SY0-701 Security Program Management and Oversight Practice Test 11 — 15 Questions

Question 1

A development team needs to release a security fix to a customer portal, but the change must not introduce a new outage or bypass review controls. Which practice best supports a secure and repeatable release?

Accepted Answer

Use an approved pipeline with peer review, automated testing, and rollback steps. Option B is correct because an approved pipeline with peer review, automated testing, and rollback steps ensures that the security fix is deployed in a controlled, repeatable manner. This approach prevents unauthorized changes, validates the fix through testing, and provides a safety net via rollback, directly addressing the requirement to avoid new outages and bypass review controls.

Answer

Apply the change directly in production so users get the fix immediately

Answer

Skip testing because security fixes should always be deployed quickly

Answer

Let any on-call developer approve and deploy without documentation

Question 2

A records manager learns that emails related to a harassment investigation are scheduled for deletion next week under the retention policy. Legal issues a hold because the case may go to court. What should the records manager do?

Accepted Answer

Suspend deletion until the legal hold is lifted. A legal hold overrides standard retention policies because it preserves electronically stored information (ESI) that may be relevant to litigation. The records manager must immediately suspend deletion to avoid spoliation, which could result in legal sanctions. This aligns with the eDiscovery process and the duty to preserve evidence once litigation is reasonably anticipated.

Answer

Delete the emails after creating a summary report

Answer

Archive the emails permanently in the same mailbox

Answer

Anonymize the sender names and keep the messages

Question 3

Based on the exhibit, what should the security team recommend before sharing the report?

Accepted Answer

Remove unnecessary personal fields and share only the minimum data needed for the analysis.. Option B is correct because the principle of data minimization requires that only the minimum necessary data be shared to fulfill the analysis purpose. Removing unnecessary personal fields reduces the risk of exposing PII and aligns with privacy regulations such as GDPR and HIPAA, even when a nondisclosure agreement (NDA) is in place.

Answer

Share the report exactly as requested, because the vendor signed a nondisclosure agreement.

Answer

Keep all fields and encrypt the file before sending it to the vendor.

Answer

Store the report in a shared folder so the vendor can access it later if needed.

Question 4

After several employees clicked on phishing emails, management wants to reduce future click rates and show measurable improvement across finance, HR, and executive assistants. Which control best meets that goal?

Accepted Answer

Use role-based security awareness training with phishing simulations and metrics tracking.. Option B is correct because role-based security awareness training with phishing simulations and metrics tracking directly addresses the human factor by tailoring content to specific job roles (finance, HR, executive assistants) and provides measurable improvement through simulation click-rate data. This approach aligns with the NIST SP 800-50 framework for continuous security awareness, enabling management to track reduction in click rates over time.

Answer

Send a one-time company-wide memo reminding users not to click suspicious links.

Answer

Disable all external email attachments for every department indefinitely.

Answer

Require employees to complete annual policy acknowledgment without testing.

Question 5

The SOC is writing step-by-step instructions for responding to a suspected malware infection on a laptop. The document should tell analysts exactly what to do first, second, and third during triage and containment. Which governance artifact should they create?

Accepted Answer

Procedure, because it gives a repeatable sequence of actions for a specific task.. A procedure is the correct governance artifact because it provides a detailed, step-by-step sequence of actions for a specific task—in this case, triaging and containing a suspected malware infection on a laptop. Unlike policies or standards, which set high-level intent or goals, a procedure ensures repeatable and consistent execution by analysts during incident response.

Answer

Policy, because it states the organization's broad security intent.

Answer

Guideline, because it offers optional advice that analysts may choose to follow.

Answer

Standard, because it defines the organization's security goals at a high level.

Question 6

Based on the exhibit, which control option provides the greatest net annual financial benefit for the organization?

Accepted Answer

Option B, because its large reduction in annual loss outweighs the higher implementation cost.. Option B is correct because it provides the greatest net annual financial benefit. The annual loss reduction of $150,000 minus the annual implementation cost of $75,000 yields a net benefit of $75,000, which is higher than any other option. This demonstrates that a larger upfront investment can be justified when the reduction in annualized loss expectancy (ALE) significantly outweighs the control cost.

Answer

Option A, because it reduces loss enough to justify the control cost better than the smaller controls.

Answer

Option C, because transferring the risk is always cheaper than engineering a technical fix.

Answer

Option D, because low upfront cost makes it the most economical option regardless of residual loss.

Question 7

A development team needs to release an urgent fix for a customer portal on Friday evening. The business wants the change to be reversible if something breaks, and security does not want the team to skip release controls. Which requirement should be part of the change process?

Accepted Answer

Require a documented test in a lower environment and a rollback plan before production approval.. Option B is correct because it enforces a documented test in a lower environment and a rollback plan, which satisfies both the business requirement for reversibility and the security requirement to maintain release controls. This aligns with the change management process in the SY0-701 domain of Security Program Management and Oversight, ensuring that changes are validated before production deployment and can be undone if issues arise.

Answer

Deploy directly to production as soon as the patch compiles successfully.

Answer

Turn off logging during deployment to avoid filling the disk with change records.

Answer

Allow the release only if the developer verbally confirms the code is safe.

Question 8

Several employees reported a text message that looked like it came from the VPN support team and linked to a fake sign-in page. Management wants to reduce future success of these attacks and improve how quickly users report suspicious messages. What should the security team implement?

