SY0-701 Security Program Management and Oversight Practice Test 13 — 15 Questions

Question 1

Based on the exhibit, what should the security team recommend for the finance workstation pilot?

Accepted Answer

Require the vendor to provide the missing supply-chain documentation or an approved compensating-control plan before approval.. Option B is correct because the exhibit indicates missing supply-chain documentation for the finance workstation pilot. Without this documentation, the security team cannot verify the integrity and provenance of the hardware and software, which is critical for a pilot involving sensitive financial data. Requiring the vendor to provide the missing documentation or an approved compensating-control plan ensures compliance with supply-chain risk management policies before approval.

Answer

Approve the pilot because the workstations are limited to read-only data and the application is signed.

Answer

Disable segmentation so the pilot can access more systems if troubleshooting is needed.

Answer

Let the finance director sign an informal email and skip the security review.

Question 2

An employee notices that a contractor left a printed report containing customer data on a conference room table. What should the employee do first?

Accepted Answer

Secure the report and report the incident through the company's approved process.. Option B is correct because the immediate priority is to protect the sensitive customer data from further unauthorized access by securing the report, and then to follow the organization's incident response policy. This aligns with the principle of data breach containment and the requirement to report security incidents through official channels to ensure proper investigation and compliance with regulations like GDPR or HIPAA.

Answer

Take a photo of the report and post it in the team chat as a warning.

Answer

Leave the report where it is so the contractor can collect it later.

Answer

Shred the report immediately without telling anyone.

Question 3

Based on the exhibit, what is the best governance action before the sales team uses the legacy portal without MFA?

Accepted Answer

Create a formal time-bound exception with compensating controls, approval, and an expiration date.. Option B is correct because governance requires that any exception to a security policy (such as bypassing MFA) must be formally documented, approved by management, time-bound, and include compensating controls to mitigate risk. In this scenario, the legacy portal lacks MFA support, so a formal exception with an expiration date ensures the risk is tracked and re-evaluated, rather than permanently weakening security posture.

Answer

Update the policy immediately to allow password-only access for all legacy systems.

Answer

Have the help desk approve the request informally in the ticket and proceed without further documentation.

Answer

Ignore the MFA requirement because the portal is owned by a trusted partner.

Question 4

Based on the exhibit, what is the best next step before the marketing SaaS platform goes live?

Accepted Answer

Proceed only after the business owner formally accepts the remaining risk in writing.. The exhibit shows a residual risk rating of 'Medium' after the vendor's SOC report was reviewed. In the SY0-701 risk management framework, the business owner is the risk owner who must formally accept any residual risk before a system goes live, as they are accountable for the business impact. Proceeding without documented acceptance violates the principle of risk acceptance and could lead to unapproved exposure.

Answer

Ignore the residual risk because the vendor has a current SOC report.

Answer

Require the security team to approve the launch verbally so the project does not slow down.

Answer

Cancel the contract immediately because any medium risk rating is unacceptable.

Question 5

Based on the exhibit, which contract change would most directly reduce the organization's third-party response risk?

Accepted Answer

Add a breach notification timeframe and a right-to-review assurance clause in the contract.. Adding a breach notification timeframe and a right-to-review assurance clause directly reduces third-party response risk by ensuring the vendor must promptly report security incidents and allow the organization to audit their security posture. This contractual change enforces accountability and timely action, which is critical for minimizing the impact of a breach originating from the third party.

Answer

Ask the vendor to provide a color logo and updated marketing brochure for the pilot.

Answer

Allow the vendor to start first and decide later whether to add security terms.

Answer

Replace the pilot with a purely internal spreadsheet process to avoid any contract review.

Question 6

A policy states that sensitive data must be encrypted, but it does not say which encryption strength to use. The security architect wants a document that lists the exact approved encryption settings for systems to follow. What document is needed?

Accepted Answer

A standard, because it specifies the required technical values and configurations.. A standard is the correct document because it mandates specific, measurable technical requirements—such as exact encryption algorithms (e.g., AES-256), key lengths, and cipher modes (e.g., GCM)—that systems must follow to comply with the policy. Unlike a policy, which states a goal (e.g., 'encrypt sensitive data'), a standard provides the enforceable configuration baseline that the security architect needs.

Answer

A procedure, because it explains the step-by-step order for handling every file.

Answer

A guideline, because it gives suggestions that teams may choose to adopt.

Answer

A memo, because it is the fastest way to tell teams about a new requirement.

Question 7

Based on the exhibit, what is the best response to the facilities manager's request?

Accepted Answer

Deny the request and direct the manager to use an approved work-contact list or seek privacy review.. The facilities manager's request to export employee contact information for a separate system likely violates data privacy policies and potentially regulations like GDPR or CCPA. Option B is correct because the proper procedure is to deny the ad-hoc export and direct the manager to use an approved work-contact list or seek a privacy review, ensuring data handling complies with organizational data governance and privacy requirements.

Answer

Provide the export because the requester is a manager with a legitimate business relationship to employees.

Answer

Send the data to the manager if the manager promises not to share it externally.

Answer

Store the export in a shared drive so multiple teams can use it for convenience.

Question 8

A coworker asks for a spreadsheet containing employee home addresses and personal phone numbers so they can build a team contact list. What is the best response?

Accepted Answer

Confirm the requester is authorized and only provide the minimum personal data allowed by policy.. Option B is correct because it aligns with the principle of least privilege and data minimization, which are core to security program management. Even internal requests must be verified for authorization, and only the minimum personal data required for the stated purpose should be shared, as per organizational policy and privacy regulations like GDPR or CCPA.

Answer

Share the spreadsheet, because the request is from another employee inside the company.

