SY0-701 Security Program Management and Oversight Practice Test 10 — 15 Questions

Question 1

A procurement team is evaluating a payroll SaaS vendor. They want independent evidence that the vendor's controls were designed and operating effectively over the last six months, not just at a single point in time. Which report should they request?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides independent assurance that a vendor's controls related to security, availability, processing integrity, confidentiality, or privacy were designed and operating effectively over a period of time (typically 6–12 months). This matches the procurement team's requirement for evidence of sustained control effectiveness, not just a point-in-time snapshot.

Answer

SOC 1 Type I report

Answer

Non-disclosure agreement

Answer

Network penetration test letter

Question 2

Based on the exhibit, which system should be restored first after a total site outage?

Accepted Answer

Payroll, because it has the shortest maximum tolerable downtime and the strongest compliance impact.. Payroll should be restored first because it has the shortest maximum tolerable downtime (MTD) and the strongest compliance impact. In disaster recovery, systems with the lowest MTD must be prioritized to avoid exceeding the recovery time objective (RTO), and compliance-driven systems like payroll often carry legal or regulatory penalties for extended outages.

Answer

Customer portal, because it produces the largest daily revenue loss and has the shortest RPO.

Answer

Email, because restoring communication always takes precedence over all other services.

Answer

Dev test lab, because lower business impact means it is easiest to restore first.

Question 3

Leadership wants to compare two controls for protecting a customer portal. Option A costs $40,000 and reduces annual loss expectancy from $120,000 to $30,000. Option B costs $15,000 and reduces annual loss expectancy to $70,000. Which analysis method best supports this decision?

Accepted Answer

Quantitative risk analysis. Quantitative risk analysis uses monetary values and numerical data to calculate risk, making it the best method to compare the cost-benefit of Option A (ALE reduction from $120,000 to $30,000 with a $40,000 cost) versus Option B (ALE reduction to $70,000 with a $15,000 cost). By computing the annualized loss expectancy (ALE) and comparing the cost of each control against the reduction in expected loss, leadership can determine which option provides a better return on investment. This approach directly supports the decision because it provides objective, dollar-based metrics for comparison.

Answer

Qualitative risk analysis

Answer

Business impact analysis

Answer

Risk acceptance

Question 4

A developer finds a critical bug in a customer portal on Friday afternoon. The fix must be released quickly, but the team needs a way to reverse the change if testing reveals a problem and wants the release to follow the normal approval process. Which two practices should be used? Select two.

Accepted Answer

Create a documented rollback plan. Option B is correct because a documented rollback plan ensures that if the emergency fix introduces new issues during testing, the team can quickly and safely revert to the previous stable state. This aligns with the principle of change management, which requires a recovery procedure for any emergency change to minimize downtime and risk.

Answer

Deploy the fix directly to production without approval

Answer

Skip testing to meet the deadline

Answer

Rename the release package to reduce risk

Question 5

Based on the exhibit, what should management implement next?

Accepted Answer

Role-based security awareness training with recurring phishing simulations and reporting practice.. The exhibit shows a user who clicked a phishing link and entered credentials, indicating a need for improved security awareness. Role-based training with phishing simulations directly addresses this human risk by teaching users to recognize and report such attacks, which is the most effective next step. This aligns with the Security Program Management domain's focus on continuous improvement through user education and testing.

Answer

Disable all email attachments for every user in the company.

Answer

Replace all passwords with longer usernames.

Answer

Move all users to a single shared mailbox for easier monitoring.

Question 6

An HR manager wants to share employee data with a benefits analytics vendor. The dataset includes names, employee IDs, home addresses, and medical leave codes. Security wants to reduce privacy exposure while still allowing the vendor to complete the analysis. What is the best first step?

Accepted Answer

Provide only the minimum necessary fields and replace direct identifiers with project IDs. Option B is correct because it implements data minimization, a core privacy principle, by providing only the minimum necessary fields and replacing direct identifiers (names, employee IDs) with project-specific pseudonyms. This reduces exposure of personally identifiable information (PII) while preserving the vendor's ability to perform analytics on the medical leave codes and other non-identifying data. It aligns with the CompTIA SY0-701 objective of applying privacy-enhancing techniques like anonymization and data masking.

Answer

Send the full file as-is if the vendor agrees not to disclose it

Answer

Keep the names but mark the spreadsheet confidential before sending it

Answer

Upload the file to a public cloud folder and restrict the link to the vendor

Question 7

A network engineer needs to change an ACL on a production firewall so a new SaaS integration works. The business cannot tolerate an extended outage, and the change must be reversible if testing fails. Which practice best fits?

Accepted Answer

Follow formal change management with approval, testing, and rollback planning. Formal change management ensures the ACL modification is documented, tested in a staging environment, and includes a rollback plan (e.g., reverting to a saved configuration or applying a 'no' command for the specific ACL entry). This minimizes downtime by allowing controlled implementation and immediate reversal if the SaaS integration fails, aligning with the business's zero-tolerance for extended outages.

Answer

Make the change directly during business hours without documentation

Answer

Disable logging temporarily so the firewall change applies faster

Answer

Ask the vendor to modify the firewall remotely without internal review

Question 8

Before approving a new payroll SaaS provider, the security team wants independent evidence that the vendor's controls operated effectively during the last year and wants the contract to clearly define security responsibilities. Which two items should they request or review? Select two.