Accepted Answer

Run role-based smishing simulations and provide a simple reporting workflow. Option B is correct because smishing simulations train users to recognize phishing SMS attacks in a controlled environment, directly reducing susceptibility. A simple reporting workflow (e.g., a dedicated email address or button in the messaging app) lowers the friction for users to report suspicious messages, enabling faster incident response. This combination addresses both the reduction of attack success and the improvement of reporting speed.

Answer

Send one annual lecture to all staff and close the ticket

Answer

Disable text messaging for every employee mobile device

Answer

Require managers to approve every external message before users open it

Question 9

Based on the exhibit, what is the best next step before the hotfix is released?

Accepted Answer

Pause release until the change is formally approved, tested, and has a documented rollback path.. Option D is correct because releasing a hotfix without formal approval, testing, and a documented rollback path violates the change management policy required by security program management. Even for urgent customer-facing issues, skipping these steps risks introducing new vulnerabilities or breaking other systems, which could lead to a larger outage. The exhibit indicates a need for controlled change processes, so pausing until the change is properly vetted ensures stability and security.

Answer

Deploy immediately because the issue is customer-facing and urgent.

Answer

Close the ticket after deployment and create a postmortem if users complain.

Answer

Ask support to warn users that sign-in may fail during the next hour.

Question 10

After a phishing campaign, several employees entered credentials on a fake login page. Management wants a control that both improves user behavior and gives the security team a way to measure whether click rates are going down. Which two actions best meet that goal? Select two.

Accepted Answer

Run role-based phishing awareness training. Role-based phishing awareness training (B) directly improves user behavior by tailoring content to specific job functions, making the training more relevant and effective. Simulated phishing exercises with reporting metrics (D) provide a measurable way for the security team to track click rates over time, enabling data-driven assessment of improvement. Together, they address both behavioral change and quantifiable measurement.

Answer

Send a reminder email once a year and stop there

Answer

Disable all external email for every employee

Answer

Tell users to ignore suspicious messages unless IT calls first

Question 11

The CIO wants to compare two mitigation options for a payment system outage and justify the budget request in dollars. The team already knows the likely downtime window, annual incident frequency, and estimated revenue loss per hour. Which approach would best support the decision?

Accepted Answer

Quantitative risk analysis. Quantitative risk analysis (Option B) is correct because it uses numerical data—such as the likely downtime window, annual incident frequency, and estimated revenue loss per hour—to calculate a monetary value (e.g., Annualized Loss Expectancy). This directly supports the CIO's need to compare mitigation options in dollars and justify a budget request with hard numbers, unlike qualitative methods that rely on subjective ratings.

Answer

Qualitative risk analysis

Answer

Risk avoidance

Answer

Risk acceptance

Question 12

Based on the exhibit, what should the records manager do next?

Accepted Answer

Suspend deletion and preserve all related records until the legal hold is formally lifted.. Option D is correct because when a legal hold is in effect, it overrides any standard retention or deletion policies. The records manager must suspend all deletion activities and preserve all related records until the legal hold is formally lifted, as failure to do so could result in spoliation of evidence and legal penalties.

Answer

Delete the records on schedule because the retention period is still the primary rule.

Answer

Move the records to long-term archive and continue the normal deletion schedule.

Answer

Print the records, delete the digital copies, and keep the paper copies instead.

Question 13

A security manager issues a mandatory document that requires all corporate laptops to use full-disk encryption, automatic screen lock after 10 minutes, and approved endpoint protection software. The document will be checked during compliance reviews. Which governance artifact is this?

Accepted Answer

Standard. The document is a mandatory requirement that must be followed and is enforced through compliance reviews, which aligns with the definition of a policy. Policies are high-level, mandatory directives that set the overall security stance of an organization, such as requiring full-disk encryption (e.g., AES-256) and automatic screen lock after 10 minutes. This document is not a standard because it does not provide specific technical configurations or baselines, nor is it a procedure or guideline, as it lacks step-by-step instructions or optional recommendations.

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 14

Based on the exhibit, which governance artifact is being described?

Accepted Answer

Baseline, because it defines the approved minimum configuration that systems must meet.. The exhibit describes a baseline because it specifies the approved minimum configuration settings that systems must meet, such as requiring AES-256 encryption, disabling weak protocols like SSL and TLS 1.0, and enforcing a minimum password length of 14 characters. These are mandatory security thresholds, not broad intent, step-by-step instructions, or optional standards.

Answer

Policy, because it states broad organizational intent without requiring specific settings.

Answer

Standard, because it defines mandatory requirements but does not describe a step-by-step process.

Answer

Procedure, because it explains the exact sequence an administrator should follow to secure the device.

Question 15

A security manager is creating a document that requires every corporate laptop to use full-disk encryption, automatic screen locking after 10 minutes, and approved antivirus software. Which two governance artifacts best fit those requirements? Select two.

Accepted Answer

Standard. Option B (Standard) is correct because a standard defines mandatory technical configurations, such as requiring full-disk encryption (e.g., AES-256 via BitLocker or FileVault), automatic screen locking after 10 minutes, and approved antivirus software. Standards are specific, enforceable baselines that implement the broader intent of a policy, making them the appropriate artifact for these concrete security controls.

Answer

Policy

Answer

Procedure

Answer

Guideline