SY0-701 Security Program Management and Oversight Practice Test 2 — 15 Questions

Question 1

A security manager is creating a document that requires every corporate laptop to use full-disk encryption, automatic screen locking after 10 minutes, and approved antivirus software. Which two governance artifacts best fit those requirements? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Standard. Both Standard and Baseline are correct. A standard defines mandatory, specific technical configurations, such as requiring full-disk encryption (e.g., AES-256 via BitLocker or FileVault), automatic screen locking after 10 minutes, and approved antivirus software. A baseline is a minimum set of security configuration requirements that all corporate laptops must meet, and it can include the exact same specifics. Standards and baselines both serve as enforceable governance artifacts for these concrete security controls, unlike a policy (which states intent), a procedure (which gives step-by-step instructions), or a guideline (which is advisory).

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 2

A security manager is creating a company-wide requirement that all Windows laptops must have full-disk encryption, screen lock after 10 minutes, and approved antivirus enabled. Administrators can choose the exact implementation details, but the minimum settings must be mandatory across the fleet. Which governance artifact should the manager update?

Accepted Answer

Standard. A standard is a mandatory set of specific technical requirements or controls that must be implemented. In this scenario, the security manager is defining mandatory minimum settings (full-disk encryption, screen lock after 10 minutes, approved antivirus) that must be enforced across all laptops. Administrators can choose which specific products or tools to use, but the controls themselves are mandatory. This is the defining characteristic of a standard, not a policy (which would be more general, e.g., 'data must be protected at rest').

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 3

A simulated phishing campaign shows that several employees clicked a simulated phishing link. Which action should the security team prioritize next?

Accepted Answer

Deploy role-based phishing training, recurring simulations, and a simple reporting workflow.. The best next step is to implement role-based phishing training, run recurring simulations, and establish a simple reporting workflow. This targets employees' specific risk levels, reinforces secure behavior over time, and makes it easier to report suspicious messages. One-time reminders or repeating the same broad module are less effective, and punitive action alone does not improve security awareness.

Answer

Send a company-wide reminder to never click links in email, regardless of sender.

Answer

Focus only on punitive action for users who failed the simulation.

Answer

Run the same broad awareness module again for all employees at the same time.

Question 4

A manager needs to send a spreadsheet containing employee names, salaries, and performance notes to an external auditor. Which two actions best support proper data handling? Select two.

Accepted Answer

Apply the correct classification label before sending. Applying the correct classification label (e.g., 'Confidential' or 'Internal Use Only') ensures the data is properly identified and handled according to the organization's data classification policy, triggering appropriate security controls such as encryption, access restrictions, and handling procedures. Using the organization's approved encrypted sharing method is equally important because it ensures the data is protected in transit and that only the intended recipient (the external auditor) can access it, in compliance with organizational policy. Removing salary columns (C) is insufficient because employee names and performance notes are still sensitive PII that must be protected, and using a personal cloud account (B) or leaving a printed copy on a shared desk (E) violate data handling policies.

Answer

Upload the file to a personal cloud account

Answer

Remove the salary columns and send the rest by email

Answer

Print the file and leave it on a shared desk

Question 5

Which contract change would most directly reduce the organization's third-party response risk?

Accepted Answer

Add a breach notification timeframe and a right-to-review assurance clause in the contract.. Adding a breach notification timeframe and a right-to-review assurance clause directly reduces third-party response risk by ensuring the vendor must promptly report security incidents and allow the organization to audit their security posture. This contractual change enforces accountability and timely action, which is critical for minimizing the impact of a breach originating from the third party.

Answer

Ask the vendor to provide a color logo and updated marketing brochure for the pilot.

Answer

Allow the vendor to start first and decide later whether to add security terms.

Answer

Replace the pilot with a purely internal spreadsheet process to avoid any contract review.

Question 6

An organization is developing a business continuity and disaster recovery (BC/DR) plan. Which three of the following are essential elements that should be included to ensure proper management and oversight? (Choose three.)

Accepted Answer

Procedures for regular testing, such as tabletop exercises or full-scale drills. A BC/DR plan must include prioritized critical business functions with RTOs to drive recovery strategy and resource allocation, defined roles and responsibilities to ensure clear ownership and accountability during an incident, and procedures for regular testing (e.g., tabletop exercises, full-scale drills) to validate the plan’s effectiveness and identify gaps. These are core governance and oversight elements required by NIST SP 800-34 and ISO 22301.

