SY0-701 Security Program Management and Oversight Practice Test 4 — 15 Questions

Question 1

Based on the exhibit, which artifact is the strongest evidence that the firewall change was reviewed and approved before implementation?

Accepted Answer

The change request record with CAB approval timestamp and implementation time.. Option C is correct because the change request record with a CAB approval timestamp and implementation time provides a clear, auditable trail that the firewall change was formally reviewed and authorized by the Change Advisory Board before it was executed. This aligns with the change management process required for security program oversight, ensuring that changes are not implemented without proper governance.

Answer

The engineer's post-implementation email, because it confirms someone checked the change.

Answer

The firewall logs, because they show the rule was applied successfully on the device.

Answer

The vendor's maintenance notice, because it explains why the rule was needed.

Question 2

Match each risk-register description to the correct risk term. Use each term once.

Question 3

Match each business scenario to the most appropriate risk treatment.
1. A legacy reporting server is expensive to replace, and leadership is willing to monitor the low expected loss for now.
2. A public web portal is being hit by credential stuffing, so the team adds MFA and rate limiting.
3. The organization wants protection from a costly third-party outage by purchasing cyber insurance.
4. A proposed project would collect regulated data that the business has decided not to process at all.

Question 4

Match each data example to the most appropriate classification label.
1. A public marketing flyer approved for external posting.
2. An internal org chart and office directory meant only for employees.
3. A customer case file with contact details and order history.
4. A vault export containing API keys and encryption secrets.

Question 5

Based on the exhibit, what should the security team add before approving the vendor's requested change?

Accepted Answer

A contract clause requiring prior written approval for new subprocessors and flow-down security obligations.. The exhibit shows the vendor requesting a change to use a new subprocessor for data storage. The security team must ensure that the vendor's contract includes a clause requiring prior written approval for new subprocessors and that security obligations flow down to them. This directly addresses the risk of unauthorized data handling by third parties, which is a key concern in vendor risk management.

Answer

A broader employee awareness training requirement for the vendor's staff.

Answer

A larger cyber insurance policy to cover possible losses if the vendor is breached.

Answer

A request for the vendor to send monthly screenshots of its backup jobs.

Question 6

Based on the exhibit, which risk treatment should the security manager recommend first?

Accepted Answer

Mitigate the risk by replacing or isolating the appliance and removing direct internet exposure.. The exhibit shows a legacy file transfer appliance with direct internet exposure and known unpatched vulnerabilities. The most immediate and effective risk treatment is to mitigate the risk by replacing or isolating the appliance and removing its direct internet exposure. This directly reduces the likelihood of exploitation by eliminating the attack surface, which aligns with the principle of defense-in-depth and is the first step before considering acceptance, avoidance, or transfer.

Answer

Accept the risk and document it for the next quarterly review.

Answer

Avoid the risk by permanently shutting down the file transfer service.

Answer

Transfer the risk by purchasing cyber insurance and keeping the current configuration.

Question 7

Based on the exhibit, what is the best data-handling action before sharing the file with the third party?

Accepted Answer

Redact the unnecessary sensitive fields and provide only the minimum necessary extract after approval.. Option B is correct because data minimization and the principle of least privilege require that only the minimum necessary sensitive data be shared with a third party. Redacting unnecessary sensitive fields and obtaining approval ensures compliance with data protection policies and reduces the risk of unauthorized exposure, even if the recipient has signed an NDA.

Answer

Send the full spreadsheet encrypted and let the vendor filter out the extra columns.

Answer

Mark the spreadsheet as internal and share it through the benefits contractor's cloud portal.

Answer

Send the file unchanged because the contractor signed a nondisclosure agreement.

Question 8

Based on the exhibit, which missing control best improves oversight of the supplier?

Accepted Answer

Right-to-audit clause.. A right-to-audit clause is the missing control that best improves oversight of the supplier because it grants the organization contractual authority to examine the supplier's security controls, processes, and compliance evidence. Without this clause, the organization has no formal mechanism to verify that the supplier is adhering to agreed-upon security requirements, leaving oversight entirely dependent on trust.

Answer

Allow the supplier to choose any encryption algorithm it wants.

Answer

Disable all contract reviews after signature.

Answer

Require the vendor to use employee badges for all facilities.

Question 9

Based on the exhibit, which metric best shows that employees are recognizing and escalating phishing attempts more quickly?

