SY0-701 Security Program Management and Oversight Practice Test 12 — 15 Questions

Question 1

A company is signing a contract with a SaaS expense platform. Security wants the vendor to notify the company within 24 hours of a confirmed incident, maintain customer data segregation, and allow the company to verify security commitments if required. Which control should be added to the agreement?

Accepted Answer

A security addendum with SLA terms. A security addendum or contract clause set is the right place to define incident notification timing, data segregation expectations, and verification rights. These requirements need to be written into a binding agreement so both sides understand their responsibilities and so the customer has leverage if the vendor does not comply. This is stronger than informal assurances or generic privacy language.

Why others are wrong: An NDA is about secrecy, not measurable security obligations. A verbal promise is not enforceable and is weak evidence for oversight or audits. Default public terms often favor the vendor and may not cover incident timing or security commitments in enough detail. The organization needs a contract mechanism that clearly states the control expectations, not just a confidentiality promise.

Answer

A non-disclosure agreement only

Answer

A verbal assurance from the account representative

Answer

The vendor's standard public terms without changes

Question 2

After a phishing campaign, 18 employees entered credentials on a fake login page. Management wants a program that both reduces future click rates and provides measurable improvement over time. What should security implement?

Accepted Answer

Simulated phishing with targeted follow-up training and metrics. Option B is correct because simulated phishing campaigns directly address the human factor by providing a controlled, repeatable test that measures click rates over time. When an employee falls for the simulation, targeted follow-up training (e.g., micro-learning modules) reinforces secure behavior, and the metrics (e.g., click-through rate, reporting rate) allow management to track improvement. This aligns with the security program management goal of continuous improvement through measurable security awareness.

Answer

A one-time company email reminding employees to be careful

Answer

An updated password complexity rule for all users

Answer

A banner that all external email is untrusted

Question 3

A records manager finds a folder of payroll reports on a shared drive. The business says the reports are no longer active, but legal retention rules require keeping them for another two years. What is the best action?

Accepted Answer

Move the reports to an approved archive and retain them for the required period. Option B is correct because the reports are subject to a legal retention policy requiring two more years of storage. Moving them to an approved archive ensures they remain accessible for compliance purposes while removing them from the active shared drive, which reduces the risk of accidental modification or deletion. This aligns with data lifecycle management and legal hold procedures.

Answer

Delete the reports immediately because the business no longer uses them

Answer

Email the reports to each manager so they can keep their own copy

Answer

Rename the folder so users do not notice it on the shared drive

Question 4

A security manager is creating a company-wide requirement that all Windows laptops must have full-disk encryption, screen lock after 10 minutes, and approved antivirus enabled. Administrators can choose the exact implementation details, but the minimum settings must be mandatory across the fleet. Which governance artifact should the manager update?

Accepted Answer

Standard. A policy is a high-level management directive that mandates specific security outcomes (e.g., 'all laptops must have full-disk encryption, screen lock after 10 minutes, and approved antivirus enabled') without prescribing the exact technical implementation. The security manager is setting mandatory minimum requirements, which is the defining characteristic of a policy. Standards, by contrast, provide the specific technical configurations or baselines (e.g., 'use BitLocker with AES-256'), which the administrators will choose later.

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 5

Based on the exhibit, what is the best next request before approving the vendor?

Accepted Answer

Request a current SOC 2 Type II report or equivalent independent operating-effectiveness attestation.. Option D is correct because a SOC 2 Type II report provides an independent, third-party attestation of the effectiveness of a vendor's security controls over a period of time (typically 6–12 months). This is the most reliable evidence for verifying that the vendor's operational security controls are working as intended, which is critical before approving a vendor. The internal penetration test summary (Option B) lacks independence and may not cover all relevant controls, while a marketing brochure (Option A) is not a verifiable audit artifact. The shared responsibility matrix (Option C) defines roles but does not attest to control effectiveness.

Answer

Ask for a fresh marketing brochure that describes the vendor's security controls in detail.

Answer

Accept the internal penetration test summary because it proves the controls were tested recently.

Answer

Request only the shared responsibility matrix again, since it covers all security responsibilities.

Question 6

A project lead needs to send a spreadsheet labeled confidential to an external auditor. The file contains employee names, salaries, and performance notes. Which handling step best protects the data while still supporting the business need?

Accepted Answer

Use an approved encrypted file-sharing portal with named recipients and access logging. Option B is correct because using an approved encrypted file-sharing portal with named recipients and access logging ensures data-in-transit and data-at-rest encryption, restricts access to only the intended auditor, and provides an audit trail for compliance. This approach meets the business need of securely sharing confidential employee data while supporting regulatory requirements like GDPR or HIPAA, unlike unencrypted email which exposes data to interception.

Answer

Email the attachment unencrypted if the auditor signed an NDA

Answer

Upload the spreadsheet to a public link so the auditor can access it easily

Answer

Remove the confidential label before sending it to avoid confusion

Question 7

Based on the exhibit, what is the best handling decision for the requested file?

Accepted Answer

Treat it as Restricted, redact unnecessary fields, and provide only the minimum approved dataset through a logged encrypted transfer.. Option D is correct because the file contains personally identifiable information (PII) in the form of a Social Security Number (SSN), which requires handling under a Restricted classification per most data governance frameworks. The correct procedure is to redact unnecessary fields, such as the full SSN, and transmit only the minimum approved dataset via a logged encrypted transfer (e.g., using SFTP or HTTPS with TLS 1.2+) to ensure confidentiality, integrity, and auditability. This aligns with the principle of least privilege and data minimization, which are core to security program management.

Answer

Share the full file by email as Confidential because only the last four digits of the SSN are included.

Answer

Label it Public because the contractor needs the information to troubleshoot effectively.