Answer

A single backup copy stored on the primary server to minimize restoration time

Answer

An inventory of all employee personal devices used for remote work

Answer

Detailed diagrams of the network topology with IP addresses and firewall rules

Question 7

Which four of the following are essential elements of an effective business continuity plan (BCP) that a security manager should oversee? (Choose four.)

Accepted Answer

Identification of critical business functions and their dependencies. An effective BCP must include identification of critical business functions and dependencies to prioritize recovery; regular testing and exercises ensures the plan remains valid and staff are trained; defined RTOs and RPOs set clear targets for recovery speed and data loss; and documented communication/escalation procedures ensure coordinated response. A single centralized backup location is a single point of failure and is not a best practice, and automatic failover without notification lacks the human-in-the-loop communication essential for coordination.

Answer

Automatic failover to a hot site without any human notification

Answer

A single, centralized backup location to simplify management

Question 8

A company is evaluating a new cloud-based customer relationship management (CRM) provider. The provider’s documentation includes a SOC 2 Type II report, but the company’s compliance team specifically requires evidence that data in transit is encrypted using TLS 1.2 or higher, and data at rest is encrypted with AES-256. Which of the following actions best demonstrates that the company has performed proper due diligence in vendor risk management?

Accepted Answer

Review the detailed control descriptions and auditor test results within the SOC 2 Type II report that address encryption of data in transit and at rest.. A SOC 2 Type II report includes detailed control descriptions and independent auditor test results that specifically verify whether encryption controls (TLS 1.2+ for data in transit and AES-256 for data at rest) are designed and operating effectively over a period of time. Reviewing these granular details allows the company to confirm compliance with its specific encryption requirements, which is a core component of due diligence in vendor risk management.

Answer

Request the provider to sign a contractual service-level agreement (SLA) that guarantees encryption compliance.

Answer

Accept the SOC 2 Type II report as sufficient and proceed without further review.

Answer

Conduct an independent penetration test on the provider’s infrastructure before signing the contract.

Question 9

A security manager is evaluating the effectiveness of a new security awareness training program that all employees completed last quarter. The company has been conducting monthly phishing simulation campaigns for the past year. Which of the following metrics would provide the strongest evidence that the training is achieving its intended goal of changing employee behavior?

Accepted Answer

The percentage of employees who clicked on a simulated phishing email decreased from 18% to 6%.. Directly measures the reduction in risky behavior (clicking phishing links) after training, which is the core goal of security awareness training. A drop from 18% to 6% demonstrates a measurable behavior change, not just knowledge acquisition. This aligns with the Kirkpatrick Model's 'Behavior' level of evaluation, which is the strongest indicator of training effectiveness.

Answer

95% of employees completed the training within the deadline.

Answer

The number of employees reporting phishing attempts to the SOC increased by 40%.

Answer

The number of helpdesk tickets related to password resets decreased by 10%.

Question 10

After completing a vulnerability scan, a security analyst discovers that a legacy customer-facing application running on an unsupported operating system contains a critical remote code execution vulnerability. The application is essential to daily operations and cannot be patched or upgraded in the near term. Management has approved the purchase of a hardware-based network firewall that will be placed in front of the application to restrict inbound traffic to only authorized source IP addresses and port numbers. Which risk management strategy does this action primarily represent?

Accepted Answer

Risk mitigation. The security team is implementing a hardware-based network firewall to restrict inbound traffic to only authorized source IP addresses and port numbers. This directly reduces the likelihood of exploitation by limiting the attack surface, which is the essence of risk mitigation — applying controls to reduce the risk to an acceptable level. Patching or upgrading is not feasible, so compensating controls like network segmentation and access control lists (ACLs) are used to mitigate the vulnerability.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transference

Question 11

A security manager is preparing a quarterly report for the board of directors on the effectiveness of the organization's security program. The manager has access to detailed technical data, including firewall log statistics, patch compliance percentages, and number of phishing simulation clicks. Which of the following would be the most appropriate way to present this information to the board?

Accepted Answer

Show a trend chart of the number of security incidents categorized by severity, along with average time to resolve.. It presents security program effectiveness in a business-relevant format: trend charts of incidents by severity and resolution times directly address risk reduction and operational efficiency, which board members need for strategic oversight. Unlike raw technical data, this aggregated, visualized information enables non-technical stakeholders to assess whether the security program is improving over time.

Answer

Provide a list of all firewall rule changes made during the quarter.

