SY0-701 Security Program Management and Oversight Practice Test 14 — 15 Questions

Question 1

The executive team wants to know which payment services are most critical and how long each can be offline before the business is seriously harmed. Which activity should security support?

Accepted Answer

A business impact analysis, because it identifies critical functions and outage impact.. A business impact analysis (BIA) is the correct activity because it systematically identifies critical business functions—such as payment processing—and quantifies the maximum tolerable downtime (MTD) and recovery time objectives (RTO). This directly answers the executive team's question about which payment services are most critical and how long each can be offline before causing serious harm.

Answer

A tabletop exercise, because leaders are practicing response discussions.

Answer

Incident containment, because the goal is to stop an active breach.

Answer

Vulnerability scanning, because it finds weaknesses in systems.

Question 2

An operations manager states that the customer portal may be unavailable for no more than 15 minutes in a month before the issue must be escalated to executives. Which risk management concept does this statement describe?

Accepted Answer

Risk tolerance, because it sets a specific measurable threshold for acceptable impact.. Risk tolerance defines the specific, measurable deviation from risk appetite that an organization is willing to accept. The operations manager's statement sets a precise threshold—15 minutes of unavailability per month—before escalation is required, which is a classic example of risk tolerance in IT service management.

Answer

Risk appetite, because it describes the organization’s overall willingness to take risk.

Answer

Risk transfer, because the business is moving the outage risk to another party.

Answer

Risk avoidance, because the organization is eliminating the portal risk completely.

Question 3

An auditor asks for evidence that the new workstation hardening baseline is actually applied across all finance laptops. Which evidence is the best to provide?

Accepted Answer

An automated compliance report from the configuration management tool showing baseline status across all devices.. An automated compliance report from a configuration management tool (e.g., Microsoft Intune, SCCM, or Ansible) provides verifiable, centralized evidence that the hardening baseline is applied across all finance laptops. Unlike manual screenshots or policy documents, this report shows real-time or historical compliance status for every device, proving enforcement at scale.

Answer

A copy of the hardening policy that says all laptops must be secured.

Answer

A manager’s email confirming that the baseline was announced to the team.

Answer

Screenshots from one finance laptop showing the baseline settings.

Question 4

A legacy production scanner cannot support MFA, but it must remain available for six months until replacement hardware arrives. What is the best security response?

Accepted Answer

Approve a time-bound exception with compensating controls and a review date.. It balances security with operational necessity by implementing a time-bound exception with compensating controls (e.g., network segmentation, strict access logging, or IP whitelisting) and a mandatory review date. This ensures the legacy scanner remains available for six months while mitigating the risk of unauthorized access, aligning with the principle of least privilege and security program oversight.

Answer

Permanently waive MFA for the scanner and leave the exception open-ended.

Answer

Shut down the scanner immediately until MFA can be enabled.

Answer

Create a shared administrator account so operators can sign in more easily.

Question 5

After several rounds of phishing simulations, management wants a metric that best shows employees are improving at recognizing suspicious messages. Which metric should security track?

Accepted Answer

The percentage of users who report simulated phishing emails to security.. The percentage of users who report simulated phishing emails to security directly measures behavioral change, showing that employees are actively recognizing and acting on suspicious messages. This metric reflects the effectiveness of security awareness training by tracking the desired response—reporting—rather than passive metrics like email volume or ticket counts.

Answer

The number of training emails sent to employees each month.

Answer

The number of spam emails blocked by the mail gateway.

Answer

The number of help desk tickets closed within the month.

Question 6

Based on the exhibit, what is the best risk response for the security team to recommend before the customer portal goes live?

Accepted Answer

Mitigate the risk by remediating the vulnerability before production release.. The exhibit shows a critical SQL injection vulnerability in the customer portal that has been partially mitigated by a WAF rule. However, WAF rules can be bypassed (e.g., through encoding tricks or HTTP parameter pollution), so the residual risk remains high. The best response is to remediate the vulnerability in the application code before launch, which directly removes the root cause and aligns with the principle of defense in depth.

Answer

Accept the risk now, because the WAF rule lowers exposure enough for launch.

Answer

Transfer the risk to the hosting provider through a service-level agreement.

Answer

Avoid the risk by permanently canceling the customer portal project.

Question 7

During a tabletop exercise, the team realizes no one has a list of who to notify if the online ordering system goes down. Which continuity planning element is missing?

Accepted Answer

Communication plan, because it defines who must be contacted and how.. A communication plan is the missing continuity planning element because it specifically defines the stakeholders who must be notified during an outage (e.g., internal teams, vendors, customers) and the methods of contact (e.g., email, SMS, phone tree). Without this plan, the team cannot execute the notification procedures required by the business continuity plan (BCP) to coordinate response and recovery efforts for the online ordering system.

Answer

Data retention schedule, because it defines how long records are kept.

Answer

Asset inventory, because it lists all hardware and software in use.

Answer

Network segmentation, because it separates sensitive systems from user networks.

Question 8

A development team wants to skip testing and deploy a major application change directly to production to meet a release date. What should the security team require?

Accepted Answer

Require change approval and testing in a nonproduction environment first.. Security policy requires that all changes to production systems undergo formal change management, including approval and testing in a nonproduction environment first. Skipping testing violates the principle of change control and could introduce vulnerabilities or misconfigurations that compromise confidentiality, integrity, or availability. The security team must enforce this process to ensure the change is reviewed for security impact and validated before deployment.

Answer

Disable logging temporarily so the release is less likely to fail.

Answer

Deploy only to one server and monitor from there before deciding.

Answer

Let developers decide without review because they understand the code best.

Question 9

Based on the exhibit, what should the organization do before approving this SaaS vendor to process employee HR records?

