SY0-701 Security Program Management and Oversight Practice Test 10 — 15 Questions

Question 1

A manufacturer identifies a rare but very costly ransomware risk. Executives decide not to eliminate the activity, but to purchase cyber insurance and formally acknowledge the remaining exposure. Which risk treatment is being used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transfer. (Transfer) because purchasing cyber insurance shifts the financial risk of the ransomware incident to the insurer. The executives formally acknowledge the remaining exposure, which confirms they are not simply accepting the risk but are actively transferring the monetary impact through a contractual agreement.

Answer

Avoidance

Answer

Mitigation

Answer

Acceptance

Question 2

A Linux operations team is building a new production gold image for database servers. Security requires every build to disable password-based SSH, enable audit logging, use the company NTP servers, and remove the desktop package set. The admins need a document that defines these exact required settings and allows exceptions only through formal approval. Which artifact should be used?

Accepted Answer

Baseline. A baseline defines the minimum security configuration that must be applied to all systems, such as disabling password-based SSH, enabling audit logging, using specific NTP servers, and removing unnecessary packages. It is the correct artifact because it specifies required settings and allows exceptions only through formal approval, which aligns with the scenario's need for a mandatory configuration standard. Policies are high-level statements of intent, guidelines are recommendations, and procedures are step-by-step instructions, none of which enforce mandatory settings with exception control.

Answer

Policy

Answer

Guideline

Answer

Procedure

Question 3

A business unit is worried about the financial impact of a rare but severe data center outage. After reviewing the risk register, leadership decides to purchase cyber insurance and document the remaining exposure rather than redesign the entire platform. Which risk treatment is this?

Accepted Answer

Risk transfer. (Risk transfer) because purchasing cyber insurance transfers the financial risk of a data center outage to an insurance provider. The business unit is not avoiding the risk by redesigning the platform, nor are they mitigating it through technical controls; they are simply documenting the residual exposure after transferring the monetary impact. This aligns with the risk treatment strategy of shifting the burden of loss to a third party.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk acceptance

Question 4

Leadership is deciding between two security controls for a customer portal outage risk. Finance wants to compare the options in dollars, using expected loss, not just a high/medium/low rating. Which approach should the analyst use?

Accepted Answer

Quantitative risk analysis, because it expresses likelihood and impact in monetary terms.. Quantitative risk analysis (A) is correct because it assigns monetary values to both the likelihood and impact of a risk, enabling a direct dollar-based comparison of expected loss. The Finance team's requirement for a dollar comparison rules out qualitative ratings, making quantitative analysis the only approach that meets their needs.

Answer

Qualitative risk analysis, because it uses categories like critical, medium, and low.

Answer

Business impact analysis, because it identifies which business processes are important.

Answer

Risk avoidance, because eliminating the activity removes the threat completely.

Question 5

A support team wants to export customer tickets into a test analytics environment so developers can search real examples while minimizing privacy exposure. The exported data includes names, email addresses, and account IDs that are not needed for the test. What is the best first step?

Accepted Answer

Remove or tokenize unneeded personal identifiers before export. Data minimization is a core privacy principle: before exporting data to a test environment, any personally identifiable information (PII) not required for the analytics task should be removed or tokenized. This reduces the attack surface and ensures compliance with privacy regulations (e.g., GDPR, CCPA) without sacrificing the utility of the real customer ticket examples.

Answer

Export the full dataset and restrict access with a shared password

Answer

Keep the data unchanged because the test environment is internal

Answer

Store the export indefinitely because development data is exempt from retention rules

Question 6

A business owner asks the security team to compare the cost of two controls for a legacy application in dollar terms. The team estimates the annual chance of a breach, the potential loss per event, and the expected yearly loss after each control is applied. Which risk analysis approach is being used?

Accepted Answer

Quantitative risk analysis. The question describes a risk analysis that uses dollar values for the annual chance of a breach, potential loss per event, and expected yearly loss after controls are applied. This is the hallmark of quantitative risk analysis, which assigns monetary or numerical values to risk components (e.g., ALE = SLE × ARO) to compare control costs in objective financial terms. The scenario explicitly asks for a cost comparison in dollar terms, which only a quantitative approach can provide.

Answer

Qualitative risk analysis

Answer

Business impact analysis

Answer

Risk acceptance

Question 7

A help desk manager wants sample customer tickets copied into a test environment so developers can reproduce support issues. The tickets include names, phone numbers, and account details. Which action best reduces privacy exposure while still supporting testing?

Accepted Answer

Mask or tokenize the personal data and restrict access to approved testers only.. Masking or tokenizing personal data (e.g., replacing names with pseudonyms, scrambling phone numbers) ensures that developers can work with realistic data structures without exposing personally identifiable information (PII). Restricting access to approved testers further enforces the principle of least privilege, which is a core security control for test environments. This approach balances the need for functional testing with compliance requirements like GDPR or HIPAA.

Answer

Export the full tickets because the developers need realistic records.

Answer

Copy the tickets to a shared cloud drive and protect it with a simple password.

Answer

Remove the account numbers only and leave the rest of the ticket untouched.

Question 8

Based on the exhibit, which governance artifact is the security team reviewing?

Accepted Answer

Baseline, because it defines the approved minimum configuration for a system type.. The exhibit shows a list of approved operating systems, software versions, and patches for a specific system type (e.g., Windows 10 22H2 with specific security updates). This is a baseline, which defines the minimum acceptable configuration for a system type. Option C is correct because a baseline establishes a known good state that systems must meet, not just intent (policy), mandatory technical requirements (standard), or step-by-step instructions (procedure).

