SY0-701 Security Program Management and Oversight Practice Test 13 — 15 Questions

Question 1

A records manager is told that some HR emails may be needed for an active investigation, while unrelated messages are still due for deletion under the retention schedule. Which two actions should the manager take? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the affected emails on legal hold. A is correct because placing the affected emails on legal hold suspends the retention schedule for those specific records, ensuring they are preserved for the active investigation without altering the deletion policy for unrelated messages. This is a standard practice under eDiscovery and legal hold procedures, often implemented via Exchange Online or similar systems using litigation hold or in-place hold.

Answer

Delete all related records immediately to reduce storage costs

Answer

Move them into a personal archive folder

Answer

Rewrite the retention schedule without approval

Question 2

A project team needs to use a temporary file-sharing service for two weeks because the approved platform is under maintenance. The security manager wants the exception to be reviewed, time-limited, and documented with the business reason. Which governance document should be created?

Accepted Answer

An exception request, because it records a deviation from the normal security requirement.. An exception request is the formal governance document used to record, review, and time-limit a deviation from the organization's security baseline. In this scenario, the temporary use of an unapproved file-sharing service for two weeks requires documented authorization, including the business reason, to ensure the risk is accepted and tracked until the approved platform returns.

Answer

A guideline, because it provides optional best practices for users to follow.

Answer

A standard, because it defines the mandatory company-wide rule for file sharing.

Answer

A procedure, because it gives step-by-step instructions for employees to follow.

Question 3

Based on the exhibit, which awareness action should the security manager prioritize next?

Accepted Answer

Launch role-based phishing training and reporting reinforcement for the highest-risk groups.. The exhibit shows that the highest-risk groups (e.g., finance, executives) have the highest phishing click rates. Option B is correct because role-based phishing training targets these specific users with simulated phishing campaigns and reporting reinforcement, which directly reduces the likelihood of successful social engineering attacks. This aligns with the principle of prioritizing remediation based on risk assessment data rather than blanket training.

Answer

Send the same annual awareness slide deck to everyone again without changing the content.

Answer

Block all external email so users cannot click suspicious messages.

Answer

Take no action because IT already reports suspicious messages well.

Question 4

Based on the exhibit, what should the security team recommend for the finance workstation pilot?

Accepted Answer

Require the vendor to provide the missing supply-chain documentation or an approved compensating-control plan before approval.. The exhibit indicates missing supply-chain documentation for the finance workstation pilot. Without this documentation, the security team cannot verify the integrity and provenance of the hardware and software, which is critical for a pilot involving sensitive financial data. Requiring the vendor to provide the missing documentation or an approved compensating-control plan ensures compliance with supply-chain risk management policies before approval.

Answer

Approve the pilot because the workstations are limited to read-only data and the application is signed.

Answer

Disable segmentation so the pilot can access more systems if troubleshooting is needed.

Answer

Let the finance director sign an informal email and skip the security review.

Question 5

An employee notices that a contractor left a printed report containing customer data on a conference room table. What should the employee do first?

Accepted Answer

Secure the report and report the incident through the company's approved process.. The immediate priority is to protect the sensitive customer data from further unauthorized access by securing the report, and then to follow the organization's incident response policy. This aligns with the principle of data breach containment and the requirement to report security incidents through official channels to ensure proper investigation and compliance with regulations like GDPR or HIPAA.

Answer

Take a photo of the report and post it in the team chat as a warning.

Answer

Leave the report where it is so the contractor can collect it later.

Answer

Shred the report immediately without telling anyone.

Question 6

Based on the exhibit, what is the best governance action before the sales team uses the legacy portal without MFA?

Accepted Answer

Create a formal time-bound exception with compensating controls, approval, and an expiration date.. Governance requires that any exception to a security policy (such as bypassing MFA) must be formally documented, approved by management, time-bound, and include compensating controls to mitigate risk. In this scenario, the legacy portal lacks MFA support, so a formal exception with an expiration date ensures the risk is tracked and re-evaluated, rather than permanently weakening security posture.

Answer

Update the policy immediately to allow password-only access for all legacy systems.

Answer

Have the help desk approve the request informally in the ticket and proceed without further documentation.

Answer

Ignore the MFA requirement because the portal is owned by a trusted partner.

Question 7

Based on the exhibit, what is the best next step before the marketing SaaS platform goes live?

Accepted Answer

Proceed only after the business owner formally accepts the remaining risk in writing.. The exhibit shows a residual risk rating of 'Medium' after the vendor's SOC report was reviewed. In the SY0-701 risk management framework, the business owner is the risk owner who must formally accept any residual risk before a system goes live, as they are accountable for the business impact. Proceeding without documented acceptance violates the principle of risk acceptance and could lead to unapproved exposure.

Answer

Ignore the residual risk because the vendor has a current SOC report.

Answer

Require the security team to approve the launch verbally so the project does not slow down.

Answer

Cancel the contract immediately because any medium risk rating is unacceptable.

Question 8

A policy states that sensitive data must be encrypted, but it does not say which encryption strength to use. The security architect wants a document that lists the exact approved encryption settings for systems to follow. What document is needed?

Accepted Answer

A standard, because it specifies the required technical values and configurations.. A standard is the correct document because it mandates specific, measurable technical requirements—such as exact encryption algorithms (e.g., AES-256), key lengths, and cipher modes (e.g., GCM)—that systems must follow to comply with the policy. Unlike a policy, which states a goal (e.g., 'encrypt sensitive data'), a standard provides the enforceable configuration baseline that the security architect needs.

