SY0-701 Security Program Management and Oversight Practice Test 2 — 15 Questions

Question 1

Based on the exhibit, which document type should the organization update if it wants the listed endpoint settings to be mandatory baseline requirements?

Accepted Answer

Standard, because it defines mandatory minimum settings that all systems must meet.. A standard is the correct document type because it defines mandatory, minimum-security configuration requirements that all systems must meet, such as specific endpoint settings. Unlike a policy, which states broad intent, a standard provides the enforceable baseline that ensures consistent security posture across the organization.

Answer

Policy, because it defines the organization's broad security intent and direction.

Answer

Procedure, because it provides the exact steps administrators follow to configure the setting.

Answer

Guideline, because it is the least restrictive document for endpoint protection.

Question 2

A security manager wants evidence that annual security awareness training was completed by employees. Which artifact is the best proof?

Accepted Answer

A training completion report exported from the learning system. A training completion report exported from the learning system is the best proof because it provides a verifiable, timestamped record of each employee's completion status, including user IDs, course names, completion dates, and scores. This artifact directly demonstrates that the training was actually completed, not just assigned or attended, and can be audited against the organization's training policy.

Answer

A copy of the company logo used on the training slides

Answer

A list of office supplies purchased last quarter

Answer

A screenshot of the company's public homepage

Question 3

Match each audit request to the best evidence artifact.
1. Auditors want proof that managers reviewed privileged access last quarter.
2. Auditors want evidence that an emergency firewall change was approved before implementation.
3. Auditors want to verify that annual security training was completed by staff.
4. Auditors want to confirm that records were deleted after the retention period expired.

Question 4

A marketing analyst asks for a spreadsheet containing customer names, email addresses, purchase history, and government ID numbers so the team can build a campaign list. What is the BEST security response?

Accepted Answer

Provide only the minimum fields required and remove the government ID numbers.. The best security response is to apply the principle of least privilege and data minimization. Government ID numbers are sensitive personally identifiable information (PII) that are not necessary for building a marketing campaign list; providing only the minimum required fields (e.g., names and email addresses) reduces the risk of exposure and complies with data protection regulations like GDPR or CCPA.

Answer

Approve the request because the data is needed for any marketing activity.

Answer

Send the full file, but ask the analyst not to store it permanently.

Answer

Classify the file as public so it can be shared more easily with the marketing team.

Question 5

A department identifies a low-likelihood software risk that would be expensive to fix right now. Leadership decides the business can live with the exposure for now, but wants it documented and reviewed later. What risk treatment is this?

Accepted Answer

Accept the risk with documented approval and periodic review. The scenario describes a low-likelihood, high-cost software risk that leadership chooses to tolerate rather than fix immediately. This is the definition of risk acceptance, which requires documented approval and periodic review to ensure the risk remains acceptable over time. The correct risk treatment is to formally accept the exposure with a record of the decision and a schedule for reassessment.

Answer

Mitigate the risk by applying a technical control immediately

Answer

Transfer the risk to an insurer or third party

Answer

Avoid the risk by stopping the business activity entirely

Question 6

A supplier tells your company it wants to use a new subcontractor to process customer data. What is the BEST contract control to reduce this risk?

Accepted Answer

Require the vendor to notify the company before adding subcontractors. Requiring the vendor to notify the company before adding subcontractors is the best contract control because it ensures the company retains visibility and approval authority over any third party that will process customer data. This aligns with the principle of due diligence and third-party risk management, as the company can assess the subcontractor's security posture before data is shared. Without such a clause, the vendor could unilaterally introduce a subcontractor with inadequate security controls, increasing the risk of a data breach or compliance violation.

Answer

Allow subcontractors without review if the vendor remains responsible

Answer

Only require a verbal promise that the subcontractor is secure

Answer

Remove all contract language related to third parties

Question 7

After three months of phishing awareness training, the security team wants a metric that best shows whether employees are becoming harder to trick. Which metric is MOST useful?

Accepted Answer

The percentage of users who report suspicious messages before clicking links.. Option B is correct because the percentage of users who report suspicious messages before clicking links directly measures the effectiveness of phishing awareness training in changing user behavior. A higher reporting rate indicates that employees are recognizing phishing indicators and using the reporting mechanism (e.g., an integrated phishing report button or email forwarding to a security mailbox) instead of falling for the trick. This metric focuses on the desired outcome—reducing successful phishing—rather than activity volume.

Answer

The total number of phishing simulation emails sent to employees.

Answer

The number of new usernames created in the email system.

Answer

The average screen resolution used by employees during the campaign.

Question 8

An external auditor asks for proof that firewall rule changes were reviewed and approved before being implemented during the last quarter. Which evidence is MOST appropriate to provide?

