SY0-701 Security Program Management and Oversight Practice Test 3 — 15 Questions

Question 1

A security manager at a financial services company is evaluating the effectiveness of a newly deployed security awareness training program. The program included modules on recognizing phishing emails, password security, and tailgating. One month after the training, the manager wants to assess whether employees are applying the learned behaviors to reduce the risk of phishing attacks. Which of the following metrics would provide the most valid indication of the training's behavioral impact?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The reduction in the employee click-through rate on simulated phishing campaigns.. The reduction in the employee click-through rate on simulated phishing campaigns directly measures a change in behavior—specifically, whether employees are applying the training to avoid clicking malicious links. Unlike knowledge scores or completion rates, this metric captures real-world application of the learned behavior in a controlled, measurable environment.

Answer

The percentage of employees who completed the training modules.

Answer

The average score on the post-training knowledge quiz.

Answer

The number of reported phishing incidents to the security team.

Question 2

A security manager at a healthcare organization is responsible for maintaining the information security policy. A project manager requests a policy exception to use a cloud-based analytics platform that stores patient data. The platform currently encrypts data at rest with AES-128 instead of the required AES-256. The security manager assesses the risk and determines that the likelihood of data exposure is low due to other compensating controls already in place, but the impact would be high. The residual risk is within the organization's risk appetite. Which of the following is the most appropriate action for the security manager to take?

Accepted Answer

Approve the exception and document the compensating controls and a review date.. The security manager has assessed the risk, determined that compensating controls reduce the likelihood of data exposure, and confirmed that the residual risk is within the organization's risk appetite. Formally approving the exception with documented compensating controls and a review date ensures governance, accountability, and a timeline for reassessment, which aligns with the policy exception process in security program management.

Answer

Deny the exception and require the project to use an approved platform that meets the AES-256 requirement.

Answer

Accept the risk and allow the project to proceed without a formal exception.

Answer

Escalate the request to the chief information officer for a final decision.

Question 3

An IT manager wants a document that defines the mandatory minimum requirements for all company laptops, including full-disk encryption, password length, and screen-lock timing. The help desk also needs a separate document that shows exactly how to enroll a laptop in management software. Which document type should contain the mandatory laptop requirements?

Accepted Answer

Standard, because it defines the required technical settings that must be followed.. A standard defines mandatory, specific technical requirements that must be uniformly applied, such as full-disk encryption (e.g., AES-256), minimum password length (e.g., 14 characters), and screen-lock timeout (e.g., 5 minutes). Unlike a policy, which provides high-level direction, a standard enforces precise configuration baselines that all laptops must meet, ensuring compliance and security consistency.

Answer

Policy, because it gives broad direction without technical detail.

Answer

Procedure, because it gives step-by-step instructions for completing a task.

Answer

Guideline, because it offers flexible recommendations for administrators.

Question 4

During onboarding, a manager wants a document that explains how to request access to a shared drive, who approves it, and what the help desk must do after approval. Which document type is MOST appropriate?

Accepted Answer

Procedure, because it provides the ordered steps for requesting and fulfilling access.. A procedure is the correct document type because it specifies the exact ordered steps for requesting access to a shared drive, the approval authority, and the help desk's post-approval actions. Unlike a policy, which states high-level security principles, a procedure provides the operational workflow needed for onboarding tasks.

Answer

Guideline, because it describes optional best practices for access requests.

Answer

Policy, because it names the general security principle without implementation detail.

Answer

Standard, because it should define every case-specific approval path in the organization.

Question 5

Match each awareness-program metric to the interpretation the security team should use.
1. 8% of users clicked the simulated phishing link.
2. 34% of users reported the simulation using the report-phish button.
3. The median time from message delivery to first user report was 12 minutes.
4. 96% of staff completed the annual awareness module.

Accepted Answer

8% of users clicked: Indicates user susceptibility to phishing.. Each metric guides interpretation: click rate indicates susceptibility, report rate shows security culture, reaction time measures responsiveness, and completion rate reflects training adoption.

Answer

8% of users clicked: Demonstrates strong security culture.

Answer

34% of users reported: Measures susceptibility to phishing.

Question 6

Based on the exhibit, which document type should the organization update if it wants the listed endpoint settings to be mandatory baseline requirements?

Accepted Answer

Standard, because it defines mandatory minimum settings that all systems must meet.. A standard is the correct document type because it defines mandatory, minimum-security configuration requirements that all systems must meet, such as specific endpoint settings. Unlike a policy, which states broad intent, a standard provides the enforceable baseline that ensures consistent security posture across the organization.

Answer

Policy, because it defines the organization's broad security intent and direction.

Answer

Procedure, because it provides the exact steps administrators follow to configure the setting.

Answer

Guideline, because it is the least restrictive document for endpoint protection.

Question 7

A security manager wants evidence that annual security awareness training was completed by employees. Which artifact is the best proof?

Accepted Answer

A training completion report exported from the learning system. A training completion report exported from the learning system is the best proof because it provides a verifiable, timestamped record of each employee's completion status, including user IDs, course names, completion dates, and scores. This artifact directly demonstrates that the training was actually completed, not just assigned or attended, and can be audited against the organization's training policy.

Answer

A copy of the company logo used on the training slides

Answer

A list of office supplies purchased last quarter

Answer

A screenshot of the company's public homepage

Question 8

Match each audit request to the best evidence artifact.
1. Auditors want proof that managers reviewed privileged access last quarter.
2. Auditors want evidence that an emergency firewall change was approved before implementation.
3. Auditors want to verify that annual security training was completed by staff.
4. Auditors want to confirm that records were deleted after the retention period expired.

