SY0-701 Security Program Management and Oversight Practice Test 14 — 15 Questions

Question 1

An auditor asks for evidence that the new workstation hardening baseline is actually applied across all finance laptops. Which evidence is the best to provide?

Accepted Answer

An automated compliance report from the configuration management tool showing baseline status across all devices.. Option D is correct because an automated compliance report from a configuration management tool (e.g., Microsoft Intune, SCCM, or Ansible) provides verifiable, centralized evidence that the hardening baseline is applied across all finance laptops. Unlike manual screenshots or policy documents, this report shows real-time or historical compliance status for every device, proving enforcement at scale.

Answer

A copy of the hardening policy that says all laptops must be secured.

Answer

A manager’s email confirming that the baseline was announced to the team.

Answer

Screenshots from one finance laptop showing the baseline settings.

Question 2

A legacy production scanner cannot support MFA, but it must remain available for six months until replacement hardware arrives. What is the best security response?

Accepted Answer

Approve a time-bound exception with compensating controls and a review date.. Option B is correct because it balances security with operational necessity by implementing a time-bound exception with compensating controls (e.g., network segmentation, strict access logging, or IP whitelisting) and a mandatory review date. This ensures the legacy scanner remains available for six months while mitigating the risk of unauthorized access, aligning with the principle of least privilege and security program oversight.

Answer

Permanently waive MFA for the scanner and leave the exception open-ended.

Answer

Shut down the scanner immediately until MFA can be enabled.

Answer

Create a shared administrator account so operators can sign in more easily.

Question 3

After several rounds of phishing simulations, management wants a metric that best shows employees are improving at recognizing suspicious messages. Which metric should security track?

Accepted Answer

The percentage of users who report simulated phishing emails to security.. The percentage of users who report simulated phishing emails to security directly measures behavioral change, showing that employees are actively recognizing and acting on suspicious messages. This metric reflects the effectiveness of security awareness training by tracking the desired response—reporting—rather than passive metrics like email volume or ticket counts.

Answer

The number of training emails sent to employees each month.

Answer

The number of spam emails blocked by the mail gateway.

Answer

The number of help desk tickets closed within the month.

Question 4

Based on the exhibit, what is the best risk response for the security team to recommend before the customer portal goes live?

Accepted Answer

Mitigate the risk by remediating the vulnerability before production release.. The exhibit shows a critical SQL injection vulnerability in the customer portal that has been partially mitigated by a WAF rule. However, WAF rules can be bypassed (e.g., through encoding tricks or HTTP parameter pollution), so the residual risk remains high. The best response is to remediate the vulnerability in the application code before launch, which directly removes the root cause and aligns with the principle of defense in depth.

Answer

Accept the risk now, because the WAF rule lowers exposure enough for launch.

Answer

Transfer the risk to the hosting provider through a service-level agreement.

Answer

Avoid the risk by permanently canceling the customer portal project.

Question 5

During a tabletop exercise, the team realizes no one has a list of who to notify if the online ordering system goes down. Which continuity planning element is missing?

Accepted Answer

Communication plan, because it defines who must be contacted and how.. A communication plan is the missing continuity planning element because it specifically defines the stakeholders who must be notified during an outage (e.g., internal teams, vendors, customers) and the methods of contact (e.g., email, SMS, phone tree). Without this plan, the team cannot execute the notification procedures required by the business continuity plan (BCP) to coordinate response and recovery efforts for the online ordering system.

Answer

Data retention schedule, because it defines how long records are kept.

Answer

Asset inventory, because it lists all hardware and software in use.

Answer

Network segmentation, because it separates sensitive systems from user networks.

Question 6

A development team wants to skip testing and deploy a major application change directly to production to meet a release date. What should the security team require?

Accepted Answer

Require change approval and testing in a nonproduction environment first.. Option B is correct because security policy requires that all changes to production systems undergo formal change management, including approval and testing in a nonproduction environment first. Skipping testing violates the principle of change control and could introduce vulnerabilities or misconfigurations that compromise confidentiality, integrity, or availability. The security team must enforce this process to ensure the change is reviewed for security impact and validated before deployment.

Answer

Disable logging temporarily so the release is less likely to fail.

Answer

Deploy only to one server and monitor from there before deciding.

Answer

Let developers decide without review because they understand the code best.

Question 7

Based on the exhibit, what should the organization do before approving this SaaS vendor to process employee HR records?

Accepted Answer

Require a security addendum and evidence review before onboarding, including notification timelines, deletion terms, subprocessors, and independent testing.. Option C is correct because before processing sensitive employee HR records, the organization must ensure the SaaS vendor meets security and compliance requirements. This includes reviewing contractual terms like notification timelines, data deletion policies, subprocessor usage, and independent testing evidence (e.g., SOC 2 Type II or ISO 27001 certification). Without these, the organization cannot verify the vendor's security posture or contractual obligations, which is critical for protecting PII and meeting regulatory requirements like GDPR or HIPAA.

Answer

Approve the vendor now because admin MFA is enabled and the deadline is urgent.

Answer

Request a formal risk acceptance memo and sign the contract without additional review.

Answer

Move the HR data into the vendor environment first and complete the review after production cutover.