Accepted Answer

A SOC 2 Type II report. A SOC 2 Type II report provides independent, audited evidence that a vendor's controls (e.g., security, availability, confidentiality) were operating effectively over a specified period (typically 6–12 months). This directly meets the requirement for independent evidence of control effectiveness over the last year, unlike a point-in-time assessment.

Answer

A sales presentation from the vendor account team

Answer

The vendor's public blog posts

Answer

A screenshot of the login page

Question 9

A help desk team needs sample customer tickets in a lower environment for testing. The records contain names, phone numbers, and case details. Which approach best reduces privacy risk while still allowing useful testing?

Accepted Answer

Mask or tokenize the personal data before loading it into test. Option B is correct because data masking or tokenization replaces sensitive personal information (names, phone numbers) with realistic but fictitious values, preserving the dataset's utility for testing while minimizing exposure of real PII. This approach aligns with privacy best practices and regulatory requirements like GDPR or HIPAA, as the test environment never contains actual customer data.

Answer

Copy the production database exactly into the test system

Answer

Email the records to developers so they can import them manually

Answer

Store the records in an unencrypted spreadsheet on a shared drive

Question 10

A developer finds a production bug on Friday afternoon. The fix has already passed staging, but the business wants the release to be reversible if the hotfix causes trouble. Which change-management practice best satisfies both speed and control?

Accepted Answer

Use an emergency change with a documented rollback plan and approval. Option C is correct because an emergency change with a documented rollback plan and approval provides the fastest path to production while maintaining control. This practice aligns with ITIL's emergency change advisory board (ECAB) process, which allows expedited approval for critical fixes while requiring a tested rollback procedure to ensure reversibility. The business's requirement for speed is met by bypassing the normal change window, and control is preserved through mandatory documentation and approval.

Answer

Bypass change control so the patch reaches production immediately

Answer

Wait for the next normal change window next week

Answer

Freeze all production changes until the next monthly review meeting

Question 11

During business impact analysis interviews, the team needs two inputs that help determine which business services must recover first after an outage. Which two inputs are the most useful? Select two.

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) defines the maximum acceptable downtime for a business service, directly indicating the urgency of recovery. Recovery Point Objective (RPO) defines the maximum acceptable data loss, which influences the recovery strategy and priority. Together, they provide the two critical inputs needed to sequence recovery efforts after an outage.

Answer

Annualized Loss Expectancy (ALE)

Answer

Mean Time Between Failures (MTBF)

Answer

Control self-assessment score

Question 12

Procurement is reviewing a new payroll SaaS provider. The business wants independent evidence that the vendor's controls were designed and operating effectively over the last six months. Which document should the security team request?

Accepted Answer

A SOC 2 Type II report from an independent auditor.. A SOC 2 Type II report provides independent assurance that a service organization's controls are not only designed appropriately (Type I) but also operating effectively over a specified period, typically six to twelve months. This aligns directly with the procurement team's requirement for evidence of control effectiveness over the last six months, making it the correct choice for evaluating a SaaS vendor's security posture.

Answer

A software patch list showing recent updates installed on the vendor's servers.

Answer

A penetration test screenshot showing one web application vulnerability was fixed.

Answer

An internal email from the vendor's security manager stating that controls are mature.

Question 13

A records manager is preparing to delete old HR emails next week under the retention schedule. Legal notifies the team that those messages may be needed for an active investigation. What should the records manager do first?

Accepted Answer

Place the emails on legal hold and suspend normal deletion for those records.. When legal notifies that emails may be needed for an active investigation, the records manager must immediately suspend normal deletion and place a legal hold on those records. This preserves the data in its original state, preventing spoliation and ensuring compliance with e-discovery obligations. Deleting or moving the emails could destroy metadata or chain of custody, violating legal hold requirements.

Answer

Delete the emails on schedule and archive only the subject lines.

Answer

Move the emails to a shared folder so legal can review them later.

Answer

Compress the emails into an encrypted file and continue with deletion.

Question 14

A business unit keeps a low-priority legacy tool but adds extra monitoring and patching. The company also buys cyber insurance to reduce the financial effect of a loss. Which two risk treatment strategies are being used? Select two.

Accepted Answer

Mitigation. Adding extra monitoring and patching to a legacy tool is a classic example of risk mitigation, as it reduces the likelihood or impact of a security incident without removing the asset. Purchasing cyber insurance transfers the financial risk of a loss to a third party, which is a risk transference strategy. The question asks for two strategies, and mitigation is one of them; the other is transference, which is not listed as an option here, but the correct choices from the given set are mitigation and acceptance (since the business unit keeps the low-priority legacy tool, accepting the residual risk).

Answer

Acceptance

Answer

Avoidance

Answer

Deterrent

Question 15

After several employees clicked on a realistic phishing email, management wants a control that both improves user behavior and gives the security team a way to measure improvement over time. Which approach is best?

Accepted Answer

Run simulated phishing campaigns with immediate feedback and follow-up training. Simulated phishing campaigns with immediate feedback and follow-up training directly address user behavior by providing a safe, controlled environment where employees can learn to recognize phishing attempts. This approach also gives the security team measurable metrics (e.g., click rates over time) to track improvement, aligning with the goal of both behavioral change and quantifiable assessment.

Answer

Send a company-wide reminder not to open suspicious emails

Answer

Block all external email messages at the gateway

Answer

Require employees to change passwords every week