SY0-701 Security Program Management and Oversight Practice Test 10 — 15 Questions

Question 1

HR stores scanned government IDs collected during onboarding. The retention policy says the files may be kept for 90 days after employment verification, then destroyed. What should security require?

Accepted Answer

Store the files in an encrypted repository and securely dispose of them when retention expires. It aligns with the principle of data minimization and the retention policy: storing scanned government IDs in an encrypted repository ensures confidentiality and integrity, while secure disposal after the 90-day retention period meets compliance requirements (e.g., GDPR, HIPAA) and reduces risk of data breaches. Security must enforce both protection during storage and timely destruction to prevent unauthorized access or legal liability.

Answer

Keep the files indefinitely in case a future audit asks for them

Answer

Move the files to a shared folder so more HR staff can access them

Answer

Print the scanned IDs and place them in a locked cabinet instead of keeping digital copies

Question 2

Match each excerpt from a small enterprise security program to the correct governance artifact.

Accepted Answer

Policy: All employees must use multi-factor authentication. Policy defines mandatory rules; Procedure gives step-by-step instructions; Standard specifies technical requirements; Guideline offers best practices.

Answer

Procedure: All employees must use multi-factor authentication

Answer

Policy: It is recommended to use complex passwords

Question 3

A manufacturer identifies a rare but very costly ransomware risk. Executives decide not to eliminate the activity, but to purchase cyber insurance and formally acknowledge the remaining exposure. Which risk treatment is being used?

Accepted Answer

Transfer. (Transfer) because purchasing cyber insurance shifts the financial risk of the ransomware incident to the insurer. The executives formally acknowledge the remaining exposure, which confirms they are not simply accepting the risk but are actively transferring the monetary impact through a contractual agreement.

Answer

Avoidance

Answer

Mitigation

Answer

Acceptance

Question 4

A Linux operations team is building a new production gold image for database servers. Security requires every build to disable password-based SSH, enable audit logging, use the company NTP servers, and remove the desktop package set. The admins need a document that defines these exact required settings and allows exceptions only through formal approval. Which artifact should be used?

Accepted Answer

Baseline. A baseline defines the minimum security configuration that must be applied to all systems, such as disabling password-based SSH, enabling audit logging, using specific NTP servers, and removing unnecessary packages. It is the correct artifact because it specifies required settings and allows exceptions only through formal approval, which aligns with the scenario's need for a mandatory configuration standard. Policies are high-level statements of intent, guidelines are recommendations, and procedures are step-by-step instructions, none of which enforce mandatory settings with exception control.

Answer

Policy

Answer

Guideline

Answer

Procedure

Question 5

A business unit is worried about the financial impact of a rare but severe data center outage. After reviewing the risk register, leadership decides to purchase cyber insurance and document the remaining exposure rather than redesign the entire platform. Which risk treatment is this?

Accepted Answer

Risk transfer. (Risk transfer) because purchasing cyber insurance transfers the financial risk of a data center outage to an insurance provider. The business unit is not avoiding the risk by redesigning the platform, nor are they mitigating it through technical controls; they are simply documenting the residual exposure after transferring the monetary impact. This aligns with the risk treatment strategy of shifting the burden of loss to a third party.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk acceptance

Question 6

Leadership is deciding between two security controls for a customer portal outage risk. Finance wants to compare the options in dollars, using expected loss, not just a high/medium/low rating. Which approach should the analyst use?

Accepted Answer

Quantitative risk analysis, because it expresses likelihood and impact in monetary terms.. Quantitative risk analysis (A) is correct because it assigns monetary values to both the likelihood and impact of a risk, enabling a direct dollar-based comparison of expected loss. The Finance team's requirement for a dollar comparison rules out qualitative ratings, making quantitative analysis the only approach that meets their needs.

Answer

Qualitative risk analysis, because it uses categories like critical, medium, and low.

Answer

Business impact analysis, because it identifies which business processes are important.

Answer

Risk avoidance, because eliminating the activity removes the threat completely.

Question 7

A support team wants to export customer tickets into a test analytics environment so developers can search real examples while minimizing privacy exposure. The exported data includes names, email addresses, and account IDs that are not needed for the test. What is the best first step?

Accepted Answer

Remove or tokenize unneeded personal identifiers before export. Data minimization is a core privacy principle: before exporting data to a test environment, any personally identifiable information (PII) not required for the analytics task should be removed or tokenized. This reduces the attack surface and ensures compliance with privacy regulations (e.g., GDPR, CCPA) without sacrificing the utility of the real customer ticket examples.

Answer

Export the full dataset and restrict access with a shared password

Answer

Keep the data unchanged because the test environment is internal

Answer

Store the export indefinitely because development data is exempt from retention rules

Question 8

A business owner asks the security team to compare the cost of two controls for a legacy application in dollar terms. The team estimates the annual chance of a breach, the potential loss per event, and the expected yearly loss after each control is applied. Which risk analysis approach is being used?

Accepted Answer

Quantitative risk analysis. The question describes a risk analysis that uses dollar values for the annual chance of a breach, potential loss per event, and expected yearly loss after controls are applied. This is the hallmark of quantitative risk analysis, which assigns monetary or numerical values to risk components (e.g., ALE = SLE × ARO) to compare control costs in objective financial terms. The scenario explicitly asks for a cost comparison in dollar terms, which only a quantitative approach can provide.

