SY0-701 Security Program Management and Oversight — 10 Questions

Question 1

A manager asks how the security team decides which issue should be fixed first. Which two factors are MOST important to evaluate for each risk?

Accepted Answer

Likelihood and impact. Risk prioritization is based on the likelihood of a threat occurring and the potential impact on the organization. These two factors are the core components of risk (Risk = Likelihood × Impact). Asset age and user satisfaction are not primary inputs to risk priority decisions; they may influence other aspects of security management but do not directly determine which risk to address first.

Answer

Asset age and user satisfaction

Answer

Vendor popularity and implementation speed

Answer

Encryption algorithm and screen resolution

Question 2

Based on the exhibit, which risk should be prioritized first under the company's likelihood-impact scoring model?

Exhibit: Risk Register

| Risk ID | Likelihood | Impact | Score | Notes |
|---------|------------|--------|-------|-------|
| R-101 | 3 | 3 | 9 | Manual review partially controls the risk |
| R-102 | 2 | 4 | 8 | Cheaper remediation available |
| R-103 | 1 | 5 | 5 | Critical impact but rare occurrence |
| R-104 | 5 | 5 | 25 | No existing control |

Accepted Answer

R-104, because it has the highest likelihood-impact score in the register.. Using the company's likelihood-impact scoring model, the risk score is calculated as likelihood × impact. R-104 has the highest score (5 × 5 = 25), so it is prioritized first. The other options incorrectly prioritize a single factor or cost over the composite score shown in the register.

Answer

R-101, because manual review means the risk is already partially controlled.

Answer

R-102, because a cheaper remediation always has priority over a higher total score.

Answer

R-103, because critical impact always outweighs likelihood in the matrix.

Question 3

Select all of the following risk term definitions that are correct.

Accepted Answer

Inherent risk: The level of risk before any controls are applied. The correct definitions are: Inherent risk is the level of risk before controls, Residual risk is after controls, Risk appetite is the amount of risk willing to be accepted, and Risk tolerance is the acceptable deviation. Thus A-D are correct, while E and F incorrectly swap these definitions.

Answer

Inherent risk: The level of risk after controls are applied

Answer

Risk appetite: The acceptable deviation from the risk appetite

Question 4

Which missing control best improves oversight of the supplier?

Accepted Answer

Right-to-audit clause.. A right-to-audit clause is the missing control that best improves oversight of the supplier because it grants the organization contractual authority to examine the supplier's security controls, processes, and compliance evidence. Without this clause, the organization has no formal mechanism to verify that the supplier is adhering to agreed-upon security requirements, leaving oversight entirely dependent on trust.

Answer

Allow the supplier to choose any encryption algorithm it wants.

Answer

Disable all contract reviews after signature.

Answer

Require the vendor to use employee badges for all facilities.

Question 5

An external auditor asks for proof that emergency firewall changes were reviewed and approved before implementation last quarter. Which two artifacts are the best evidence? Select two.

Accepted Answer

An approved change ticket that shows the reviewer, approver, and timestamps.. An approved change ticket with reviewer, approver, and timestamps directly documents the required pre-approval workflow for emergency firewall changes. Similarly, CAB or workflow approval records serve as formal documentation of the decision to approve the change. Both artifacts provide an auditable trail showing that the change was reviewed and approved before implementation, which is the exact evidence the auditor is requesting.

Answer

A screenshot of the firewall's current rule base after the change.

Answer

A technician's memory of getting permission over the phone.

Answer

The organization's general information security policy.

Question 6

After a phishing simulation, many users still nearly entered credentials. Leadership wants to reduce repeat mistakes without causing long training sessions. Which two actions are the best balance of security and usability? Select two.