Question 8

Before contracting with a cloud-based payroll provider, the security team requests a security questionnaire, proof of controls, and an independent audit report. What activity is this?

Accepted Answer

Third-party due diligence, because the team is evaluating vendor risk before onboarding.. The security team's request for a security questionnaire, proof of controls, and an independent audit report before contracting with a cloud-based payroll provider is a classic example of third-party due diligence. This process evaluates the vendor's security posture, compliance, and risk level before onboarding, ensuring that sensitive payroll data is protected. It is a proactive risk management activity, not a reactive test or training exercise.

Answer

Business continuity testing, because the team is checking recovery procedures.

Answer

Security awareness training, because the vendor is being taught safe behavior.

Answer

Data classification, because the team is labeling the payroll data type.

Question 9

A security manager is designing a security program to align with business goals. Which three of the following are essential components of a security program that directly support governance and oversight? (Choose three.)

Accepted Answer

Establishing a security steering committee with executive sponsorship. A security steering committee with executive sponsorship ensures that security initiatives have top-down support and alignment with business objectives, which is a core governance function. Developing and maintaining security policies, standards, and procedures provides the formal framework for enforcing security controls and ensuring compliance, directly supporting oversight. Conducting periodic risk assessments informs decision-making by identifying and prioritizing risks, which is essential for governance and resource allocation.

Answer

Implementing a vulnerability scanning tool across all endpoints

Answer

Deploying a next-generation firewall to segment the network

Answer

Installing endpoint detection and response agents on all workstations

Question 10

An organization is implementing a third-party vendor risk management program. Which three of the following should be included as key activities to maintain oversight of vendor security? (Choose three.)

Accepted Answer

Performing due diligence assessments before onboarding new vendors. Performing due diligence assessments before onboarding new vendors is correct because it allows the organization to evaluate a vendor's security posture, compliance, and risk level before any contractual relationship begins. This proactive step helps identify potential vulnerabilities or gaps that could expose the organization to third-party risks, aligning with the NIST SP 800-161 supply chain risk management framework.

Answer

Requiring all vendors to use the same password manager as the organization

Answer

Providing vendor staff with direct access to internal source code repositories

Answer

Automatically renewing vendor contracts unless a security incident occurs

Question 11

A security analyst is reviewing the organization’s security awareness program. Which three of the following are key metrics that demonstrate the effectiveness of the program? (Choose three.)

Accepted Answer

Total count of security incidents reported by employees. The percentage of employees who complete annual security training is a key metric because it measures participation in the foundational awareness activity. The number of phishing simulation clicks before and after training directly quantifies behavioral change, showing whether training reduces susceptibility to social engineering. The total count of security incidents reported by employees indicates whether the program has successfully fostered a culture of reporting, which is critical for early threat detection.

Answer

Average time to patch critical vulnerabilities in production systems

Answer

Number of firewall rule changes approved per quarter

Answer

Percentage of servers with full disk encryption enabled

Question 12

An organization is developing a business continuity and disaster recovery (BC/DR) plan. Which three of the following are essential elements that should be included to ensure proper management and oversight? (Choose three.)

Accepted Answer

A list of prioritized critical business functions and their recovery time objectives (RTOs). A list of prioritized critical business functions with their RTOs is essential because it directly drives recovery strategy and resource allocation. Without this, the BC/DR plan lacks measurable recovery targets and cannot ensure that the most vital operations are restored first, which is a core requirement of NIST SP 800-34 and ISO 22301.

Answer

Detailed diagrams of the network topology with IP addresses and firewall rules

Answer

A single backup copy stored on the primary server to minimize restoration time

Answer

An inventory of all employee personal devices used for remote work

Question 13

Which four of the following are key components of a successful security awareness and training program within an organization? (Choose four.)

Accepted Answer

Phishing simulations to reinforce practical skills. Role-based training is correct because it ensures that employees receive security education relevant to their specific job functions, such as data handling for finance or system access for IT, which increases the practical applicability and retention of security principles. Phishing simulations are correct as they provide hands-on reinforcement of skills, allowing employees to practice identifying and reporting malicious emails in a controlled environment, which directly reduces real-world risk. Metrics like click rates on simulated phishing emails are correct because they provide quantifiable data to measure program effectiveness, identify high-risk groups, and guide continuous improvement. Executive-level sponsorship is correct because it provides the necessary authority, resources, and organizational commitment to prioritize security awareness, ensuring the program is taken seriously across all departments.

Answer

Annual one-time training with no follow-up assessments

Answer

Outsourcing all training content development to a single vendor without internal review

Question 14

Which four of the following are essential elements of an effective business continuity plan (BCP) that a security manager should oversee? (Choose four.)

Accepted Answer

Defined recovery time objectives (RTOs) and recovery point objectives (RPOs). Identification of critical business functions and their dependencies is correct because a BCP must prioritize which systems and processes are essential for survival, ensuring that recovery efforts focus on the most vital operations first. Without this mapping, the plan lacks direction and may waste resources on non-critical assets during a disaster.

Answer

A single, centralized backup location to simplify management

Answer

Automatic failover to a hot site without any human notification

Question 15

Drag and drop the steps to perform a factory reset on a managed switch into the correct order.