The best answer is A. Sandboxing environment.
A USB drive associated with a ransomware attack should be treated as highly suspicious. To securely retrieve files without risking infection of production systems, the analyst should use a sandboxing environment. A sandbox provides an isolated environment where files can be opened, examined, and extracted while containing any malicious behavior.
This is the safest option because ransomware may execute automatically or contain hidden malicious payloads.
Why the other options are incorrect:
B). Intrusion prevention systemAn IPS monitors and blocks malicious network traffic. It does not provide a secure environment for opening files from a suspicious USB drive.
C). File integrity management toolFile integrity monitoring detects changes to files, but it is not designed to safely retrieve files from potentially malicious media.
D). Static code analysis toolStatic code analysis is used to inspect source code for vulnerabilities. It is not intended for safely interacting with suspicious files on removable media.
From the SY0-701 perspective, suspicious files and removable media should be handled in an isolated sandbox to reduce the risk of malware execution. Therefore, A is the correct answer.

Internal audits are conducted within an organization to independently assess and evaluate the effectiveness of internal controls, policies, and procedures. A key benefit of internal audits is the identification of control gaps or weaknesses that can then be remediated before they lead to security incidents or compliance failures.
Unlike external audits, internal audit findings are primarily for management and internal stakeholders, focusing on improving security posture and operational efficiency. Reports generated are formal and documented to ensure accountability, and internal audits do not replace the need for external audits, which provide independent verification to external parties like regulators or shareholders.
This role of internal audits in identifying deficiencies and driving remediation efforts is emphasized in the Security Program Management and Oversight domain of the SY0-701 exam#7:Chapter 5 CompTIA Security+ Practice Tests#.

The correct answer is A. Residual risk.
Residual risk is the risk that remains after safeguards, controls, or mitigation strategies have been applied. In some cases, a risk cannot be fully eliminated or mitigated. The organization must then decide whether to accept, transfer, avoid, or further manage the remaining risk.
This aligns with CompTIA Security+ SY0-701 risk management concepts, especially risk treatment, risk acceptance, risk tolerance, and residual risk.
Why the other options are incorrect:
B . Risk appetite
Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its objectives. It does not specifically describe a risk that remains after mitigation attempts.
C . Reviewed risk
This is not the best formal risk management term for a risk that cannot be mitigated.
D . Risk register
A risk register is a document or system used to track identified risks, risk owners, likelihood, impact, treatment plans, and status. It does not describe the remaining risk itself.
Therefore, a risk that cannot be fully mitigated is best described as residual risk.

The best answer is D. ARO.
ARO (Annualized Rate of Occurrence) measures how often a specific incident or event is expected to happen in a single year. This is the risk analysis attribute that directly represents yearly frequency.
Why the other options are incorrect:
A). RTORecovery Time Objective is the target time to restore operations after a disruption. It does not measure incident frequency.
B). ALEAnnualized Loss Expectancy estimates the expected yearly financial loss from a risk. It is calculated using other values and reflects cost, not frequency alone.
C). SLESingle Loss Expectancy is the monetary loss expected from one occurrence of an incident. It does not represent how often the event happens.
From the SY0-701 perspective, risk calculations often use:
ALE = SLE × ARO
Since the question asks how frequently an incident is expected to happen each year, the correct answer is ARO.