SY0-701 Security Program Management and Oversight Practice Test 3 — 15 Questions

Question 1

A business unit wants to keep using a customer portal even though a low-likelihood, high-impact dependency risk was identified. Leadership does not want to stop the service, but it does want to lower exposure and formally document the remaining risk. Which two actions best fit that approach? Select two.

Accepted Answer

Implement compensating controls to reduce the chance or impact of the event.. Option A is correct because implementing compensating controls is a standard risk mitigation strategy that reduces the likelihood or impact of a dependency risk without stopping the service. For a customer portal, this could include adding web application firewall (WAF) rules, rate limiting, or failover mechanisms to lower exposure while keeping the portal operational.

Answer

Immediately shut down the portal until the dependency risk is completely eliminated.

Answer

Ignore the finding until the next annual audit cycle.

Answer

Transfer the issue to the help desk by opening a routine support ticket.

Question 2

After implementing MFA and stronger monitoring, a department still has a small chance of account misuse that could affect a low-value internal tool. The business owner reviews the remaining exposure and agrees it is within tolerance. What should happen next?

Accepted Answer

Document the residual risk and obtain formal acceptance from the risk owner.. Option B is correct because after implementing MFA and stronger monitoring, the remaining exposure is residual risk that must be formally documented and accepted by the risk owner (the business owner). This aligns with the risk management process in Security Program Management, where residual risk that falls within the organization's risk appetite is accepted rather than eliminated. The business owner's agreement indicates formal acceptance, which should be recorded for audit and compliance purposes.

Answer

Escalate the issue to legal because all residual risk must be eliminated.

Answer

Remove MFA because the remaining risk is already low.

Answer

Treat the issue as resolved because monitoring alone eliminates all risk.

Question 3

A desktop engineering team needs the document that sets the mandatory minimum password length and screen-lock timeout for all company laptops. Which document type should they use?

Accepted Answer

Standard. A standard specifies mandatory technical requirements, such as minimum password length and screen-lock timeout, that must be implemented on all company laptops. Unlike a policy, which is high-level and states management intent, a standard provides the specific, enforceable configuration settings. This aligns with the desktop engineering team's need for a document that dictates exact technical parameters.

Answer

Policy

Answer

Guideline

Answer

Procedure

Question 4

After several password-reset incidents, the security team wants one document that sets mandatory minimum controls for privileged accounts and another that tells the help desk the exact steps to verify identity and reset access. Which two document types should they use? Select two.

Accepted Answer

Standard, because it defines the mandatory minimum requirements that everyone must follow.. Option B is correct because a standard defines mandatory minimum requirements that must be followed, such as password length, complexity, and MFA enforcement for privileged accounts. This ensures consistent security controls across the organization without ambiguity, unlike a policy which is high-level intent.

Answer

Policy, because it explains the organization's overall security intent in broad terms.

Answer

Guideline, because it provides recommended practices that staff may ignore if needed.

Answer

Baseline, because it is mainly used as a casual reference document for analysts.

Question 5

A software supplier used by your company is adding a new library to its product and says the change is "internal only." Your security team wants better visibility into future component risks before the next renewal. What requirement would BEST support supply chain due diligence?

Accepted Answer

Require an updated software bill of materials and a notification process for material component changes.. A Software Bill of Materials (SBOM) provides a detailed inventory of all components in a product, enabling the security team to assess risks from new libraries. Requiring an SBOM plus a notification process for material changes gives proactive visibility into component risks, directly supporting supply chain due diligence as recommended by frameworks like NIST SP 800-161.

Answer

Require the supplier to provide a marketing summary of its development process.

Answer

Ask the supplier to promise that future vulnerabilities will never affect the product.

Answer

Approve the change if the new library is open source and widely used.

Question 6

HR needs to share a copy of employee records with a benefits contractor for testing. The contractor only needs names and coverage selections, not Social Security numbers or bank details. Which two actions best satisfy data handling requirements? Select two.

Accepted Answer

Redact or mask unnecessary sensitive fields before sharing the file.. Option A is correct because redacting or masking sensitive fields like Social Security numbers and bank details ensures that the contractor receives only the necessary data (names and coverage selections) while protecting personally identifiable information (PII). This aligns with the principle of data minimization and compliance with regulations such as GDPR or HIPAA, which require that only the minimum necessary data be shared for a specific purpose. Masking techniques, such as replacing SSNs with placeholders or applying irreversible hashing, prevent unauthorized exposure even if the file is intercepted.

Answer

Send the full employee record set because the contractor is trusted.

Answer

Upload the file to a public collaboration site so the contractor can retrieve it easily.

Answer

Keep an unrestricted copy on multiple shared drives for convenience.

Question 7

HR needs to send a benefits contractor a file for testing, but the contractor only needs employee names and plan selections. What is the best action before sharing the file?

