SY0-701 Security Program Management and Oversight Practice Test 11 — 15 Questions

Question 1

Before approving a new payroll SaaS provider, the security team wants independent evidence that the vendor's controls operated effectively during the last year and wants the contract to clearly define security responsibilities. Which two items should they request or review? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A SOC 2 Type II report. A SOC 2 Type II report provides independent, audited evidence that a vendor's controls (e.g., security, availability, confidentiality) were operating effectively over a specified period (typically 6–12 months). This directly meets the requirement for independent evidence of control effectiveness over the last year, unlike a point-in-time assessment.

Answer

A sales presentation from the vendor account team

Answer

The vendor's public blog posts

Answer

A screenshot of the login page

Question 2

A help desk team needs sample customer tickets in a lower environment for testing. The records contain names, phone numbers, and case details. Which approach best reduces privacy risk while still allowing useful testing?

Accepted Answer

Mask or tokenize the personal data before loading it into test. Data masking or tokenization replaces sensitive personal information (names, phone numbers) with realistic but fictitious values, preserving the dataset's utility for testing while minimizing exposure of real PII. This approach aligns with privacy best practices and regulatory requirements like GDPR or HIPAA, as the test environment never contains actual customer data.

Answer

Copy the production database exactly into the test system

Answer

Email the records to developers so they can import them manually

Answer

Store the records in an unencrypted spreadsheet on a shared drive

Question 3

A developer finds a production bug on Friday afternoon. The fix has already passed staging, but the business wants the release to be reversible if the hotfix causes trouble. Which change-management practice best satisfies both speed and control?

Accepted Answer

Use an emergency change with a documented rollback plan and approval. An emergency change with a documented rollback plan and approval provides the fastest path to production while maintaining control. This practice aligns with ITIL's emergency change advisory board (ECAB) process, which allows expedited approval for critical fixes while requiring a tested rollback procedure to ensure reversibility. The business's requirement for speed is met by bypassing the normal change window, and control is preserved through mandatory documentation and approval.

Answer

Bypass change control so the patch reaches production immediately

Answer

Wait for the next normal change window next week

Answer

Freeze all production changes until the next monthly review meeting

Question 4

During business impact analysis interviews, the team needs two inputs that help determine which business services must recover first after an outage. Which two inputs are the most useful? Select two.

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) defines the maximum acceptable downtime for a business service, directly indicating the urgency of recovery. Recovery Point Objective (RPO) defines the maximum acceptable data loss, which influences the recovery strategy and priority. Together, they provide the two critical inputs needed to sequence recovery efforts after an outage.

Answer

Annualized Loss Expectancy (ALE)

Answer

Mean Time Between Failures (MTBF)

Answer

Control self-assessment score

Question 5

Procurement is reviewing a new payroll SaaS provider. The business wants independent evidence that the vendor's controls were designed and operating effectively over the last six months. Which document should the security team request?

Accepted Answer

A SOC 2 Type II report from an independent auditor.. A SOC 2 Type II report provides independent assurance that a service organization's controls are not only designed appropriately (Type I) but also operating effectively over a specified period, typically six to twelve months. This aligns directly with the procurement team's requirement for evidence of control effectiveness over the last six months, making it the correct choice for evaluating a SaaS vendor's security posture.

Answer

A software patch list showing recent updates installed on the vendor's servers.

Answer

A penetration test screenshot showing one web application vulnerability was fixed.

Answer

An internal email from the vendor's security manager stating that controls are mature.

Question 6

A records manager is preparing to delete old HR emails next week under the retention schedule. Legal notifies the team that those messages may be needed for an active investigation. What should the records manager do first?

Accepted Answer

Place the emails on legal hold and suspend normal deletion for those records.. When legal notifies that emails may be needed for an active investigation, the records manager must immediately suspend normal deletion and place a legal hold on those records. This preserves the data in its original state, preventing spoliation and ensuring compliance with e-discovery obligations. Deleting or moving the emails could destroy metadata or chain of custody, violating legal hold requirements.

Answer

Delete the emails on schedule and archive only the subject lines.

Answer

Move the emails to a shared folder so legal can review them later.

Answer

Compress the emails into an encrypted file and continue with deletion.

Question 7

A business unit keeps a low-priority legacy tool but adds extra monitoring and patching. The company also buys cyber insurance to reduce the financial effect of a loss. Which two risk treatment strategies are being used? Select two.

Accepted Answer

Mitigation. Mitigation (B) is correct because the business unit keeps the legacy tool but reduces its risk exposure by adding extra monitoring and patching, which are compensating controls that lower the likelihood or impact of a loss. Transfer (D) is correct because purchasing cyber insurance shifts the financial consequences of a potential loss to the insurer, which is the defining characteristic of risk transfer. Acceptance (A) does not apply because the organization is actively applying controls rather than simply acknowledging and retaining the risk without action. Avoidance (C) does not apply because the legacy tool is still kept in use rather than being eliminated or discontinued. Deterrent (E) is not a distinct risk treatment strategy here; monitoring and patching are preventive/detective controls supporting mitigation, not a separate deterrent strategy.

Answer

Acceptance

Answer

Avoidance

Answer

Deterrent

Question 8

After several employees clicked on a realistic phishing email, management wants a control that both improves user behavior and gives the security team a way to measure improvement over time. Which approach is best?

