SY0-701 Security Program Management and Oversight Practice Test 3 — 15 Questions

Question 1

A security manager at a healthcare organization is reviewing the results of a third-party vendor risk assessment for a cloud-based email service that will store protected health information (PHI). The assessment reveals that the vendor encrypts data at rest using AES-256 but does not support customer-managed encryption keys. The vendor's data center is located in a country that is not subject to HIPAA jurisdiction. The vendor's previous penetration test report is over 18 months old. Which of the following is the most appropriate risk management action for the security manager to take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Request the vendor to obtain a current SOC 2 Type II report and review the findings before making a decision.. A SOC 2 Type II report provides an independent assessment of a vendor's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time. Given the vendor's lack of customer-managed keys and outdated penetration test, the security manager needs a current, comprehensive audit report to evaluate whether compensating controls adequately mitigate the risks of storing PHI outside HIPAA jurisdiction. This action allows an informed risk acceptance or mitigation decision without prematurely terminating a potentially compliant service.

Answer

Accept the risk because the vendor uses strong encryption.

Answer

Terminate the contract immediately and select a different vendor.

Answer

Require the vendor to implement customer-managed keys and provide a new penetration test report within 30 days.

Question 2

A security manager at a hospital is reviewing the annual vendor risk assessment for a cloud-based electronic health record (EHR) provider. The provider's SOC 2 Type II report, issued six months ago, identifies a significant deficiency in logical access controls: the provider failed to revoke access for former employees in a timely manner. The provider's management has asserted that this deficiency has been fully remediated, but the next SOC 2 audit is not scheduled for another eight months. The hospital's data protection policy requires that any vendor handling protected health information (PHI) must have a current SOC 2 Type II report with no unresolved significant deficiencies. Which of the following is the most appropriate next step for the security manager?

Accepted Answer

Require the vendor to provide a bridge letter from their external auditor confirming that the remediation has been implemented and is operating effectively.. The hospital's policy requires a current SOC 2 Type II report with no unresolved significant deficiencies. Since the deficiency was reported but is claimed to be fixed, a bridge letter from the external auditor provides independent assurance that the remediation is effective and operating as intended, bridging the gap until the next formal audit. This is the most appropriate step because it maintains compliance without prematurely terminating a critical vendor relationship.

Answer

Accept the vendor's assertion that the deficiency has been remediated and continue the relationship as is.

Answer

Immediately terminate the contract with the EHR provider and begin the process of selecting a new vendor.

Answer

Increase the frequency of manual access reviews performed by the hospital's internal IT staff on the vendor's systems.

Question 3

A security manager at a financial services company is evaluating the effectiveness of a newly deployed security awareness training program. The program included modules on recognizing phishing emails, password security, and tailgating. One month after the training, the manager wants to assess whether employees are applying the learned behaviors to reduce the risk of phishing attacks. Which of the following metrics would provide the most valid indication of the training's behavioral impact?

Accepted Answer

The reduction in the employee click-through rate on simulated phishing campaigns.. The reduction in the employee click-through rate on simulated phishing campaigns directly measures a change in behavior—specifically, whether employees are applying the training to avoid clicking malicious links. Unlike knowledge scores or completion rates, this metric captures real-world application of the learned behavior in a controlled, measurable environment.

Answer

The percentage of employees who completed the training modules.

Answer

The average score on the post-training knowledge quiz.

Answer

The number of reported phishing incidents to the security team.

Question 4

A security manager at a healthcare organization is reviewing the results of a third-party vendor risk assessment for a cloud-based email service that will store protected health information (PHI). The assessment reveals that the vendor encrypts data at rest using AES-256 but does not support customer-managed encryption keys. The vendor's data center is located in a country that is not subject to HIPAA jurisdiction. The vendor's previous penetration test report is over 18 months old. Which of the following is the most appropriate risk management action for the security manager to take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Approve the exception and document the compensating controls and a review date.. The security manager has assessed the risk, determined that compensating controls reduce the likelihood of data exposure, and confirmed that the residual risk is within the organization's risk appetite. Formally approving the exception with documented compensating controls and a review date ensures governance, accountability, and a timeline for reassessment, which aligns with the policy exception process in security program management.