Accepted Answer

Request 1: Access review records with manager sign-offs. Each audit request requires specific evidence: access reviews show manager sign-offs, change requests prove pre-approval, training records confirm completion, and deletion logs demonstrate data disposal per policy.

Answer

Request 2: Access review records with manager sign-offs

Answer

Request 4: Training completion records

Question 9

A marketing analyst asks for a spreadsheet containing customer names, email addresses, purchase history, and government ID numbers so the team can build a campaign list. What is the BEST security response?

Accepted Answer

Provide only the minimum fields required and remove the government ID numbers.. The best security response is to apply the principle of least privilege and data minimization. Government ID numbers are sensitive personally identifiable information (PII) that are not necessary for building a marketing campaign list; providing only the minimum required fields (e.g., names and email addresses) reduces the risk of exposure and complies with data protection regulations like GDPR or CCPA.

Answer

Approve the request because the data is needed for any marketing activity.

Answer

Send the full file, but ask the analyst not to store it permanently.

Answer

Classify the file as public so it can be shared more easily with the marketing team.

Question 10

A department identifies a low-likelihood software risk that would be expensive to fix right now. Leadership decides the business can live with the exposure for now, but wants it documented and reviewed later. What risk treatment is this?

Accepted Answer

Accept the risk with documented approval and periodic review. The scenario describes a low-likelihood, high-cost software risk that leadership chooses to tolerate rather than fix immediately. This is the definition of risk acceptance, which requires documented approval and periodic review to ensure the risk remains acceptable over time. The correct risk treatment is to formally accept the exposure with a record of the decision and a schedule for reassessment.

Answer

Mitigate the risk by applying a technical control immediately

Answer

Transfer the risk to an insurer or third party

Answer

Avoid the risk by stopping the business activity entirely

Question 11

A supplier tells your company it wants to use a new subcontractor to process customer data. What is the BEST contract control to reduce this risk?

Accepted Answer

Require the vendor to notify the company before adding subcontractors. Requiring the vendor to notify the company before adding subcontractors is the best contract control because it ensures the company retains visibility and approval authority over any third party that will process customer data. This aligns with the principle of due diligence and third-party risk management, as the company can assess the subcontractor's security posture before data is shared. Without such a clause, the vendor could unilaterally introduce a subcontractor with inadequate security controls, increasing the risk of a data breach or compliance violation.

Answer

Allow subcontractors without review if the vendor remains responsible

Answer

Only require a verbal promise that the subcontractor is secure

Answer

Remove all contract language related to third parties

Question 12

After three months of phishing awareness training, the security team wants a metric that best shows whether employees are becoming harder to trick. Which metric is MOST useful?

Accepted Answer

The percentage of users who report suspicious messages before clicking links.. The percentage of users who report suspicious messages before clicking links directly measures the effectiveness of phishing awareness training in changing user behavior. A higher reporting rate indicates that employees are recognizing phishing indicators and using the reporting mechanism (e.g., an integrated phishing report button or email forwarding to a security mailbox) instead of falling for the trick. This metric focuses on the desired outcome—reducing successful phishing—rather than activity volume.

Answer

The total number of phishing simulation emails sent to employees.

Answer

The number of new usernames created in the email system.

Answer

The average screen resolution used by employees during the campaign.

Question 13

An external auditor asks for proof that firewall rule changes were reviewed and approved before being implemented during the last quarter. Which evidence is MOST appropriate to provide?

Accepted Answer

Change tickets showing requester, reviewer approval, implementation date, and rollback plan.. Change tickets provide a formal, auditable record of the entire change management process, including requester identification, reviewer approval, implementation date, and rollback plan. This directly satisfies the auditor's requirement for proof that firewall rule changes were reviewed and approved before implementation, aligning with the principle of separation of duties and change control.

Answer

A screenshot of the firewall management homepage showing that the system is online.

Answer

An email from the network team stating they remember reviewing the changes.

Answer

A list of the firewall vendor's product features from the company website.

Question 14

A company is evaluating a new payroll SaaS provider that will store employee tax and bank details. Before signing the contract, which action BEST supports vendor due diligence?

Accepted Answer

Review a current independent security attestation and verify contractual security obligations.. Vendor due diligence for a SaaS provider handling sensitive employee data (tax and bank details) requires verifying independent security attestations (e.g., SOC 2 Type II, ISO 27001 certification) and ensuring contractual security obligations (e.g., data encryption, breach notification, right to audit) are explicitly defined. This provides objective, audited evidence of the vendor's security posture rather than relying on marketing claims or unverified assurances.

Answer

Ask the vendor for a marketing brochure describing platform features and uptime claims.

Answer

Accept the vendor’s assurance that its customers have never experienced incidents.

Answer

Wait until after go-live and then review the security posture during the first annual audit.

Question 15

Match each vendor-risk concern to the contractual control that best addresses it.
1. The company wants the right to review the vendor's controls and supporting records after the contract is signed.
2. The company wants to know when the vendor will use subcontractors that may touch its data.
3. The company wants written notice within 24 hours if the vendor suffers an incident affecting company data.
4. The company wants assurance that the vendor's controls are independently assessed each year.

Accepted Answer

Vendor control review: Right to audit. Right to audit allows reviewing controls; subcontractor clause requires notification; incident clause mandates timely breach notification; independent assessment ensures annual audits; DPA covers data protection; SLA defines service levels.

Answer

Vendor control review: Subcontractor clause

Answer

Incident notification: Data protection agreement