CompTIA Security+ SY0-701 (V7) Practice Question

An exemption is appropriately granted when adherence to a specific security policy or control would not be feasible, such as when it would interfere with operational requirements or when the associated cost far outweighs the benefit. It is not a means to avoid implementing security measures altogether but a considered decision that requires approval by the appropriate level of management. The approval process must include an understanding of the potential risks and agreement that such risks are acceptable. This distinguishes exemptions from other risk strategies, like mitigation where risks are reduced, or transference where risks are shared.