SY0-701 Security Program Management and Oversight Practice Test 2 — 15 Questions

Question 1

Based on the exhibit, which control option provides the greatest net annual financial benefit for the organization?

Accepted Answer

Option B, because its large reduction in annual loss outweighs the higher implementation cost.. It provides the greatest net annual financial benefit. With a loss reduction of $220,000 and an implementation cost of $120,000, the net benefit is $100,000, which is higher than any other option. This demonstrates that a larger upfront investment can be justified when the reduction in annualized loss expectancy (ALE) significantly outweighs the control cost.

Answer

Option A, because it reduces loss enough to justify the control cost better than the smaller controls.

Answer

Option C, because transferring the risk is always cheaper than engineering a technical fix.

Answer

Option D, because low upfront cost makes it the most economical option regardless of residual loss.

Question 2

A security manager issues a mandatory document that requires all corporate laptops to use full-disk encryption, automatic screen lock after 10 minutes, and approved endpoint protection software. The document will be checked during compliance reviews. Which governance artifact is this?

Accepted Answer

Standard. This document is a standard because it specifies mandatory technical configurations and controls (full-disk encryption, screen lock timeout, endpoint protection) that must be implemented. Unlike a policy, which is a high-level statement of management intent, a standard provides specific, measurable requirements that support the policy. The document is not a procedure (step-by-step actions) or a guideline (optional recommendations). Compliance reviews enforce this standard as a mandatory baseline.

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 3

A security manager is creating a document that requires every corporate laptop to use full-disk encryption, automatic screen locking after 10 minutes, and approved antivirus software. Which two governance artifacts best fit those requirements? Select two.

Accepted Answer

Standard. Both Standard and Baseline are correct. A standard defines mandatory, specific technical configurations, such as requiring full-disk encryption (e.g., AES-256 via BitLocker or FileVault), automatic screen locking after 10 minutes, and approved antivirus software. A baseline is a minimum set of security configuration requirements that all corporate laptops must meet, and it can include the exact same specifics. Standards and baselines both serve as enforceable governance artifacts for these concrete security controls, unlike a policy (which states intent), a procedure (which gives step-by-step instructions), or a guideline (which is advisory).

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 4

A security manager is creating a company-wide requirement that all Windows laptops must have full-disk encryption, screen lock after 10 minutes, and approved antivirus enabled. Administrators can choose the exact implementation details, but the minimum settings must be mandatory across the fleet. Which governance artifact should the manager update?

Accepted Answer

Standard. A standard is a mandatory set of specific technical requirements or controls that must be implemented. In this scenario, the security manager is defining mandatory minimum settings (full-disk encryption, screen lock after 10 minutes, approved antivirus) that must be enforced across all laptops. Administrators can choose which specific products or tools to use, but the controls themselves are mandatory. This is the defining characteristic of a standard, not a policy (which would be more general, e.g., 'data must be protected at rest').

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 5

A simulated phishing campaign shows that several employees clicked a simulated phishing link. Which action should the security team prioritize next?

Accepted Answer

Deploy role-based phishing training, recurring simulations, and a simple reporting workflow.. The best next step is to implement role-based phishing training, run recurring simulations, and establish a simple reporting workflow. This targets employees' specific risk levels, reinforces secure behavior over time, and makes it easier to report suspicious messages. One-time reminders or repeating the same broad module are less effective, and punitive action alone does not improve security awareness.

Answer

Send a company-wide reminder to never click links in email, regardless of sender.

Answer

Focus only on punitive action for users who failed the simulation.

Answer

Run the same broad awareness module again for all employees at the same time.

Question 6

A manager needs to send a spreadsheet containing employee names, salaries, and performance notes to an external auditor. Which two actions best support proper data handling? Select two.