Accepted Answer

Change tickets showing requester, reviewer approval, implementation date, and rollback plan.. Change tickets provide a formal, auditable record of the entire change management process, including requester identification, reviewer approval, implementation date, and rollback plan. This directly satisfies the auditor's requirement for proof that firewall rule changes were reviewed and approved before implementation, aligning with the principle of separation of duties and change control.

Answer

A screenshot of the firewall management homepage showing that the system is online.

Answer

An email from the network team stating they remember reviewing the changes.

Answer

A list of the firewall vendor's product features from the company website.

Question 9

A company is evaluating a new payroll SaaS provider that will store employee tax and bank details. Before signing the contract, which action BEST supports vendor due diligence?

Accepted Answer

Review a current independent security attestation and verify contractual security obligations.. Option B is correct because vendor due diligence for a SaaS provider handling sensitive employee data (tax and bank details) requires verifying independent security attestations (e.g., SOC 2 Type II, ISO 27001 certification) and ensuring contractual security obligations (e.g., data encryption, breach notification, right to audit) are explicitly defined. This provides objective, audited evidence of the vendor's security posture rather than relying on marketing claims or unverified assurances.

Answer

Ask the vendor for a marketing brochure describing platform features and uptime claims.

Answer

Accept the vendor’s assurance that its customers have never experienced incidents.

Answer

Wait until after go-live and then review the security posture during the first annual audit.

Question 10

Match each vendor-risk concern to the contractual control that best addresses it.
1. The company wants the right to review the vendor's controls and supporting records after the contract is signed.
2. The company wants to know when the vendor will use subcontractors that may touch its data.
3. The company wants written notice within 24 hours if the vendor suffers an incident affecting company data.
4. The company wants assurance that the vendor's controls are independently assessed each year.

Question 11

Match each procurement need to the vendor due diligence artifact or control that best fits.
1. Procurement wants independent evidence that a SaaS provider's controls operated effectively during the last year.
2. The team wants to know what files, libraries, and modules were included in a supplier's software build.
3. The business needs a signed agreement that defines how customer data is handled and what the vendor must do if an incident occurs.
4. The procurement team wants answers about MFA, logging, and incident response before onboarding a cloud supplier.

Question 12

A data analyst needs a copy of a customer file for product testing. The file includes names, email addresses, purchase history, and government ID numbers, but the test team only needs the names and purchase history. What is the BEST handling action?

Accepted Answer

Remove or mask the government ID numbers before sharing the minimum necessary fields.. Option B is correct because it applies the principle of least privilege and data minimization. The test team only needs names and purchase history, so removing or masking the government ID numbers before sharing the minimum necessary fields protects sensitive personally identifiable information (PII) and complies with data protection regulations like GDPR or CCPA. This action reduces the risk of unauthorized exposure of high-risk data while still enabling the test team to perform their work.

Answer

Provide the full file because the test team is internal and already trusted.

Answer

Encrypt the file and send it by email to the entire test group.

Answer

Keep the file unchanged and rely on the team not to open the sensitive columns.

Question 13

Based on the exhibit, which document type should define the exact encryption algorithm and minimum key length for all company laptops?

Accepted Answer

Standard. A Standard defines mandatory, specific technical requirements such as the exact encryption algorithm (e.g., AES-256) and minimum key length (e.g., 256 bits) that must be enforced on all company laptops. Policies are high-level statements of intent, while Standards provide the measurable, enforceable criteria to implement that intent. In this context, the encryption algorithm and key length are precise technical specifications, not general guidance or step-by-step instructions.

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 14

A project team identifies a new risk with a high likelihood of minor data exposure during a pilot rollout. The impact is low, but the issue would become harder to address after production launch. The business owner wants the project to proceed. What should the risk owner do NEXT?

Accepted Answer

Document the risk, assign an owner, and escalate for acceptance or treatment before launch.. Option B is correct because the risk owner must follow the formal risk management process: document the risk, assign an owner, and escalate it to the business owner for a decision on acceptance or treatment before the pilot launch. Even though the impact is low, the high likelihood and the fact that the issue becomes harder to address post-production mean the risk cannot be ignored or deferred; it requires a documented acceptance or a mitigation plan before proceeding.

Answer

Ignore the issue because the impact is low.

Answer

Wait until after production launch to see whether the issue actually occurs.

Answer

Transfer the risk by moving the pilot to a different business unit.

Question 15

Match each governance need to the document type that best fits.
1. All employees must follow rules for acceptable use of company systems.
2. Every company laptop must use full-disk encryption and a 14-character screen-lock PIN.
3. The service desk follows these exact steps to verify a caller before resetting MFA.
4. Admins are encouraged to place non-production test data in approved folders when practical.

SY0-701 Security Program Management and Oversight Practice Test 2 — 15 Questions

Exhibit

SY0-701 Security Program Management and Oversight Practice Test 2 — 15 Questions

Exhibit