SY0-701 Security Program Management and Oversight Practice Test 12 — 15 Questions

Question 1

Several employees reported a text message that looked like it came from the VPN support team and linked to a fake sign-in page. Management wants to reduce future success of these attacks and improve how quickly users report suspicious messages. What should the security team implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run role-based smishing simulations and provide a simple reporting workflow. Smishing simulations train users to recognize phishing SMS attacks in a controlled environment, directly reducing susceptibility. A simple reporting workflow (e.g., a dedicated email address or button in the messaging app) lowers the friction for users to report suspicious messages, enabling faster incident response. This combination addresses both the reduction of attack success and the improvement of reporting speed.

Answer

Send one annual lecture to all staff and close the ticket

Answer

Disable text messaging for every employee mobile device

Answer

Require managers to approve every external message before users open it

Question 2

Based on the exhibit, what is the best next step before the hotfix is released?

Accepted Answer

Pause release until the change is formally approved, tested, and has a documented rollback path.. Releasing a hotfix without formal approval, testing, and a documented rollback path violates the change management policy required by security program management. Even for urgent customer-facing issues, skipping these steps risks introducing new vulnerabilities or breaking other systems, which could lead to a larger outage. The exhibit indicates a need for controlled change processes, so pausing until the change is properly vetted ensures stability and security.

Answer

Deploy immediately because the issue is customer-facing and urgent.

Answer

Close the ticket after deployment and create a postmortem if users complain.

Answer

Ask support to warn users that sign-in may fail during the next hour.

Question 3

After a phishing campaign, several employees entered credentials on a fake login page. Management wants a control that both improves user behavior and gives the security team a way to measure whether click rates are going down. Which two actions best meet that goal? Select two.

Accepted Answer

Run role-based phishing awareness training. Role-based phishing awareness training (B) directly improves user behavior by tailoring content to specific job functions, making the training more relevant and effective. Simulated phishing exercises with reporting metrics (D) provide a measurable way for the security team to track click rates over time, enabling data-driven assessment of improvement. Together, they address both behavioral change and quantifiable measurement.

Answer

Send a reminder email once a year and stop there

Answer

Disable all external email for every employee

Answer

Tell users to ignore suspicious messages unless IT calls first

Question 4

The CIO wants to compare two mitigation options for a payment system outage and justify the budget request in dollars. The team already knows the likely downtime window, annual incident frequency, and estimated revenue loss per hour. Which approach would best support the decision?

Accepted Answer

Quantitative risk analysis. Quantitative risk analysis (Option B) is correct because it uses numerical data—such as the likely downtime window, annual incident frequency, and estimated revenue loss per hour—to calculate a monetary value (e.g., Annualized Loss Expectancy). This directly supports the CIO's need to compare mitigation options in dollars and justify a budget request with hard numbers, unlike qualitative methods that rely on subjective ratings.

Answer

Qualitative risk analysis

Answer

Risk avoidance

Answer

Risk acceptance

Question 5

Based on the exhibit, what should the records manager do next?

Accepted Answer

Suspend deletion and preserve all related records until the legal hold is formally lifted.. When a legal hold is in effect, it overrides any standard retention or deletion policies. The records manager must suspend all deletion activities and preserve all related records until the legal hold is formally lifted, as failure to do so could result in spoliation of evidence and legal penalties.

Answer

Delete the records on schedule because the retention period is still the primary rule.

Answer

Move the records to long-term archive and continue the normal deletion schedule.

Answer

Print the records, delete the digital copies, and keep the paper copies instead.

Question 6

Based on the exhibit, which governance artifact is being described?

Accepted Answer

Baseline, because it defines the approved minimum configuration that systems must meet.. The exhibit describes a baseline because it specifies the approved minimum configuration settings that systems must meet, such as requiring AES-256 encryption, disabling weak protocols like SSL and TLS 1.0, and enforcing a minimum password length of 14 characters. These are mandatory security thresholds, not broad intent, step-by-step instructions, or optional standards.

Answer

Policy, because it states broad organizational intent without requiring specific settings.

Answer

Standard, because it defines mandatory requirements but does not describe a step-by-step process.

Answer

Procedure, because it explains the exact sequence an administrator should follow to secure the device.

Question 7

A company is signing a contract with a SaaS expense platform. Security wants the vendor to notify the company within 24 hours of a confirmed incident, maintain customer data segregation, and allow the company to verify security commitments if required. Which control should be added to the agreement?

Accepted Answer

A security addendum with SLA terms. A security addendum or contract clause set is the right place to define incident notification timing, data segregation expectations, and verification rights. These requirements need to be written into a binding agreement so both sides understand their responsibilities and so the customer has leverage if the vendor does not comply. This is stronger than informal assurances or generic privacy language.

Why others are wrong: An NDA is about secrecy, not measurable security obligations. A verbal promise is not enforceable and is weak evidence for oversight or audits. Default public terms often favor the vendor and may not cover incident timing or security commitments in enough detail. The organization needs a contract mechanism that clearly states the control expectations, not just a confidentiality promise.

Answer

A non-disclosure agreement only

Answer

A verbal assurance from the account representative

Answer

The vendor's standard public terms without changes

Question 8

After a phishing campaign, 18 employees entered credentials on a fake login page. Management wants a program that both reduces future click rates and provides measurable improvement over time. What should security implement?

Accepted Answer

Simulated phishing with targeted follow-up training and metrics. Simulated phishing campaigns directly address the human factor by providing a controlled, repeatable test that measures click rates over time. When an employee falls for the simulation, targeted follow-up training (e.g., micro-learning modules) reinforces secure behavior, and the metrics (e.g., click-through rate, reporting rate) allow management to track improvement. This aligns with the security program management goal of continuous improvement through measurable security awareness.