Accepted Answer

Apply the correct classification label before sending. Applying the correct classification label (e.g., 'Confidential' or 'Internal Use Only') ensures the data is properly identified and handled according to the organization's data classification policy, triggering appropriate security controls such as encryption, access restrictions, and handling procedures. Using the organization's approved encrypted sharing method is equally important because it ensures the data is protected in transit and that only the intended recipient (the external auditor) can access it, in compliance with organizational policy. Removing salary columns (C) is insufficient because employee names and performance notes are still sensitive PII that must be protected, and using a personal cloud account (B) or leaving a printed copy on a shared desk (E) violate data handling policies.

Answer

Upload the file to a personal cloud account

Answer

Remove the salary columns and send the rest by email

Answer

Print the file and leave it on a shared desk

Question 7

Which contract change would most directly reduce the organization's third-party response risk?

Accepted Answer

Add a breach notification timeframe and a right-to-review assurance clause in the contract.. Adding a breach notification timeframe and a right-to-review assurance clause directly reduces third-party response risk by ensuring the vendor must promptly report security incidents and allow the organization to audit their security posture. This contractual change enforces accountability and timely action, which is critical for minimizing the impact of a breach originating from the third party.

Answer

Ask the vendor to provide a color logo and updated marketing brochure for the pilot.

Answer

Allow the vendor to start first and decide later whether to add security terms.

Answer

Replace the pilot with a purely internal spreadsheet process to avoid any contract review.

Question 8

An organization is developing a business continuity and disaster recovery (BC/DR) plan. Which three of the following are essential elements that should be included to ensure proper management and oversight? (Choose three.)

Accepted Answer

Procedures for regular testing, such as tabletop exercises or full-scale drills. A BC/DR plan must include prioritized critical business functions with RTOs to drive recovery strategy and resource allocation, defined roles and responsibilities to ensure clear ownership and accountability during an incident, and procedures for regular testing (e.g., tabletop exercises, full-scale drills) to validate the plan’s effectiveness and identify gaps. These are core governance and oversight elements required by NIST SP 800-34 and ISO 22301.

Answer

Detailed diagrams of the network topology with IP addresses and firewall rules

Answer

An inventory of all employee personal devices used for remote work

Answer

A single backup copy stored on the primary server to minimize restoration time

Question 9

Which four of the following are essential elements of an effective business continuity plan (BCP) that a security manager should oversee? (Choose four.)

Accepted Answer

Documented communication and escalation procedures during an incident. An effective BCP must include identification of critical business functions and dependencies to prioritize recovery; regular testing and exercises ensures the plan remains valid and staff are trained; defined RTOs and RPOs set clear targets for recovery speed and data loss; and documented communication/escalation procedures ensure coordinated response. A single centralized backup location is a single point of failure and is not a best practice, and automatic failover without notification lacks the human-in-the-loop communication essential for coordination.

Answer

Automatic failover to a hot site without any human notification

Answer

A single, centralized backup location to simplify management

Question 10

A company is evaluating a new cloud-based customer relationship management (CRM) provider. The provider’s documentation includes a SOC 2 Type II report, but the company’s compliance team specifically requires evidence that data in transit is encrypted using TLS 1.2 or higher, and data at rest is encrypted with AES-256. Which of the following actions best demonstrates that the company has performed proper due diligence in vendor risk management?

Accepted Answer

Review the detailed control descriptions and auditor test results within the SOC 2 Type II report that address encryption of data in transit and at rest.. A SOC 2 Type II report includes detailed control descriptions and independent auditor test results that specifically verify whether encryption controls (TLS 1.2+ for data in transit and AES-256 for data at rest) are designed and operating effectively over a period of time. Reviewing these granular details allows the company to confirm compliance with its specific encryption requirements, which is a core component of due diligence in vendor risk management.

Answer

Request the provider to sign a contractual service-level agreement (SLA) that guarantees encryption compliance.

Answer

Accept the SOC 2 Type II report as sufficient and proceed without further review.

Answer

Conduct an independent penetration test on the provider’s infrastructure before signing the contract.

Question 11

A security manager is evaluating the effectiveness of a new security awareness training program that all employees completed last quarter. The company has been conducting monthly phishing simulation campaigns for the past year. Which of the following metrics would provide the strongest evidence that the training is achieving its intended goal of changing employee behavior?