Answer

Policy, because it describes the organization's overall intent and direction.

Answer

Standard, because it sets mandatory technical requirements for systems.

Answer

Procedure, because it gives step-by-step instructions for completing a task.

Question 9

A procurement team is evaluating a payroll SaaS vendor. They want independent evidence that the vendor's controls were designed and operating effectively over the last six months, not just at a single point in time. Which report should they request?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides independent assurance that a vendor's controls related to security, availability, processing integrity, confidentiality, or privacy were designed and operating effectively over a period of time (typically 6–12 months). This matches the procurement team's requirement for evidence of sustained control effectiveness, not just a point-in-time snapshot.

Answer

SOC 1 Type I report

Answer

Non-disclosure agreement

Answer

Network penetration test letter

Question 10

Based on the exhibit, which system should be restored first after a total site outage?

Accepted Answer

Payroll, because it has the shortest maximum tolerable downtime and the strongest compliance impact.. Payroll should be restored first because it has the shortest maximum tolerable downtime (MTD) and the strongest compliance impact. In disaster recovery, systems with the lowest MTD must be prioritized to avoid exceeding the recovery time objective (RTO), and compliance-driven systems like payroll often carry legal or regulatory penalties for extended outages.

Answer

Customer portal, because it produces the largest daily revenue loss and has the shortest RPO.

Answer

Email, because restoring communication always takes precedence over all other services.

Answer

Dev test lab, because lower business impact means it is easiest to restore first.

Question 11

Leadership wants to compare two controls for protecting a customer portal. Option A costs $40,000 and reduces annual loss expectancy from $120,000 to $30,000. Option B costs $15,000 and reduces annual loss expectancy to $70,000. Which analysis method best supports this decision?

Accepted Answer

Quantitative risk analysis. Quantitative risk analysis uses monetary values and numerical data to calculate risk, making it the best method to compare the cost-benefit of Option A (ALE reduction from $120,000 to $30,000 with a $40,000 cost) versus Option B (ALE reduction to $70,000 with a $15,000 cost). By computing the annualized loss expectancy (ALE) and comparing the cost of each control against the reduction in expected loss, leadership can determine which option provides a better return on investment. This approach directly supports the decision because it provides objective, dollar-based metrics for comparison.

Answer

Qualitative risk analysis

Answer

Business impact analysis

Answer

Risk acceptance

Question 12

A developer finds a critical bug in a customer portal on Friday afternoon. The fix must be released quickly, but the team needs a way to reverse the change if testing reveals a problem and wants the release to follow the normal approval process. Which two practices should be used? Select two.

Accepted Answer

Create a documented rollback plan. A documented rollback plan ensures that if the emergency fix introduces new issues during testing, the team can quickly and safely revert to the previous stable state. This aligns with the principle of change management, which requires a recovery procedure for any emergency change to minimize downtime and risk.

Answer

Deploy the fix directly to production without approval

Answer

Skip testing to meet the deadline

Answer

Rename the release package to reduce risk

Question 13

Based on the exhibit, what should management implement next?

Accepted Answer

Role-based security awareness training with recurring phishing simulations and reporting practice.. The exhibit shows a user who clicked a phishing link and entered credentials, indicating a need for improved security awareness. Role-based training with phishing simulations directly addresses this human risk by teaching users to recognize and report such attacks, which is the most effective next step. This aligns with the Security Program Management domain's focus on continuous improvement through user education and testing.

Answer

Disable all email attachments for every user in the company.

Answer

Replace all passwords with longer usernames.

Answer

Move all users to a single shared mailbox for easier monitoring.

Question 14

An HR manager wants to share employee data with a benefits analytics vendor. The dataset includes names, employee IDs, home addresses, and medical leave codes. Security wants to reduce privacy exposure while still allowing the vendor to complete the analysis. What is the best first step?

Accepted Answer

Provide only the minimum necessary fields and replace direct identifiers with project IDs. It implements data minimization, a core privacy principle, by providing only the minimum necessary fields and replacing direct identifiers (names, employee IDs) with project-specific pseudonyms. This reduces exposure of personally identifiable information (PII) while preserving the vendor's ability to perform analytics on the medical leave codes and other non-identifying data. It aligns with the CompTIA SY0-701 objective of applying privacy-enhancing techniques like anonymization and data masking.

Answer

Send the full file as-is if the vendor agrees not to disclose it

Answer

Keep the names but mark the spreadsheet confidential before sending it

Answer

Upload the file to a public cloud folder and restrict the link to the vendor

Question 15

A network engineer needs to change an ACL on a production firewall so a new SaaS integration works. The business cannot tolerate an extended outage, and the change must be reversible if testing fails. Which practice best fits?

Accepted Answer

Follow formal change management with approval, testing, and rollback planning. Formal change management ensures the ACL modification is documented, tested in a staging environment, and includes a rollback plan (e.g., reverting to a saved configuration or applying a 'no' command for the specific ACL entry). This minimizes downtime by allowing controlled implementation and immediate reversal if the SaaS integration fails, aligning with the business's zero-tolerance for extended outages.

Answer

Make the change directly during business hours without documentation

Answer

Disable logging temporarily so the firewall change applies faster

Answer

Ask the vendor to modify the firewall remotely without internal review