vulnerabilities.
Show 6 more comments
  1. 9149f41 👍 2 Answered A
    Some vulnerability scans may interrupt or block particular services; that's why the technician must inform the client before starting the scan.
  2. 3b6be6b 👍 2 Answered A
    It may impact performance of the systems
  3. musaabokisec 👍 1 Answered A
    GPT Conducting a vulnerability assessment involves scanning systems, applications, and networks to identify security weaknesses. Depending on the tools and techniques used, this process can sometimes inadvertently disrupt business operations by: Overloading systems with traffic during scans. Causing application crashes or service interruptions, especially if poorly configured or sensitive systems are involved. Triggering security defenses, such as intrusion prevention systems (IPS), that may block legitimate traffic or actions. While vulnerability assessments are essential for improving security, they carry the inherent risk of impacting the availability or performance of critical business services during the testing process.
  4. 3b6be6b 👍 1 Answered A
    A. A disruption of business operations: Conducting a vulnerability assessment involves scanning systems for weaknesses and potential security issues. Depending on the tools and techniques used, this process could inadvertently disrupt business operations. For example, some scans might consume significant system resources, cause performance degradation, or even trigger unintended issues like system crashes or downtime. This is a real risk of performing vulnerability assessments, especially in live or production environments.
  5. jacobtriestech 👍 1 Answered C
    A vulnerability assessment is a process of identifying, classifying, and prioritizing vulnerabilities in a system. While it's a valuable security practice, it can sometimes lead to false positives, which are security alerts that incorrectly identify a threat.
  6. e157c7c 👍 1 Answered C
    A vulnerability assessment is unlikely to cause a disruption of business operations. It is far more likely to generate false positives. C.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide