SY0-701 Security Program Management and Oversight — 40 Questions

Question 1

A manager asks how the security team decides which issue should be fixed first. Which two factors are MOST important to evaluate for each risk?

Accepted Answer

Likelihood and impact. Risk prioritization is based on the likelihood of a threat occurring and the potential impact on the organization. These two factors are the core components of risk (Risk = Likelihood × Impact). Asset age and user satisfaction are not primary inputs to risk priority decisions; they may influence other aspects of security management but do not directly determine which risk to address first.

Answer

Asset age and user satisfaction

Answer

Vendor popularity and implementation speed

Answer

Encryption algorithm and screen resolution

Question 2

Based on the exhibit, which risk should be prioritized first under the company's likelihood-impact scoring model?

Exhibit: Risk Register

| Risk ID | Likelihood | Impact | Score | Notes |
|---------|------------|--------|-------|-------|
| R-101 | 3 | 3 | 9 | Manual review partially controls the risk |
| R-102 | 2 | 4 | 8 | Cheaper remediation available |
| R-103 | 1 | 5 | 5 | Critical impact but rare occurrence |
| R-104 | 5 | 5 | 25 | No existing control |

Accepted Answer

R-104, because it has the highest likelihood-impact score in the register.. Using the company's likelihood-impact scoring model, the risk score is calculated as likelihood × impact. R-104 has the highest score (5 × 5 = 25), so it is prioritized first. The other options incorrectly prioritize a single factor or cost over the composite score shown in the register.

Answer

R-101, because manual review means the risk is already partially controlled.

Answer

R-102, because a cheaper remediation always has priority over a higher total score.

Answer

R-103, because critical impact always outweighs likelihood in the matrix.

Question 3

Select all of the following risk term definitions that are correct.

Accepted Answer

Inherent risk: The level of risk before any controls are applied. The correct definitions are: Inherent risk is the level of risk before controls, Residual risk is after controls, Risk appetite is the amount of risk willing to be accepted, and Risk tolerance is the acceptable deviation. Thus A-D are correct, while E and F incorrectly swap these definitions.

Answer

Inherent risk: The level of risk after controls are applied

Answer

Risk appetite: The acceptable deviation from the risk appetite

Question 4

Which missing control best improves oversight of the supplier?

Accepted Answer

Right-to-audit clause.. A right-to-audit clause is the missing control that best improves oversight of the supplier because it grants the organization contractual authority to examine the supplier's security controls, processes, and compliance evidence. Without this clause, the organization has no formal mechanism to verify that the supplier is adhering to agreed-upon security requirements, leaving oversight entirely dependent on trust.

Answer

Allow the supplier to choose any encryption algorithm it wants.

Answer

Disable all contract reviews after signature.

Answer

Require the vendor to use employee badges for all facilities.

Question 5

An external auditor asks for proof that emergency firewall changes were reviewed and approved before implementation last quarter. Which two artifacts are the best evidence? Select two.

Accepted Answer

An approved change ticket that shows the reviewer, approver, and timestamps.. An approved change ticket with reviewer, approver, and timestamps directly documents the required pre-approval workflow for emergency firewall changes. Similarly, CAB or workflow approval records serve as formal documentation of the decision to approve the change. Both artifacts provide an auditable trail showing that the change was reviewed and approved before implementation, which is the exact evidence the auditor is requesting.

Answer

A screenshot of the firewall's current rule base after the change.

Answer

A technician's memory of getting permission over the phone.

Answer

The organization's general information security policy.

Question 6

After a phishing simulation, many users still nearly entered credentials. Leadership wants to reduce repeat mistakes without causing long training sessions. Which two actions are the best balance of security and usability? Select two.

Accepted Answer

Send a short targeted refresher focused on the exact mistake. A short, targeted refresher directly addresses the specific mistake (e.g., entering credentials on a phishing page) without overwhelming users. This approach leverages microlearning principles, which improve retention and reduce cognitive load compared to lengthy training. It balances security by reinforcing the exact behavior to avoid, while maintaining usability by minimizing time away from work. Additionally, adding an easy reporting button inside the email client empowers users to quickly flag suspicious messages, enabling faster response and reinforcing a security-conscious culture without requiring significant training time. Together, these actions provide immediate, low-friction security improvements while preserving productivity.

Answer

Require every employee to attend a full-day annual course this week

Answer

Publicly post the names of employees who clicked the simulation

Answer

Disable all email attachments for every user

Question 7

After several near-miss phishing attempts, leadership wants to reduce mistakes quickly without disrupting daily work. Which three measures are the best balance of security and usability? Select three.

Accepted Answer

Run short role-based phishing training for higher-risk user groups.. Targeted, role-based phishing training focuses on users who handle sensitive data or financial transactions, reducing the attack surface without overwhelming the entire workforce. A simple report-phishing button empowers users to quickly flag suspicious emails, enabling rapid response and fostering a security-conscious culture. Out-of-band verification for payment changes and wire requests adds a critical control against financial fraud, preventing unauthorized transactions even if credentials are compromised, without significantly disrupting normal workflows.