Answer

Mark it Internal and place it on the shared project drive for easy access.

Question 8

Based on the exhibit, which action should the security team prioritize next?

Accepted Answer

Deploy role-based phishing training, recurring simulations, and a simple reporting workflow.. Option D is correct because the exhibit (not shown here, but implied by the question) likely shows that a phishing simulation has been completed and that the organization needs to move from a one-size-fits-all awareness approach to a sustainable, role-based security training program. Deploying role-based phishing training, recurring simulations, and a simple reporting workflow addresses the root cause of user susceptibility by tailoring content to specific job functions, reinforcing learning through repetition, and enabling users to report suspicious emails easily, which aligns with NIST SP 800-50 and the continuous improvement cycle of security awareness programs.

Answer

Send a company-wide reminder to never click links in email, regardless of sender.

Answer

Focus only on punitive action for users who failed the simulation.

Answer

Run the same broad awareness module again for all employees at the same time.

Question 9

A security team is defining the minimum approved configuration for all new Linux web servers. The document must require specific logging settings, approved packages, and disabled services, and administrators must check servers against it during audits. Which governance artifact best fits this need?

Accepted Answer

Baseline, because it defines the minimum approved configuration that systems should meet.. A baseline is the correct governance artifact because it defines the minimum approved configuration that systems must meet, including specific logging settings, approved packages, and disabled services. In the context of Linux web servers, a baseline ensures consistent security posture by providing a measurable standard that administrators can audit against, such as verifying that rsyslog is configured for remote logging, only packages like Apache or Nginx from approved repositories are installed, and services like Telnet or FTP are disabled. This aligns with the requirement for enforcement and auditability, unlike a guideline which is merely advisory.

Answer

Guideline, because it suggests recommended settings without requiring enforcement.

Answer

Policy, because it is the high-level statement of intent for the organization.

Answer

Procedure, because it explains the exact steps to install and configure each server.

Question 10

An organization is evaluating a payroll SaaS provider after the procurement team asks for evidence that the vendor's security controls were designed and operating effectively during the past year. Which document should the security team review first?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides an independent auditor's assessment of a service organization's controls over a period of time (typically 6–12 months), confirming that security controls were not only designed but also operating effectively. This directly meets the procurement team's need for evidence of the vendor's security posture over the past year, as required for evaluating a SaaS provider handling sensitive payroll data.

Answer

Memorandum of understanding

Answer

Software license agreement

Answer

Network diagram of the vendor's data center

Question 11

A manager needs to send a spreadsheet containing employee names, salaries, and performance notes to an external auditor. Which two actions best support proper data handling? Select two.

Accepted Answer

Apply the correct classification label before sending. Option A is correct because applying the correct classification label (e.g., 'Confidential' or 'Internal Use Only') ensures that the data is properly identified and handled according to the organization's data classification policy. This is a foundational step in data handling, as it triggers appropriate security controls such as encryption, access restrictions, and handling procedures. Without a classification label, the sensitivity of the data may be overlooked, leading to potential mishandling.

Answer

Upload the file to a personal cloud account

Answer

Remove the salary columns and send the rest by email

Answer

Print the file and leave it on a shared desk

Question 12

A security manager publishes a document that tells help desk staff exactly how to verify identity, reset an admin password, record the ticket number, and close out the request during a maintenance window. What type of governance artifact is this?

Accepted Answer

Procedure. Option C is correct because a procedure is a step-by-step, ordered list of tasks required to perform a specific operational activity. The document describes exactly how to verify identity, reset an admin password, record the ticket number, and close out the request, which matches the definition of a procedure in governance frameworks.

Answer

Policy

Answer

Standard

Answer

Guideline

Question 13

A records manager is told that some HR emails may be needed for an active investigation, while unrelated messages are still due for deletion under the retention schedule. Which two actions should the manager take? Select two.

Accepted Answer

Place the affected emails on legal hold. A is correct because placing the affected emails on legal hold suspends the retention schedule for those specific records, ensuring they are preserved for the active investigation without altering the deletion policy for unrelated messages. This is a standard practice under eDiscovery and legal hold procedures, often implemented via Exchange Online or similar systems using litigation hold or in-place hold.

Answer

Delete all related records immediately to reduce storage costs

Answer

Move them into a personal archive folder

Answer

Rewrite the retention schedule without approval

Question 14

A project team needs to use a temporary file-sharing service for two weeks because the approved platform is under maintenance. The security manager wants the exception to be reviewed, time-limited, and documented with the business reason. Which governance document should be created?

Accepted Answer

An exception request, because it records a deviation from the normal security requirement.. Option B is correct because an exception request is the formal governance document used to record, review, and time-limit a deviation from the organization's security baseline. In this scenario, the temporary use of an unapproved file-sharing service for two weeks requires documented authorization, including the business reason, to ensure the risk is accepted and tracked until the approved platform returns.

Answer

A guideline, because it provides optional best practices for users to follow.

Answer

A standard, because it defines the mandatory company-wide rule for file sharing.

Answer

A procedure, because it gives step-by-step instructions for employees to follow.

Question 15

Based on the exhibit, which awareness action should the security manager prioritize next?

Accepted Answer

Launch role-based phishing training and reporting reinforcement for the highest-risk groups.. The exhibit shows that the highest-risk groups (e.g., finance, executives) have the highest phishing click rates. Option B is correct because role-based phishing training targets these specific users with simulated phishing campaigns and reporting reinforcement, which directly reduces the likelihood of successful social engineering attacks. This aligns with the principle of prioritizing remediation based on risk assessment data rather than blanket training.

Answer

Send the same annual awareness slide deck to everyone again without changing the content.

Answer

Block all external email so users cannot click suspicious messages.

Answer

Take no action because IT already reports suspicious messages well.