Accepted Answer

Send a short targeted refresher focused on the exact mistake. A short, targeted refresher directly addresses the specific mistake (e.g., entering credentials on a phishing page) without overwhelming users. This approach leverages microlearning principles, which improve retention and reduce cognitive load compared to lengthy training. It balances security by reinforcing the exact behavior to avoid, while maintaining usability by minimizing time away from work. Additionally, adding an easy reporting button inside the email client empowers users to quickly flag suspicious messages, enabling faster response and reinforcing a security-conscious culture without requiring significant training time. Together, these actions provide immediate, low-friction security improvements while preserving productivity.

Answer

Require every employee to attend a full-day annual course this week

Answer

Publicly post the names of employees who clicked the simulation

Answer

Disable all email attachments for every user

Question 7

After several near-miss phishing attempts, leadership wants to reduce mistakes quickly without disrupting daily work. Which three measures are the best balance of security and usability? Select three.

Accepted Answer

Run short role-based phishing training for higher-risk user groups.. Targeted, role-based phishing training focuses on users who handle sensitive data or financial transactions, reducing the attack surface without overwhelming the entire workforce. A simple report-phishing button empowers users to quickly flag suspicious emails, enabling rapid response and fostering a security-conscious culture. Out-of-band verification for payment changes and wire requests adds a critical control against financial fraud, preventing unauthorized transactions even if credentials are compromised, without significantly disrupting normal workflows.

Answer

Disable email for all staff until phishing activity stops.

Answer

Block all external senders permanently.

Question 8

The exhibit shows a weekly risk register for a small enterprise. Which three findings should be remediated first based on likelihood of exploitation and business impact? Select three.

Accepted Answer

Finding 1, because the customer portal is internet-facing and protects a high-value administrative path.. Finding 1 is correct because the customer portal is internet-facing and protects a high-value administrative path. External exposure increases likelihood, and a compromise could lead to full administrative access, resulting in severe business impact.

Finding 3 is correct because broad payroll permissions create both fraud and lateral-movement risk. Insider threats or compromised accounts could lead to financial fraud and deeper network compromise, making it a high-priority remediation.

Finding 4 is correct because a default printer password is an easy foothold on the internal network. The ease of exploitation and potential for lateral movement make it a critical risk, even if the immediate impact is lower than the portal or payroll.

Options B and E are incorrect because they rely on absolute statements ('always' and 'before') rather than the risk register's assessment of likelihood and business impact. Not all default settings or outdated software outrank other higher-impact risks.

Answer

Finding 2, because any default setting should always outrank all other issues automatically.

Answer

Finding 5, because any outdated software should be fixed before higher-impact business systems.

Question 9

A weekly risk review lists several findings. Which two should be addressed first based on likelihood of exploitation and business impact? Select two.

Accepted Answer

An internet-facing VPN appliance with a known exploit and no vendor patch available yet.. Both A and C are critical. An internet-facing VPN appliance with a known exploit is highly likely to be exploited and can lead to network compromise, making it a top priority. A public payroll portal with default admin credentials is trivially exploitable and directly exposes sensitive data, also requiring immediate action. The other options are internal or low-impact risks.

Answer

An internal lab system with an outdated browser component, isolated from production and not customer-facing.

Answer

A training virtual machine used offline once per month in a disconnected lab.

Answer

A documentation site with a spelling error in its banner text.

Question 10

A security manager is writing baseline requirements for all corporate laptops. Which three statements belong in the standard rather than in a policy or guideline? Select three.

Accepted Answer

Full-disk encryption must be enabled using approved encryption software.. A standard is a mandatory, enforceable set of technical requirements that specifies exactly what must be done. Option A qualifies because it requires full-disk encryption with approved software, a specific and obligatory control. Option B qualifies because it sets a precise, mandatory timeout for screen locking (10 minutes), a concrete technical setting. Option D qualifies because it prohibits local administrator rights, an enforceable technical restriction on user accounts. These contrast with guidelines, which are recommended (e.g., 'should consider'), and policies, which state broad intent (e.g., following acceptable use). Therefore, the correct answers are A, B, and D.

Answer

Users should consider keeping their devices updated whenever convenient.

Answer

Employees must follow the company's acceptable use policy at all times.