Answer

Disable email for all staff until phishing activity stops.

Answer

Block all external senders permanently.

Question 8

The exhibit shows a weekly risk register for a small enterprise. Which three findings should be remediated first based on likelihood of exploitation and business impact? Select three.

Accepted Answer

Finding 1, because the customer portal is internet-facing and protects a high-value administrative path.. Finding 1 is correct because the customer portal is internet-facing and protects a high-value administrative path. External exposure increases likelihood, and a compromise could lead to full administrative access, resulting in severe business impact.

Finding 3 is correct because broad payroll permissions create both fraud and lateral-movement risk. Insider threats or compromised accounts could lead to financial fraud and deeper network compromise, making it a high-priority remediation.

Finding 4 is correct because a default printer password is an easy foothold on the internal network. The ease of exploitation and potential for lateral movement make it a critical risk, even if the immediate impact is lower than the portal or payroll.

Options B and E are incorrect because they rely on absolute statements ('always' and 'before') rather than the risk register's assessment of likelihood and business impact. Not all default settings or outdated software outrank other higher-impact risks.

Answer

Finding 2, because any default setting should always outrank all other issues automatically.

Answer

Finding 5, because any outdated software should be fixed before higher-impact business systems.

Question 9

A weekly risk review lists several findings. Which two should be addressed first based on likelihood of exploitation and business impact? Select two.

Accepted Answer

An internet-facing VPN appliance with a known exploit and no vendor patch available yet.. Both A and C are critical. An internet-facing VPN appliance with a known exploit is highly likely to be exploited and can lead to network compromise, making it a top priority. A public payroll portal with default admin credentials is trivially exploitable and directly exposes sensitive data, also requiring immediate action. The other options are internal or low-impact risks.

Answer

An internal lab system with an outdated browser component, isolated from production and not customer-facing.

Answer

A training virtual machine used offline once per month in a disconnected lab.

Answer

A documentation site with a spelling error in its banner text.

Question 10

A security manager is writing baseline requirements for all corporate laptops. Which three statements belong in the standard rather than in a policy or guideline? Select three.

Accepted Answer

Full-disk encryption must be enabled using approved encryption software.. A standard is a mandatory, enforceable set of technical requirements that specifies exactly what must be done. Option A qualifies because it requires full-disk encryption with approved software, a specific and obligatory control. Option B qualifies because it sets a precise, mandatory timeout for screen locking (10 minutes), a concrete technical setting. Option D qualifies because it prohibits local administrator rights, an enforceable technical restriction on user accounts. These contrast with guidelines, which are recommended (e.g., 'should consider'), and policies, which state broad intent (e.g., following acceptable use). Therefore, the correct answers are A, B, and D.

Answer

Users should consider keeping their devices updated whenever convenient.

Answer

Employees must follow the company's acceptable use policy at all times.

Question 11

A small company can only remediate two findings this week. Which two should be fixed first based on risk to the business? Select two.

Accepted Answer

An internet-facing VPN appliance with a critical vulnerability and a public exploit. An internet-facing VPN appliance with a critical vulnerability and a public exploit represents an immediate, high-impact risk. Attackers can leverage the public exploit to gain unauthorized remote access to the internal network, potentially compromising all connected systems and data. The combination of internet exposure and known exploit makes this the highest priority for remediation. Additionally, a production print server with default administrator credentials poses a serious risk: default credentials are well-known and easily exploited, and because the server is accessible to finance users, an attacker could gain a foothold on the internal network, access sensitive print jobs, and potentially move laterally to other systems. Both A and C address immediate, exploitable risks to the business, whereas B, D, and E represent lower or no active risk.

Answer

An internal training VM used by one student with a medium vulnerability and no sensitive data

Answer

A discontinued server already removed from the network but still listed in inventory

Answer

A low-severity cosmetic issue on a noncritical dashboard page

Question 12

A records manager confirms that paper onboarding forms containing government IDs are past retention, no legal hold exists, and the files are no longer needed. Which two actions should happen next? Select two.

Accepted Answer

Destroy the forms using approved secure disposal methods.. The scenario establishes that the records have already been confirmed as past retention, with no legal hold, and no longer needed. The correct next steps are to destroy the forms using approved secure disposal (A) and record the destruction according to procedures (B). Option C, 'Verify that no legal hold or regulatory exception applies,' is redundant because the manager has already done this verification. Therefore, the correct answer should only include A and B, not C.

Answer

Verify that no legal hold or regulatory exception applies.

Answer

Store the forms in a desk drawer for another quarter just in case.

Answer

Email scans of the forms to managers so they can keep a copy.

Question 13

An employee receives a text message claiming their email password expired and asks them to tap a link and confirm a one-time code. Which two responses are appropriate? Select two.

Accepted Answer

Do not tap the link or share the one-time code. This message is a phishing attempt. Tapping the link or sharing the one-time code would allow an attacker to complete credential harvesting or MFA bypass. The appropriate responses are to avoid interacting with the link or code and to report the message through the company's approved security channel so the security team can investigate and respond.