Accepted Answer

The percentage of employees who clicked on a simulated phishing email decreased from 18% to 6%.. Directly measures the reduction in risky behavior (clicking phishing links) after training, which is the core goal of security awareness training. A drop from 18% to 6% demonstrates a measurable behavior change, not just knowledge acquisition. This aligns with the Kirkpatrick Model's 'Behavior' level of evaluation, which is the strongest indicator of training effectiveness.

Answer

95% of employees completed the training within the deadline.

Answer

The number of employees reporting phishing attempts to the SOC increased by 40%.

Answer

The number of helpdesk tickets related to password resets decreased by 10%.

Question 12

After completing a vulnerability scan, a security analyst discovers that a legacy customer-facing application running on an unsupported operating system contains a critical remote code execution vulnerability. The application is essential to daily operations and cannot be patched or upgraded in the near term. Management has approved the purchase of a hardware-based network firewall that will be placed in front of the application to restrict inbound traffic to only authorized source IP addresses and port numbers. Which risk management strategy does this action primarily represent?

Accepted Answer

Risk mitigation. The security team is implementing a hardware-based network firewall to restrict inbound traffic to only authorized source IP addresses and port numbers. This directly reduces the likelihood of exploitation by limiting the attack surface, which is the essence of risk mitigation — applying controls to reduce the risk to an acceptable level. Patching or upgrading is not feasible, so compensating controls like network segmentation and access control lists (ACLs) are used to mitigate the vulnerability.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transference

Question 13

A security manager is preparing a quarterly report for the board of directors on the effectiveness of the organization's security program. The manager has access to detailed technical data, including firewall log statistics, patch compliance percentages, and number of phishing simulation clicks. Which of the following would be the most appropriate way to present this information to the board?

Accepted Answer

Show a trend chart of the number of security incidents categorized by severity, along with average time to resolve.. It presents security program effectiveness in a business-relevant format: trend charts of incidents by severity and resolution times directly address risk reduction and operational efficiency, which board members need for strategic oversight. Unlike raw technical data, this aggregated, visualized information enables non-technical stakeholders to assess whether the security program is improving over time.

Answer

Provide a list of all firewall rule changes made during the quarter.

Answer

Include raw logs of the top 10 most frequent alerts from the SIEM.

Answer

Describe the technical architecture of the intrusion prevention system.

Question 14

A security manager is leading a risk assessment for the organization. The team identifies a legacy application that contains a known critical vulnerability. The vendor has discontinued support and no patch is available. The manager calculates that the annualized loss expectancy (ALE) for exploiting this vulnerability is $50,000. Implementing a third-party web application firewall (WAF) as a compensating control would cost $80,000 per year. The organization's leadership decides that accepting the risk is the most cost-effective approach. Which of the following documents should the security manager update to formally record this risk acceptance decision and obtain the necessary sign-off?

Accepted Answer

Risk register. The risk register is the correct document to update because it formally tracks identified risks, their assessed impact, and the chosen risk response (acceptance). Recording the decision to accept the $50,000 ALE risk and obtaining sign-off ensures auditability and accountability, which is a key requirement in risk management frameworks like NIST SP 800-37.

Answer

Business impact analysis (BIA)

Answer

Security baseline configuration document

Answer

Incident response plan

Question 15

A security manager at a financial services company is proposing a new policy that would require annual background checks for all employees with access to sensitive customer payment data. The proposed policy, if implemented, would increase the organization's operational costs by approximately $200,000 per year. The manager needs to obtain formal approval to implement this policy. Which of the following groups is MOST likely to have the authority to approve this policy and allocate the necessary budget?

Accepted Answer

Board of directors. The board of directors holds the ultimate fiduciary responsibility and authority over significant financial commitments and strategic policy changes. A $200,000 annual cost increase requires approval at the highest governance level, as it impacts the organization's budget and risk posture. The board is the only group with the formal power to allocate such a substantial operational expense and approve a new policy affecting all employees with access to sensitive payment data.

Answer

Chief Information Security Officer (CISO)

Answer

IT steering committee

Answer

Security operations team