Answer

Deny the exception and require the project to use an approved platform that meets the AES-256 requirement.

Answer

Accept the risk and allow the project to proceed without a formal exception.

Answer

Escalate the request to the chief information officer for a final decision.

Question 5

An IT manager wants a document that defines the mandatory minimum requirements for all company laptops, including full-disk encryption, password length, and screen-lock timing. The help desk also needs a separate document that shows exactly how to enroll a laptop in management software. Which document type should contain the mandatory laptop requirements?

Accepted Answer

Standard, because it defines the required technical settings that must be followed.. A standard defines mandatory, specific technical requirements that must be uniformly applied, such as full-disk encryption (e.g., AES-256), minimum password length (e.g., 14 characters), and screen-lock timeout (e.g., 5 minutes). Unlike a policy, which provides high-level direction, a standard enforces precise configuration baselines that all laptops must meet, ensuring compliance and security consistency.

Answer

Policy, because it gives broad direction without technical detail.

Answer

Procedure, because it gives step-by-step instructions for completing a task.

Answer

Guideline, because it offers flexible recommendations for administrators.

Question 6

During onboarding, a manager wants a document that explains how to request access to a shared drive, who approves it, and what the help desk must do after approval. Which document type is MOST appropriate?

Accepted Answer

Procedure, because it provides the ordered steps for requesting and fulfilling access.. A procedure is the correct document type because it specifies the exact ordered steps for requesting access to a shared drive, the approval authority, and the help desk's post-approval actions. Unlike a policy, which states high-level security principles, a procedure provides the operational workflow needed for onboarding tasks.

Answer

Guideline, because it describes optional best practices for access requests.

Answer

Policy, because it names the general security principle without implementation detail.

Answer

Standard, because it should define every case-specific approval path in the organization.

Question 7

Match each awareness-program metric to the interpretation the security team should use.
1. 8% of users clicked the simulated phishing link.
2. 34% of users reported the simulation using the report-phish button.
3. The median time from message delivery to first user report was 12 minutes.
4. 96% of staff completed the annual awareness module.

Accepted Answer

8% of users clicked: Indicates user susceptibility to phishing.. Each metric guides interpretation: click rate indicates susceptibility, report rate shows security culture, reaction time measures responsiveness, and completion rate reflects training adoption.

Answer

8% of users clicked: Demonstrates strong security culture.

Answer

34% of users reported: Measures susceptibility to phishing.

Question 8

Based on the exhibit, which document type should the organization update if it wants the listed endpoint settings to be mandatory baseline requirements?

Accepted Answer

Standard, because it defines mandatory minimum settings that all systems must meet.. A standard is the correct document type because it defines mandatory, minimum-security configuration requirements that all systems must meet, such as specific endpoint settings. Unlike a policy, which states broad intent, a standard provides the enforceable baseline that ensures consistent security posture across the organization.

Answer

Policy, because it defines the organization's broad security intent and direction.

Answer

Procedure, because it provides the exact steps administrators follow to configure the setting.

Answer

Guideline, because it is the least restrictive document for endpoint protection.

Question 9

A security manager wants evidence that annual security awareness training was completed by employees. Which artifact is the best proof?

Accepted Answer

A training completion report exported from the learning system. A training completion report exported from the learning system is the best proof because it provides a verifiable, timestamped record of each employee's completion status, including user IDs, course names, completion dates, and scores. This artifact directly demonstrates that the training was actually completed, not just assigned or attended, and can be audited against the organization's training policy.

Answer

A copy of the company logo used on the training slides

Answer

A list of office supplies purchased last quarter

Answer

A screenshot of the company's public homepage

Question 10

Match each audit request to the best evidence artifact.
1. Auditors want proof that managers reviewed privileged access last quarter.
2. Auditors want evidence that an emergency firewall change was approved before implementation.
3. Auditors want to verify that annual security training was completed by staff.
4. Auditors want to confirm that records were deleted after the retention period expired.