Answer

Include raw logs of the top 10 most frequent alerts from the SIEM.

Answer

Describe the technical architecture of the intrusion prevention system.

Question 12

A security manager is leading a risk assessment for the organization. The team identifies a legacy application that contains a known critical vulnerability. The vendor has discontinued support and no patch is available. The manager calculates that the annualized loss expectancy (ALE) for exploiting this vulnerability is $50,000. Implementing a third-party web application firewall (WAF) as a compensating control would cost $80,000 per year. The organization's leadership decides that accepting the risk is the most cost-effective approach. Which of the following documents should the security manager update to formally record this risk acceptance decision and obtain the necessary sign-off?

Accepted Answer

Risk register. The risk register is the correct document to update because it formally tracks identified risks, their assessed impact, and the chosen risk response (acceptance). Recording the decision to accept the $50,000 ALE risk and obtaining sign-off ensures auditability and accountability, which is a key requirement in risk management frameworks like NIST SP 800-37.

Answer

Business impact analysis (BIA)

Answer

Security baseline configuration document

Answer

Incident response plan

Question 13

A security manager at a financial services company is proposing a new policy that would require annual background checks for all employees with access to sensitive customer payment data. The proposed policy, if implemented, would increase the organization's operational costs by approximately $200,000 per year. The manager needs to obtain formal approval to implement this policy. Which of the following groups is MOST likely to have the authority to approve this policy and allocate the necessary budget?

Accepted Answer

Board of directors. The board of directors holds the ultimate fiduciary responsibility and authority over significant financial commitments and strategic policy changes. A $200,000 annual cost increase requires approval at the highest governance level, as it impacts the organization's budget and risk posture. The board is the only group with the formal power to allocate such a substantial operational expense and approve a new policy affecting all employees with access to sensitive payment data.

Answer

Chief Information Security Officer (CISO)

Answer

IT steering committee

Answer

Security operations team

Question 14

A security manager at a healthcare organization is reviewing the results of a third-party vendor risk assessment for a cloud-based email service that will store protected health information (PHI). The assessment reveals that the vendor encrypts data at rest using AES-256 but does not support customer-managed encryption keys. The vendor's data center is located in a country that is not subject to HIPAA jurisdiction. The vendor's previous penetration test report is over 18 months old. Which of the following is the most appropriate risk management action for the security manager to take?

Accepted Answer

Request the vendor to obtain a current SOC 2 Type II report and review the findings before making a decision.. A SOC 2 Type II report provides an independent assessment of a vendor's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time. Given the vendor's lack of customer-managed keys and outdated penetration test, the security manager needs a current, comprehensive audit report to evaluate whether compensating controls adequately mitigate the risks of storing PHI outside HIPAA jurisdiction. This action allows an informed risk acceptance or mitigation decision without prematurely terminating a potentially compliant service.

Answer

Accept the risk because the vendor uses strong encryption.

Answer

Terminate the contract immediately and select a different vendor.

Answer

Require the vendor to implement customer-managed keys and provide a new penetration test report within 30 days.

Question 15

A security manager at a hospital is reviewing the annual vendor risk assessment for a cloud-based electronic health record (EHR) provider. The provider's SOC 2 Type II report, issued six months ago, identifies a significant deficiency in logical access controls: the provider failed to revoke access for former employees in a timely manner. The provider's management has asserted that this deficiency has been fully remediated, but the next SOC 2 audit is not scheduled for another eight months. The hospital's data protection policy requires that any vendor handling protected health information (PHI) must have a current SOC 2 Type II report with no unresolved significant deficiencies. Which of the following is the most appropriate next step for the security manager?

Accepted Answer

Require the vendor to provide a bridge letter from their external auditor confirming that the remediation has been implemented and is operating effectively.. The hospital's policy requires a current SOC 2 Type II report with no unresolved significant deficiencies. Since the deficiency was reported but is claimed to be fixed, a bridge letter from the external auditor provides independent assurance that the remediation is effective and operating as intended, bridging the gap until the next formal audit. This is the most appropriate step because it maintains compliance without prematurely terminating a critical vendor relationship.

Answer

Accept the vendor's assertion that the deficiency has been remediated and continue the relationship as is.

Answer

Immediately terminate the contract with the EHR provider and begin the process of selecting a new vendor.

Answer

Increase the frequency of manual access reviews performed by the hospital's internal IT staff on the vendor's systems.