SY0-701 Question 16
Single answerGap analysisA healthcare company is preparing for an external assessment against its internal security baseline and applicable regulatory requirements. The security manager has collected the current state of technical and administrative controls, documented the target state required by policy and compliance obligations, and now needs to identify where the organization falls short so leadership can prioritize remediation. Which process should the security manager perform NEXT?
- A
Gap analysis
- B
Penetration testing
- C
Vulnerability scanning
- D
Regression testing
Show answer and explanation
Correct answer: A
Explanation
The best answer is gap analysis. In Security+, gap analysis is used to compare an organization's current security posture with a desired state, such as internal policies, contractual obligations, or external frameworks and regulations. This process is commonly performed before remediation planning because leadership needs a clear view of what controls are missing, partially implemented, or ineffective. In real environments, the output often maps deficiencies to risk, cost, and remediation timelines. This aligns with common practices described in security governance and risk management guidance such as the NIST Cybersecurity Framework and NIST SP 800-53/800-171 assessment approaches, where organizations assess current implementations against required controls and identify deficiencies before developing plans of action and milestones.
- A. Correct.
Correct. A gap analysis compares the current state of security controls and processes against a desired future state, such as an internal baseline, framework requirement, or regulatory obligation. In this scenario, the manager has already documented both the current and target states, so the next step is to identify gaps between them and use those findings to guide remediation planning and prioritization.
- B. Incorrect.
Incorrect. Penetration testing is used to simulate attacker behavior to exploit weaknesses in systems and applications. While it can help validate technical exposures, it does not directly compare current organizational controls against a target security baseline or compliance requirement. Someone might choose this because penetration testing can uncover weaknesses, but it is narrower and more attack-focused than the broader control comparison described here.
- C. Incorrect.
Incorrect. Vulnerability scanning identifies known technical weaknesses such as missing patches, insecure configurations, or exposed services. It is useful input into a broader security program, but it does not by itself measure administrative, procedural, and technical differences between the current state and required state. This distractor is plausible because scans often support assessments, but the scenario asks for the process of identifying shortfalls against defined requirements.
- D. Incorrect.
Incorrect. Regression testing is typically used in software development and quality assurance to verify that recent code changes did not break existing functionality. It is not the appropriate process for comparing present security controls to a desired control framework or compliance baseline. A candidate might select this if they confuse testing terminology, but it does not fit the governance and assessment context.