Answer

Email the full spreadsheet, because internal data is not protected by privacy rules.

Answer

Delete the spreadsheet immediately so the information cannot be misused.

Question 9

Based on the exhibit, which document should be updated first to reflect the new ticketing platform while keeping approval requirements unchanged?

Accepted Answer

Procedure, because the step-by-step instructions and screenshots are now outdated.. The procedure document contains the step-by-step instructions, including screenshots and specific commands for the old ticketing platform. Since the new platform changes the user interface and workflow steps, the procedure must be updated first to ensure technicians can follow accurate instructions. Policies and standards define high-level rules and approval requirements, which remain unchanged, so they do not need immediate revision.

Answer

Policy, because every tool change requires rewriting the corporate mandate.

Answer

Standard, because the approval workflow and evidence rules are still the same.

Answer

Guideline, because optional content should always be revised before mandatory content.

Question 10

A security team wants every company laptop to have the same screen-lock timeout, disk encryption setting, and local firewall configuration. Which type of document should define these mandatory settings?

Accepted Answer

A standard, because it specifies mandatory technical requirements.. A standard is the correct document type because it defines mandatory technical requirements that must be uniformly enforced across all company laptops. In this scenario, the screen-lock timeout, disk encryption setting (e.g., BitLocker or FileVault), and local firewall configuration (e.g., Windows Defender Firewall with Advanced Security) are non-negotiable controls that must be applied identically to every device to meet security policy. Standards are binding and often reference specific configuration baselines, such as CIS Benchmarks or NIST SP 800-53, ensuring consistent implementation.

Answer

A guideline, because employees can decide whether to follow it.

Answer

A risk register, because it tracks all security vulnerabilities on laptops.

Answer

A business impact analysis, because it identifies the most important laptop functions.

Question 11

After reviewing a risk memo, the operations director signs off on continuing to use an older application because the cost of replacement is too high right now. Which risk management action did the director take?

Accepted Answer

Risk acceptance, because management chose to live with the remaining risk.. The operations director chose to continue using the older application despite the identified risk, explicitly because the cost of replacement was too high. This is the definition of risk acceptance: management acknowledges the risk and decides to tolerate the residual risk without implementing additional controls. The director did not transfer, avoid, or mitigate the risk; they accepted it as a cost of business.

Answer

Risk transfer, because the risk was moved to another company.

Answer

Risk avoidance, because the application is still being used.

Answer

Risk mitigation, because the replacement cost was too high.

Question 12

A department wants to keep using a cloud printing service even though the vendor has not yet completed the company's security questionnaire. The business owner agrees to add extra log monitoring until the review is finished. What is the best term for the added monitoring?

Accepted Answer

A compensating control, because it reduces risk while the normal control is unavailable.. The added log monitoring is a compensating control because it provides an alternative security measure to mitigate risk while the primary control (the vendor's completed security questionnaire) is not yet in place. Compensating controls are temporary or alternative safeguards that reduce risk exposure when the preferred control cannot be implemented immediately. In this scenario, the monitoring does not eliminate the need for the questionnaire but reduces the risk of undetected malicious activity until the vendor's security posture is formally assessed.

Answer

Residual risk, because all risk is eliminated once monitoring is added.

Answer

Risk acceptance, because the business owner has approved continued use of the service.

Answer

Due diligence, because the company is actively reviewing the vendor.

Question 13

A help desk technician receives a ticket asking for a password reset on a manager's account. The requester says the manager is traveling and cannot be reached. What is the best action before making any change?

Accepted Answer

Verify the request through an approved identity-check process before taking action.. Option B is correct because the principle of least privilege and proper identity verification are critical before performing any privileged action like a password reset. Without verifying the requester's identity through an approved process (e.g., out-of-band verification, knowledge-based authentication, or manager callback), the technician risks unauthorized access, which could lead to a security breach. This aligns with the CompTIA SY0-701 objective on implementing identity and access management controls.

Answer

Reset the password immediately to avoid delaying the manager's work.

Answer

Tell the requester to ask a coworker to share the manager's existing password.

Answer

Ignore the ticket until the manager returns from travel.

Question 14

The executive team wants to know which payment services are most critical and how long each can be offline before the business is seriously harmed. Which activity should security support?

Accepted Answer

A business impact analysis, because it identifies critical functions and outage impact.. A business impact analysis (BIA) is the correct activity because it systematically identifies critical business functions—such as payment processing—and quantifies the maximum tolerable downtime (MTD) and recovery time objectives (RTO). This directly answers the executive team's question about which payment services are most critical and how long each can be offline before causing serious harm.

Answer

A tabletop exercise, because leaders are practicing response discussions.

Answer

Incident containment, because the goal is to stop an active breach.

Answer

Vulnerability scanning, because it finds weaknesses in systems.

Question 15

An operations manager states that the customer portal may be unavailable for no more than 15 minutes in a month before the issue must be escalated to executives. Which risk management concept does this statement describe?

Accepted Answer

Risk tolerance, because it sets a specific measurable threshold for acceptable impact.. Option B is correct because risk tolerance defines the specific, measurable deviation from risk appetite that an organization is willing to accept. The operations manager's statement sets a precise threshold—15 minutes of unavailability per month—before escalation is required, which is a classic example of risk tolerance in IT service management.

Answer

Risk appetite, because it describes the organization’s overall willingness to take risk.

Answer

Risk transfer, because the business is moving the outage risk to another party.

Answer

Risk avoidance, because the organization is eliminating the portal risk completely.

SY0-701 Security Program Management and Oversight Practice Test 13 — 15 Questions

Exhibit

SY0-701 Security Program Management and Oversight Practice Test 13 — 15 Questions

Exhibit