Answer

A procedure, because it explains the step-by-step order for handling every file.

Answer

A guideline, because it gives suggestions that teams may choose to adopt.

Answer

A memo, because it is the fastest way to tell teams about a new requirement.

Question 9

Based on the exhibit, what is the best response to the facilities manager's request?

Accepted Answer

Deny the request and direct the manager to use an approved work-contact list or seek privacy review.. The facilities manager's request to export employee contact information for a separate system likely violates data privacy policies and potentially regulations like GDPR or CCPA. Option B is correct because the proper procedure is to deny the ad-hoc export and direct the manager to use an approved work-contact list or seek a privacy review, ensuring data handling complies with organizational data governance and privacy requirements.

Answer

Provide the export because the requester is a manager with a legitimate business relationship to employees.

Answer

Send the data to the manager if the manager promises not to share it externally.

Answer

Store the export in a shared drive so multiple teams can use it for convenience.

Question 10

A coworker asks for a spreadsheet containing employee home addresses and personal phone numbers so they can build a team contact list. What is the best response?

Accepted Answer

Confirm the requester is authorized and only provide the minimum personal data allowed by policy.. It aligns with the principle of least privilege and data minimization, which are core to security program management. Even internal requests must be verified for authorization, and only the minimum personal data required for the stated purpose should be shared, as per organizational policy and privacy regulations like GDPR or CCPA.

Answer

Share the spreadsheet, because the request is from another employee inside the company.

Answer

Email the full spreadsheet, because internal data is not protected by privacy rules.

Answer

Delete the spreadsheet immediately so the information cannot be misused.

Question 11

Based on the exhibit, which document should be updated first to reflect the new ticketing platform while keeping approval requirements unchanged?

Accepted Answer

Procedure, because the step-by-step instructions and screenshots are now outdated.. The procedure document contains the step-by-step instructions, including screenshots and specific commands for the old ticketing platform. Since the new platform changes the user interface and workflow steps, the procedure must be updated first to ensure technicians can follow accurate instructions. Policies and standards define high-level rules and approval requirements, which remain unchanged, so they do not need immediate revision.

Answer

Policy, because every tool change requires rewriting the corporate mandate.

Answer

Standard, because the approval workflow and evidence rules are still the same.

Answer

Guideline, because optional content should always be revised before mandatory content.

Question 12

A security team wants every company laptop to have the same screen-lock timeout, disk encryption setting, and local firewall configuration. Which type of document should define these mandatory settings?

Accepted Answer

A standard, because it specifies mandatory technical requirements.. A standard is the correct document type because it defines mandatory technical requirements that must be uniformly enforced across all company laptops. In this scenario, the screen-lock timeout, disk encryption setting (e.g., BitLocker or FileVault), and local firewall configuration (e.g., Windows Defender Firewall with Advanced Security) are non-negotiable controls that must be applied identically to every device to meet security policy. Standards are binding and often reference specific configuration baselines, such as CIS Benchmarks or NIST SP 800-53, ensuring consistent implementation.

Answer

A guideline, because employees can decide whether to follow it.

Answer

A risk register, because it tracks all security vulnerabilities on laptops.

Answer

A business impact analysis, because it identifies the most important laptop functions.

Question 13

After reviewing a risk memo, the operations director signs off on continuing to use an older application because the cost of replacement is too high right now. Which risk management action did the director take?

Accepted Answer

Risk acceptance, because management chose to live with the remaining risk.. The operations director chose to continue using the older application despite the identified risk, explicitly because the cost of replacement was too high. This is the definition of risk acceptance: management acknowledges the risk and decides to tolerate the residual risk without implementing additional controls. The director did not transfer, avoid, or mitigate the risk; they accepted it as a cost of business.

Answer

Risk transfer, because the risk was moved to another company.

Answer

Risk avoidance, because the application is still being used.

Answer

Risk mitigation, because the replacement cost was too high.

Question 14

A department wants to keep using a cloud printing service even though the vendor has not yet completed the company's security questionnaire. The business owner agrees to add extra log monitoring until the review is finished. What is the best term for the added monitoring?

Accepted Answer

A compensating control, because it reduces risk while the normal control is unavailable.. The added log monitoring is a compensating control because it provides an alternative security measure to mitigate risk while the primary control (the vendor's completed security questionnaire) is not yet in place. Compensating controls are temporary or alternative safeguards that reduce risk exposure when the preferred control cannot be implemented immediately. In this scenario, the monitoring does not eliminate the need for the questionnaire but reduces the risk of undetected malicious activity until the vendor's security posture is formally assessed.

Answer

Residual risk, because all risk is eliminated once monitoring is added.

Answer

Risk acceptance, because the business owner has approved continued use of the service.

Answer

Due diligence, because the company is actively reviewing the vendor.

Question 15

A help desk technician receives a ticket asking for a password reset on a manager's account. The requester says the manager is traveling and cannot be reached. What is the best action before making any change?

Accepted Answer

Verify the request through an approved identity-check process before taking action.. The principle of least privilege and proper identity verification are critical before performing any privileged action like a password reset. Without verifying the requester's identity through an approved process (e.g., out-of-band verification, knowledge-based authentication, or manager callback), the technician risks unauthorized access, which could lead to a security breach. This aligns with the CompTIA SY0-701 objective on implementing identity and access management controls.

Answer

Reset the password immediately to avoid delaying the manager's work.

Answer

Tell the requester to ask a coworker to share the manager's existing password.

Answer

Ignore the ticket until the manager returns from travel.