Accepted Answer

Request 1: Access review records with manager sign-offs. Each audit request requires specific evidence: access reviews show manager sign-offs, change requests prove pre-approval, training records confirm completion, and deletion logs demonstrate data disposal per policy.

Answer

Request 2: Access review records with manager sign-offs

Answer

Request 4: Training completion records

Question 11

A marketing analyst asks for a spreadsheet containing customer names, email addresses, purchase history, and government ID numbers so the team can build a campaign list. What is the BEST security response?

Accepted Answer

Provide only the minimum fields required and remove the government ID numbers.. The best security response is to apply the principle of least privilege and data minimization. Government ID numbers are sensitive personally identifiable information (PII) that are not necessary for building a marketing campaign list; providing only the minimum required fields (e.g., names and email addresses) reduces the risk of exposure and complies with data protection regulations like GDPR or CCPA.

Answer

Approve the request because the data is needed for any marketing activity.

Answer

Send the full file, but ask the analyst not to store it permanently.

Answer

Classify the file as public so it can be shared more easily with the marketing team.

Question 12

A department identifies a low-likelihood software risk that would be expensive to fix right now. Leadership decides the business can live with the exposure for now, but wants it documented and reviewed later. What risk treatment is this?

Accepted Answer

Accept the risk with documented approval and periodic review. The scenario describes a low-likelihood, high-cost software risk that leadership chooses to tolerate rather than fix immediately. This is the definition of risk acceptance, which requires documented approval and periodic review to ensure the risk remains acceptable over time. The correct risk treatment is to formally accept the exposure with a record of the decision and a schedule for reassessment.

Answer

Mitigate the risk by applying a technical control immediately

Answer

Transfer the risk to an insurer or third party

Answer

Avoid the risk by stopping the business activity entirely

Question 13

A supplier tells your company it wants to use a new subcontractor to process customer data. What is the BEST contract control to reduce this risk?

Accepted Answer

Require the vendor to notify the company before adding subcontractors. Requiring the vendor to notify the company before adding subcontractors is the best contract control because it ensures the company retains visibility and approval authority over any third party that will process customer data. This aligns with the principle of due diligence and third-party risk management, as the company can assess the subcontractor's security posture before data is shared. Without such a clause, the vendor could unilaterally introduce a subcontractor with inadequate security controls, increasing the risk of a data breach or compliance violation.

Answer

Allow subcontractors without review if the vendor remains responsible

Answer

Only require a verbal promise that the subcontractor is secure

Answer

Remove all contract language related to third parties

Question 14

After three months of phishing awareness training, the security team wants a metric that best shows whether employees are becoming harder to trick. Which metric is MOST useful?

Accepted Answer

The percentage of users who report suspicious messages before clicking links.. The percentage of users who report suspicious messages before clicking links directly measures the effectiveness of phishing awareness training in changing user behavior. A higher reporting rate indicates that employees are recognizing phishing indicators and using the reporting mechanism (e.g., an integrated phishing report button or email forwarding to a security mailbox) instead of falling for the trick. This metric focuses on the desired outcome—reducing successful phishing—rather than activity volume.

Answer

The total number of phishing simulation emails sent to employees.

Answer

The number of new usernames created in the email system.

Answer

The average screen resolution used by employees during the campaign.

Question 15

An external auditor asks for proof that firewall rule changes were reviewed and approved before being implemented during the last quarter. Which evidence is MOST appropriate to provide?

Accepted Answer

Change tickets showing requester, reviewer approval, implementation date, and rollback plan.. Change tickets provide a formal, auditable record of the entire change management process, including requester identification, reviewer approval, implementation date, and rollback plan. This directly satisfies the auditor's requirement for proof that firewall rule changes were reviewed and approved before implementation, aligning with the principle of separation of duties and change control.

Answer

A screenshot of the firewall management homepage showing that the system is online.

Answer

An email from the network team stating they remember reviewing the changes.

Answer

A list of the firewall vendor's product features from the company website.