A county must choose risk-assessment cadences for three systems: a rarely changed archival land-record vault, a permitting app that ships monthly features, and a 911 CAD platform that changes configuration daily. Which pairing best matches assessment type to change rate and criticality?
Select an answer to reveal the explanation.
Short Explanation
Match the checkup schedule to how fast the patient changes and how vital they are. Dusty archives get occasional checkups; busy permitting gets regular ones; 911 that morphs daily needs continuous vitals monitoring.
Full Explanation
SY0-701 distinguishes ad hoc, one-time, recurring, and continuous risk assessment approaches so organizations can match cadence to how fast systems change and how critical they are. A rarely changed archival land-record vault is relatively stable; one-time or infrequent recurring assessment can remain appropriate if the threat landscape review is still scheduled. A permitting application that ships monthly features needs recurring assessments aligned to release or change cycles because the attack surface keeps shifting. A 911 CAD platform with daily configuration change and life-safety impact warrants continuous or near-continuous assessment and monitoring-driven reassessment. Continuous assessment for the archive, one-time assessment for 911 CAD, and no assessment for permitting reverses criticality and change rate. The quiet archive does not need the densest cadence, while emergency CAD cannot rely on a single historical assessment, and permitting still requires periodic review when features ship. Ad hoc assessment only when a newspaper story appears is reactive journalism, not a risk program. Media-driven spikes miss silent configuration drift on CAD, planned permitting releases, and archive control decay until something becomes newsworthy. Continuous assessment for the archive only because archives hold the oldest data confuses data age with operational criticality and change velocity. Oldest data does not automatically demand the most intensive ongoing assessment relative to 911 or frequently updated citizen services. Exam caveat: Pair assessment type to change rate and business criticality together. Continuous is not automatically best for every system, and one-time is not adequate for high-change, high-impact platforms. Operational check: Document assessment cadence per system class in the risk program, tie permitting reviews to release calendars, and ensure 911 CAD has continuous control monitoring plus scheduled deep assessments rather than waiting for headlines.