Answer

Reply to the sender and ask them to prove they are legitimate

Answer

Enter the code to see whether the message is real

Answer

Forward the text to coworkers so they can compare it

Question 14

A records manager finds paper onboarding forms and scanned copies that contain government ID numbers. The retention period has expired, no legal hold exists, and the forms are no longer needed. Which three actions should the records manager take to securely dispose of the records? Select three.

Accepted Answer

Verify the retention schedule and confirm that no legal hold or exception applies.. Before disposing of the records, the records manager must first verify the retention schedule and confirm that no legal hold or exception applies (Option A). Once that is confirmed, the paper copies must be destroyed using an approved secure method, such as cross-cut shredding or pulping (Option C), and the electronic copies must be securely deleted from active storage while following backup-retention rules for residual copies (Option D). These steps ensure compliance with organizational policy and legal requirements, and prevent unauthorized access to sensitive government ID numbers.

Answer

Move the forms to an unsecured archive so they can be retrieved later if needed.

Answer

Keep personal copies because auditors might ask informally later.

Question 15

A business unit keeps a low-priority legacy tool but adds extra monitoring and patching. The company also buys cyber insurance to reduce the financial effect of a loss. Which two risk treatment strategies are being used? Select two.

Accepted Answer

Mitigation. Adding extra monitoring and patching to a legacy tool reduces the likelihood or impact of a security incident, which is a classic example of risk mitigation. Purchasing cyber insurance transfers the financial risk of a loss to a third party, which is risk transference. Therefore, the two strategies used are mitigation (option B) and transfer (option D).

Answer

Acceptance

Answer

Avoidance

Answer

Deterrent

Question 16

Based on the exhibit, which control option provides the greatest net annual financial benefit for the organization?

Accepted Answer

Option B, because its large reduction in annual loss outweighs the higher implementation cost.. It provides the greatest net annual financial benefit. With a loss reduction of $220,000 and an implementation cost of $120,000, the net benefit is $100,000, which is higher than any other option. This demonstrates that a larger upfront investment can be justified when the reduction in annualized loss expectancy (ALE) significantly outweighs the control cost.

Answer

Option A, because it reduces loss enough to justify the control cost better than the smaller controls.

Answer

Option C, because transferring the risk is always cheaper than engineering a technical fix.

Answer

Option D, because low upfront cost makes it the most economical option regardless of residual loss.

Question 17

A security manager issues a mandatory document that requires all corporate laptops to use full-disk encryption, automatic screen lock after 10 minutes, and approved endpoint protection software. The document will be checked during compliance reviews. Which governance artifact is this?

Accepted Answer

Standard. This document is a standard because it specifies mandatory technical configurations and controls (full-disk encryption, screen lock timeout, endpoint protection) that must be implemented. Unlike a policy, which is a high-level statement of management intent, a standard provides specific, measurable requirements that support the policy. The document is not a procedure (step-by-step actions) or a guideline (optional recommendations). Compliance reviews enforce this standard as a mandatory baseline.

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 18

A security manager is creating a document that requires every corporate laptop to use full-disk encryption, automatic screen locking after 10 minutes, and approved antivirus software. Which two governance artifacts best fit those requirements? Select two.

Accepted Answer

Standard. Both Standard and Baseline are correct. A standard defines mandatory, specific technical configurations, such as requiring full-disk encryption (e.g., AES-256 via BitLocker or FileVault), automatic screen locking after 10 minutes, and approved antivirus software. A baseline is a minimum set of security configuration requirements that all corporate laptops must meet, and it can include the exact same specifics. Standards and baselines both serve as enforceable governance artifacts for these concrete security controls, unlike a policy (which states intent), a procedure (which gives step-by-step instructions), or a guideline (which is advisory).

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 19

A security manager is creating a company-wide requirement that all Windows laptops must have full-disk encryption, screen lock after 10 minutes, and approved antivirus enabled. Administrators can choose the exact implementation details, but the minimum settings must be mandatory across the fleet. Which governance artifact should the manager update?

Accepted Answer

Standard. A standard is a mandatory set of specific technical requirements or controls that must be implemented. In this scenario, the security manager is defining mandatory minimum settings (full-disk encryption, screen lock after 10 minutes, approved antivirus) that must be enforced across all laptops. Administrators can choose which specific products or tools to use, but the controls themselves are mandatory. This is the defining characteristic of a standard, not a policy (which would be more general, e.g., 'data must be protected at rest').

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 20

A simulated phishing campaign shows that several employees clicked a simulated phishing link. Which action should the security team prioritize next?

Accepted Answer

Deploy role-based phishing training, recurring simulations, and a simple reporting workflow.. The best next step is to implement role-based phishing training, run recurring simulations, and establish a simple reporting workflow. This targets employees' specific risk levels, reinforces secure behavior over time, and makes it easier to report suspicious messages. One-time reminders or repeating the same broad module are less effective, and punitive action alone does not improve security awareness.

Answer

Send a company-wide reminder to never click links in email, regardless of sender.

Answer

Focus only on punitive action for users who failed the simulation.

Answer

Run the same broad awareness module again for all employees at the same time.