Accepted Answer

Remove all fields the contractor does not need for the task. Option B is correct because data minimization is a core security principle: you should only share the minimum necessary data for the task. By removing all fields the contractor does not need (e.g., Social Security numbers, addresses, salary data), you reduce the attack surface and limit exposure of sensitive personally identifiable information (PII) in case of a breach or misuse.

Answer

Send the full file because the contractor is trusted

Answer

Post the file to a public collaboration site with a password

Answer

Rename the file so the contents are harder to identify

Question 8

A company is considering a new SaaS vendor that will process customer records. What is the best first action before signing the contract?

Accepted Answer

Perform vendor due diligence and review the vendor's security controls. Performing vendor due diligence and reviewing the vendor's security controls is the best first action because it proactively assesses the SaaS vendor's ability to protect customer records before any data is shared. This aligns with the principle of 'trust but verify' and ensures that the vendor's security posture meets the company's compliance requirements (e.g., GDPR, HIPAA) and risk tolerance before signing a legally binding contract.

Answer

Allow the vendor access immediately and monitor for misuse afterward

Answer

Ask the vendor to send a marketing brochure and pricing sheet only

Answer

Wait until a security incident occurs before reviewing the vendor

Question 9

The legal team wants to confirm that customer records are being deleted on schedule after the retention period expires. Which two artifacts best demonstrate compliance? Select two.

Accepted Answer

An approved retention schedule or retention policy that defines the deletion period.. Option A is correct because an approved retention schedule or policy is the authoritative document that defines the required deletion period for customer records. It serves as the legal mandate against which compliance is measured. Option C is correct because system or audit logs provide verifiable evidence that the deletion job executed successfully, confirming that the policy was actually followed. Together, these two artifacts demonstrate both the requirement (policy) and the execution (logs) needed to prove compliance.

Answer

A folder of employee social media posts about data cleanup.

Answer

A list of all printers in the office environment.

Answer

A draft policy from last year that was never approved.

Question 10

A finance application has a known vulnerability in a third-party reporting component. The vendor says a patch will not be available for six months, but the business cannot stop using the application. What is the BEST risk treatment for the organization to pursue next?

Accepted Answer

Mitigate the risk by adding compensating controls and tracking residual risk until the patch is available.. Option B is correct because when a known vulnerability exists in a third-party component and patching is delayed, the best risk treatment is to implement compensating controls (such as network segmentation, WAF rules, or input validation) to reduce the likelihood or impact of exploitation. This approach allows the business to continue operations while actively tracking residual risk until the vendor releases the patch. It aligns with the NIST risk management framework, which prioritizes mitigation when avoidance is not feasible.

Answer

Avoid the risk by shutting down the finance application immediately.

Answer

Transfer the risk by asking the vendor to guarantee that no incident will occur.

Answer

Accept the risk because any delay in patching is automatically low priority.

Question 11

The service desk needs a document that tells analysts exactly how to verify a caller and reset a password for a locked account. Which document type should they use?

Accepted Answer

Procedure, because it provides exact steps staff must follow in order. A procedure is the correct document type because it provides a step-by-step sequence of actions that staff must follow to complete a specific operational task, such as verifying a caller's identity and resetting a password. Unlike policies or standards, procedures are mandatory and detail the exact commands, verification checks, and escalation paths required to ensure consistent and secure execution of the task.

Answer

Policy, because it states the organization's high-level security expectations

Answer

Guideline, because it offers helpful suggestions that staff may choose to follow

Answer

Standard, because it defines a general topic without operational detail

Question 12

Based on the exhibit, what is the best next step before onboarding the vendor?

Accepted Answer

Require a security addendum with breach-notification timing, subprocessor approval, and audit rights.. The exhibit indicates the vendor has not yet provided a security addendum, which is a critical contractual document that defines security obligations such as breach-notification timing, subprocessor approval, and audit rights. Without this addendum, the organization lacks enforceable guarantees for data protection and incident response, making onboarding premature. Option B directly addresses this gap by requiring the addendum before proceeding.

Answer

Approve the vendor because it already passed a penetration test.

Answer

Ask the vendor to provide source code so developers can review it.

Answer

Move the workload to an internal shared drive until the vendor is ready.

Question 13

Match each requirement or instruction to the correct governance document type. Use each document type once.

Question 14

The help desk needs a document that tells analysts exactly how to verify a caller, reset a password, and record the ticket when a user is locked out. What type of document is this?

Accepted Answer

Procedure. A procedure is the correct type of document because it provides step-by-step instructions for performing a specific task, such as verifying a caller's identity, resetting a password, and recording a ticket. Unlike a policy, which states high-level rules, a procedure details the exact actions to take in a given scenario, making it ideal for help desk operations.

Answer

Policy

Answer

Standard

Answer

Guideline

Question 15

Match each procurement or oversight need to the best vendor due diligence artifact or clause. Use each item once.