Answer

Qualitative risk analysis

Answer

Business impact analysis

Answer

Risk acceptance

Question 9

A help desk manager wants sample customer tickets copied into a test environment so developers can reproduce support issues. The tickets include names, phone numbers, and account details. Which action best reduces privacy exposure while still supporting testing?

Accepted Answer

Mask or tokenize the personal data and restrict access to approved testers only.. Masking or tokenizing personal data (e.g., replacing names with pseudonyms, scrambling phone numbers) ensures that developers can work with realistic data structures without exposing personally identifiable information (PII). Restricting access to approved testers further enforces the principle of least privilege, which is a core security control for test environments. This approach balances the need for functional testing with compliance requirements like GDPR or HIPAA.

Answer

Export the full tickets because the developers need realistic records.

Answer

Copy the tickets to a shared cloud drive and protect it with a simple password.

Answer

Remove the account numbers only and leave the rest of the ticket untouched.

Question 10

Based on the exhibit, which governance artifact is the security team reviewing?

Accepted Answer

Baseline, because it defines the approved minimum configuration for a system type.. The exhibit shows a list of approved operating systems, software versions, and patches for a specific system type (e.g., Windows 10 22H2 with specific security updates). This is a baseline, which defines the minimum acceptable configuration for a system type. Option C is correct because a baseline establishes a known good state that systems must meet, not just intent (policy), mandatory technical requirements (standard), or step-by-step instructions (procedure).

Answer

Policy, because it describes the organization's overall intent and direction.

Answer

Standard, because it sets mandatory technical requirements for systems.

Answer

Procedure, because it gives step-by-step instructions for completing a task.

Question 11

A procurement team is evaluating a payroll SaaS vendor. They want independent evidence that the vendor's controls were designed and operating effectively over the last six months, not just at a single point in time. Which report should they request?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides independent assurance that a vendor's controls related to security, availability, processing integrity, confidentiality, or privacy were designed and operating effectively over a period of time (typically 6–12 months). This matches the procurement team's requirement for evidence of sustained control effectiveness, not just a point-in-time snapshot.

Answer

SOC 1 Type I report

Answer

Non-disclosure agreement

Answer

Network penetration test letter

Question 12

Based on the exhibit, which system should be restored first after a total site outage?

Accepted Answer

Payroll, because it has the shortest maximum tolerable downtime and the strongest compliance impact.. Payroll should be restored first because it has the shortest maximum tolerable downtime (MTD) and the strongest compliance impact. In disaster recovery, systems with the lowest MTD must be prioritized to avoid exceeding the recovery time objective (RTO), and compliance-driven systems like payroll often carry legal or regulatory penalties for extended outages.

Answer

Customer portal, because it produces the largest daily revenue loss and has the shortest RPO.

Answer

Email, because restoring communication always takes precedence over all other services.

Answer

Dev test lab, because lower business impact means it is easiest to restore first.

Question 13

Leadership wants to compare two controls for protecting a customer portal. Option A costs $40,000 and reduces annual loss expectancy from $120,000 to $30,000. Option B costs $15,000 and reduces annual loss expectancy to $70,000. Which analysis method best supports this decision?

Accepted Answer

Quantitative risk analysis. Quantitative risk analysis uses monetary values and numerical data to calculate risk, making it the best method to compare the cost-benefit of Option A (ALE reduction from $120,000 to $30,000 with a $40,000 cost) versus Option B (ALE reduction to $70,000 with a $15,000 cost). By computing the annualized loss expectancy (ALE) and comparing the cost of each control against the reduction in expected loss, leadership can determine which option provides a better return on investment. This approach directly supports the decision because it provides objective, dollar-based metrics for comparison.

Answer

Qualitative risk analysis

Answer

Business impact analysis

Answer

Risk acceptance

Question 14

A developer finds a critical bug in a customer portal on Friday afternoon. The fix must be released quickly, but the team needs a way to reverse the change if testing reveals a problem and wants the release to follow the normal approval process. Which two practices should be used? Select two.

Accepted Answer

Create a documented rollback plan. A documented rollback plan ensures that if the emergency fix introduces new issues during testing, the team can quickly and safely revert to the previous stable state. This aligns with the principle of change management, which requires a recovery procedure for any emergency change to minimize downtime and risk.

Answer

Deploy the fix directly to production without approval

Answer

Skip testing to meet the deadline

Answer

Rename the release package to reduce risk

Question 15

Based on the exhibit, what should management implement next?

Accepted Answer

Role-based security awareness training with recurring phishing simulations and reporting practice.. The exhibit shows a user who clicked a phishing link and entered credentials, indicating a need for improved security awareness. Role-based training with phishing simulations directly addresses this human risk by teaching users to recognize and report such attacks, which is the most effective next step. This aligns with the Security Program Management domain's focus on continuous improvement through user education and testing.

Answer

Disable all email attachments for every user in the company.

Answer

Replace all passwords with longer usernames.

Answer

Move all users to a single shared mailbox for easier monitoring.