Answer

A one-time company email reminding employees to be careful

Answer

An updated password complexity rule for all users

Answer

A banner that all external email is untrusted

Question 9

A records manager finds a folder of payroll reports on a shared drive. The business says the reports are no longer active, but legal retention rules require keeping them for another two years. What is the best action?

Accepted Answer

Move the reports to an approved archive and retain them for the required period. The reports are subject to a legal retention policy requiring two more years of storage. Moving them to an approved archive ensures they remain accessible for compliance purposes while removing them from the active shared drive, which reduces the risk of accidental modification or deletion. This aligns with data lifecycle management and legal hold procedures.

Answer

Delete the reports immediately because the business no longer uses them

Answer

Email the reports to each manager so they can keep their own copy

Answer

Rename the folder so users do not notice it on the shared drive

Question 10

Based on the exhibit, what is the best next request before approving the vendor?

Accepted Answer

Request a current SOC 2 Type II report or equivalent independent operating-effectiveness attestation.. A SOC 2 Type II report provides an independent, third-party attestation of the effectiveness of a vendor's security controls over a period of time (typically 6–12 months). This is the most reliable evidence for verifying that the vendor's operational security controls are working as intended, which is critical before approving a vendor. The internal penetration test summary (Option B) lacks independence and may not cover all relevant controls, while a marketing brochure (Option A) is not a verifiable audit artifact. The shared responsibility matrix (Option C) defines roles but does not attest to control effectiveness.

Answer

Ask for a fresh marketing brochure that describes the vendor's security controls in detail.

Answer

Accept the internal penetration test summary because it proves the controls were tested recently.

Answer

Request only the shared responsibility matrix again, since it covers all security responsibilities.

Question 11

A project lead needs to send a spreadsheet labeled confidential to an external auditor. The file contains employee names, salaries, and performance notes. Which handling step best protects the data while still supporting the business need?

Accepted Answer

Use an approved encrypted file-sharing portal with named recipients and access logging. Using an approved encrypted file-sharing portal with named recipients and access logging ensures data-in-transit and data-at-rest encryption, restricts access to only the intended auditor, and provides an audit trail for compliance. This approach meets the business need of securely sharing confidential employee data while supporting regulatory requirements like GDPR or HIPAA, unlike unencrypted email which exposes data to interception.

Answer

Email the attachment unencrypted if the auditor signed an NDA

Answer

Upload the spreadsheet to a public link so the auditor can access it easily

Answer

Remove the confidential label before sending it to avoid confusion

Question 12

Based on the exhibit, what is the best handling decision for the requested file?

Accepted Answer

Treat it as Restricted, redact unnecessary fields, and provide only the minimum approved dataset through a logged encrypted transfer.. The file contains personally identifiable information (PII) in the form of a Social Security Number (SSN), which requires handling under a Restricted classification per most data governance frameworks. The correct procedure is to redact unnecessary fields, such as the full SSN, and transmit only the minimum approved dataset via a logged encrypted transfer (e.g., using SFTP or HTTPS with TLS 1.2+) to ensure confidentiality, integrity, and auditability. This aligns with the principle of least privilege and data minimization, which are core to security program management.

Answer

Share the full file by email as Confidential because only the last four digits of the SSN are included.

Answer

Label it Public because the contractor needs the information to troubleshoot effectively.

Answer

Mark it Internal and place it on the shared project drive for easy access.

Question 13

A security team is defining the minimum approved configuration for all new Linux web servers. The document must require specific logging settings, approved packages, and disabled services, and administrators must check servers against it during audits. Which governance artifact best fits this need?

Accepted Answer

Baseline, because it defines the minimum approved configuration that systems should meet.. A baseline is the correct governance artifact because it defines the minimum approved configuration that systems must meet, including specific logging settings, approved packages, and disabled services. In the context of Linux web servers, a baseline ensures consistent security posture by providing a measurable standard that administrators can audit against, such as verifying that rsyslog is configured for remote logging, only packages like Apache or Nginx from approved repositories are installed, and services like Telnet or FTP are disabled. This aligns with the requirement for enforcement and auditability, unlike a guideline which is merely advisory.

Answer

Guideline, because it suggests recommended settings without requiring enforcement.

Answer

Policy, because it is the high-level statement of intent for the organization.

Answer

Procedure, because it explains the exact steps to install and configure each server.

Question 14

An organization is evaluating a payroll SaaS provider after the procurement team asks for evidence that the vendor's security controls were designed and operating effectively during the past year. Which document should the security team review first?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides an independent auditor's assessment of a service organization's controls over a period of time (typically 6–12 months), confirming that security controls were not only designed but also operating effectively. This directly meets the procurement team's need for evidence of the vendor's security posture over the past year, as required for evaluating a SaaS provider handling sensitive payroll data.

Answer

Memorandum of understanding

Answer

Software license agreement

Answer

Network diagram of the vendor's data center

Question 15

A security manager publishes a document that tells help desk staff exactly how to verify identity, reset an admin password, record the ticket number, and close out the request during a maintenance window. What type of governance artifact is this?

Accepted Answer

Procedure. A procedure is a step-by-step, ordered list of tasks required to perform a specific operational activity. The document describes exactly how to verify identity, reset an admin password, record the ticket number, and close out the request, which matches the definition of a procedure in governance frameworks.

Answer

Policy

Answer

Standard

Answer

Guideline