Accepted Answer

Require a security addendum and evidence review before onboarding, including notification timelines, deletion terms, subprocessors, and independent testing.. Before processing sensitive employee HR records, the organization must ensure the SaaS vendor meets security and compliance requirements. This includes reviewing contractual terms like notification timelines, data deletion policies, subprocessor usage, and independent testing evidence (e.g., SOC 2 Type II or ISO 27001 certification). Without these, the organization cannot verify the vendor's security posture or contractual obligations, which is critical for protecting PII and meeting regulatory requirements like GDPR or HIPAA.

Answer

Approve the vendor now because admin MFA is enabled and the deadline is urgent.

Answer

Request a formal risk acceptance memo and sign the contract without additional review.

Answer

Move the HR data into the vendor environment first and complete the review after production cutover.

Question 10

Before contracting with a cloud-based payroll provider, the security team requests a security questionnaire, proof of controls, and an independent audit report. What activity is this?

Accepted Answer

Third-party due diligence, because the team is evaluating vendor risk before onboarding.. The security team's request for a security questionnaire, proof of controls, and an independent audit report before contracting with a cloud-based payroll provider is a classic example of third-party due diligence. This process evaluates the vendor's security posture, compliance, and risk level before onboarding, ensuring that sensitive payroll data is protected. It is a proactive risk management activity, not a reactive test or training exercise.

Answer

Business continuity testing, because the team is checking recovery procedures.

Answer

Security awareness training, because the vendor is being taught safe behavior.

Answer

Data classification, because the team is labeling the payroll data type.

Question 11

A security manager is designing a security program to align with business goals. Which three of the following are essential components of a security program that directly support governance and oversight? (Choose three.)

Accepted Answer

Conducting periodic risk assessments to inform decision-making. A security steering committee with executive sponsorship ensures that security initiatives have top-down support and alignment with business objectives, which is a core governance function. Developing and maintaining security policies, standards, and procedures provides the formal framework for enforcing security controls and ensuring compliance, directly supporting oversight. Conducting periodic risk assessments informs decision-making by identifying and prioritizing risks, which is essential for governance and resource allocation.

Answer

Installing endpoint detection and response agents on all workstations

Answer

Implementing a vulnerability scanning tool across all endpoints

Answer

Deploying a next-generation firewall to segment the network

Question 12

An organization is implementing a third-party vendor risk management program. Which three of the following should be included as key activities to maintain oversight of vendor security? (Choose three.)

Accepted Answer

Conducting periodic security reviews or audits of critical vendors. Performing due diligence assessments before onboarding new vendors is correct because it allows the organization to evaluate a vendor's security posture, compliance, and risk level before any contractual relationship begins. This proactive step helps identify potential vulnerabilities or gaps that could expose the organization to third-party risks, aligning with the NIST SP 800-161 supply chain risk management framework.

Answer

Automatically renewing vendor contracts unless a security incident occurs

Answer

Providing vendor staff with direct access to internal source code repositories

Answer

Requiring all vendors to use the same password manager as the organization

Question 13

A security analyst is reviewing the organization’s security awareness program. Which three of the following are key metrics that demonstrate the effectiveness of the program? (Choose three.)

Accepted Answer

Percentage of employees who complete annual security training. The percentage of employees who complete annual security training is a key metric because it measures participation in the foundational awareness activity. The number of phishing simulation clicks before and after training directly quantifies behavioral change, showing whether training reduces susceptibility to social engineering. The total count of security incidents reported by employees indicates whether the program has successfully fostered a culture of reporting, which is critical for early threat detection.

Answer

Percentage of servers with full disk encryption enabled

Answer

Number of firewall rule changes approved per quarter

Answer

Average time to patch critical vulnerabilities in production systems

Question 14

Which four of the following are key components of a successful security awareness and training program within an organization? (Choose four.)

Accepted Answer

Executive-level sponsorship and support for the program. Role-based training is correct because it ensures that employees receive security education relevant to their specific job functions, such as data handling for finance or system access for IT, which increases the practical applicability and retention of security principles. Phishing simulations are correct as they provide hands-on reinforcement of skills, allowing employees to practice identifying and reporting malicious emails in a controlled environment, which directly reduces real-world risk. Metrics like click rates on simulated phishing emails are correct because they provide quantifiable data to measure program effectiveness, identify high-risk groups, and guide continuous improvement. Executive-level sponsorship is correct because it provides the necessary authority, resources, and organizational commitment to prioritize security awareness, ensuring the program is taken seriously across all departments.

Answer

Outsourcing all training content development to a single vendor without internal review

Answer

Annual one-time training with no follow-up assessments

Question 15

Drag and drop the steps to perform a factory reset on a managed switch into the correct order.

Accepted Answer

Step 1: Power off the switch, Step 2: Press and hold the reset button, Step 3: Power on the switch while holding the reset button, Step 4: Continue holding the reset button for 10 seconds, Step 5: Release the reset button, Step 6: Wait for the switch to reboot with factory defaults.. Factory reset clears all configuration; the exact method may vary by vendor, but typically involves holding a button during power-on.

Answer

Step 2: Press and hold the reset button, Step 2: Power off the switch, Step 3: Power on the switch while holding the reset button, Step 4: Continue holding for 10 seconds, Step 5: Release, Step 6: Wait for reboot.

Answer

Step 1: Power off, Step 2: Press and hold reset, Step 3: Power on while holding, Step 4: Release after 2 seconds, Step 5: Wait for reboot.

Answer

Step 1: Power on the switch, Step 2: Press and hold reset, Step 3: Power off, Step 4: Power on again while holding reset, Step 5: Hold for 10 seconds, Step 6: Release, Step 7: Wait for reboot.