Accepted Answer

Run simulated phishing campaigns with immediate feedback and follow-up training. Simulated phishing campaigns with immediate feedback and follow-up training directly address user behavior by providing a safe, controlled environment where employees can learn to recognize phishing attempts. This approach also gives the security team measurable metrics (e.g., click rates over time) to track improvement, aligning with the goal of both behavioral change and quantifiable assessment.

Answer

Send a company-wide reminder not to open suspicious emails

Answer

Block all external email messages at the gateway

Answer

Require employees to change passwords every week

Question 9

A development team needs to release a security fix to a customer portal, but the change must not introduce a new outage or bypass review controls. Which practice best supports a secure and repeatable release?

Accepted Answer

Use an approved pipeline with peer review, automated testing, and rollback steps. An approved pipeline with peer review, automated testing, and rollback steps ensures that the security fix is deployed in a controlled, repeatable manner. This approach prevents unauthorized changes, validates the fix through testing, and provides a safety net via rollback, directly addressing the requirement to avoid new outages and bypass review controls.

Answer

Apply the change directly in production so users get the fix immediately

Answer

Skip testing because security fixes should always be deployed quickly

Answer

Let any on-call developer approve and deploy without documentation

Question 10

A records manager learns that emails related to a harassment investigation are scheduled for deletion next week under the retention policy. Legal issues a hold because the case may go to court. What should the records manager do?

Accepted Answer

Suspend deletion until the legal hold is lifted. A legal hold overrides standard retention policies because it preserves electronically stored information (ESI) that may be relevant to litigation. The records manager must immediately suspend deletion to avoid spoliation, which could result in legal sanctions. This aligns with the eDiscovery process and the duty to preserve evidence once litigation is reasonably anticipated.

Answer

Delete the emails after creating a summary report

Answer

Archive the emails permanently in the same mailbox

Answer

Anonymize the sender names and keep the messages

Question 11

Based on the exhibit, what should the security team recommend before sharing the report?

Accepted Answer

Remove unnecessary personal fields and share only the minimum data needed for the analysis.. The principle of data minimization requires that only the minimum necessary data be shared to fulfill the analysis purpose. Removing unnecessary personal fields reduces the risk of exposing PII and aligns with privacy regulations such as GDPR and HIPAA, even when a nondisclosure agreement (NDA) is in place.

Answer

Share the report exactly as requested, because the vendor signed a nondisclosure agreement.

Answer

Keep all fields and encrypt the file before sending it to the vendor.

Answer

Store the report in a shared folder so the vendor can access it later if needed.

Question 12

After several employees clicked on phishing emails, management wants to reduce future click rates and show measurable improvement across finance, HR, and executive assistants. Which control best meets that goal?

Accepted Answer

Use role-based security awareness training with phishing simulations and metrics tracking.. Role-based security awareness training with phishing simulations and metrics tracking directly addresses the human factor by tailoring content to specific job roles (finance, HR, executive assistants) and provides measurable improvement through simulation click-rate data. This approach aligns with the NIST SP 800-50 framework for continuous security awareness, enabling management to track reduction in click rates over time.

Answer

Send a one-time company-wide memo reminding users not to click suspicious links.

Answer

Disable all external email attachments for every department indefinitely.

Answer

Require employees to complete annual policy acknowledgment without testing.

Question 13

The SOC is writing step-by-step instructions for responding to a suspected malware infection on a laptop. The document should tell analysts exactly what to do first, second, and third during triage and containment. Which governance artifact should they create?

Accepted Answer

Procedure, because it gives a repeatable sequence of actions for a specific task.. A procedure is the correct governance artifact because it provides a detailed, step-by-step sequence of actions for a specific task—in this case, triaging and containing a suspected malware infection on a laptop. Unlike policies or standards, which set high-level intent or goals, a procedure ensures repeatable and consistent execution by analysts during incident response.

Answer

Policy, because it states the organization's broad security intent.

Answer

Guideline, because it offers optional advice that analysts may choose to follow.

Answer

Standard, because it defines the organization's security goals at a high level.

Question 14

Based on the exhibit, which control option provides the greatest net annual financial benefit for the organization?

Accepted Answer

Option B, because its large reduction in annual loss outweighs the higher implementation cost.. It provides the greatest net annual financial benefit. With a loss reduction of $220,000 and an implementation cost of $120,000, the net benefit is $100,000, which is higher than any other option. This demonstrates that a larger upfront investment can be justified when the reduction in annualized loss expectancy (ALE) significantly outweighs the control cost.

Answer

Option A, because it reduces loss enough to justify the control cost better than the smaller controls.

Answer

Option C, because transferring the risk is always cheaper than engineering a technical fix.

Answer

Option D, because low upfront cost makes it the most economical option regardless of residual loss.

Question 15

A development team needs to release an urgent fix for a customer portal on Friday evening. The business wants the change to be reversible if something breaks, and security does not want the team to skip release controls. Which requirement should be part of the change process?

Accepted Answer

Require a documented test in a lower environment and a rollback plan before production approval.. It enforces a documented test in a lower environment and a rollback plan, which satisfies both the business requirement for reversibility and the security requirement to maintain release controls. This aligns with the change management process in the SY0-701 domain of Security Program Management and Oversight, ensuring that changes are validated before production deployment and can be undone if issues arise.

Answer

Deploy directly to production as soon as the patch compiles successfully.

Answer

Turn off logging during deployment to avoid filling the disk with change records.

Answer

Allow the release only if the developer verbally confirms the code is safe.