Accepted Answer

Median report time, because it shows how quickly users notify security after spotting a phish.. The median report time directly measures the speed at which employees notify the security team after identifying a phishing simulation email. A decreasing median report time indicates that users are recognizing phishing attempts more quickly and escalating them, which is the key behavioral change this metric captures. Unlike click rate, which only measures failure, report time measures the positive action of reporting.

Answer

Click rate, because a lower click rate is the only useful awareness metric.

Answer

Training completion rate, because it proves every employee attended the awareness session.

Answer

Number of simulation emails sent, because a larger campaign is always a better metric.

Question 10

Based on the exhibit, which metric best indicates improved phishing resistance?

Accepted Answer

Phish report rate.. The phish report rate measures how many users report a simulated phishing email to the security team, which directly indicates their ability to recognize and respond to phishing attempts. A higher report rate demonstrates improved security awareness and resistance because users are actively identifying threats rather than ignoring or falling for them. This metric is a key performance indicator in security awareness programs because it reflects behavioral change, not just training completion.

Answer

Training completion rate.

Answer

Number of phishing emails sent by attackers.

Answer

Total number of help desk tickets.

Question 11

A payroll SaaS provider has passed initial review, but before contract signing it announces that customer data will be processed by a new subcontractor in another country. The business wants to keep the onboarding timeline short, but security still needs assurance that the change does not increase exposure. What is the BEST next step?

Accepted Answer

Update the third-party risk assessment and require evidence of the subcontractor's controls before approval.. The correct answer is B because the introduction of a new subcontractor in a different country represents a material change to the data processing environment, which invalidates the initial risk assessment. Security must update the third-party risk assessment to evaluate the subcontractor's controls, such as data protection, encryption standards, and compliance with local regulations, before approval. This ensures that the change does not increase exposure, even if the primary provider passed initial review.

Answer

Approve the vendor because the primary provider already passed the initial review.

Answer

Wait until the first quarterly audit to review the subcontractor change.

Answer

Accept the change if the vendor provides a marketing brochure describing its security program.

Question 12

An external auditor asks for proof that quarterly privileged access reviews were completed and that any exceptions were tracked to closure during the last year. Which evidence is MOST appropriate to provide?

Accepted Answer

Signed access review records and remediation tickets from the access management process.. Option B is correct because signed access review records provide verifiable proof that quarterly reviews were conducted, and remediation tickets demonstrate that any exceptions (e.g., excessive privileges) were tracked and resolved. This aligns with the principle of audit evidence: it must be objective, verifiable, and show a complete chain of actions from review to closure. A screenshot or policy alone lacks the audit trail of actual completion and exception handling.

Answer

A screenshot of one administrator's account showing current privileges.

Answer

The security policy that says access reviews must happen every quarter.

Answer

An email from the system administrator stating that reviews were completed on time.

Question 13

Based on the exhibit, what is the best risk treatment recommendation for the security manager?

Accepted Answer

Mitigate the risk with compensating controls until the migration is complete.. Mitigation is the strongest recommendation here because the portal must stay available for 90 more days, yet the risk score is high and existing controls are limited. Since the organization has budget for compensating controls, the manager should reduce likelihood and impact through measures such as tighter access restrictions, additional monitoring, or isolation. That preserves the business function while lowering exposure until migration is complete.

Why others are wrong: Accepting the risk leaves a high-likelihood, high-impact exposure in place without additional protection. Avoiding the risk would effectively shut down a required business service before the replacement is ready. Transferring the risk through insurance may help with financial loss, but it does not actually reduce the portal’s attack surface or the chance of disruption.

Answer

Accept the risk because backups are already enabled.

Answer

Avoid the risk by immediately retiring the portal.

Answer

Transfer the risk by purchasing cyber insurance only.

Question 14

A company wants to state that customer data must not be emailed externally unless a manager approves the exception. Which document type should contain this rule?

Accepted Answer

Policy, because it establishes mandatory organizational rules. A policy is the correct document type because it establishes mandatory organizational rules that must be followed. The requirement that customer data must not be emailed externally without manager approval is a binding directive, not a suggestion or a step-by-step guide. Policies define high-level security requirements that all employees must comply with, making them the appropriate vehicle for this rule.

Answer

Guideline, because it gives staff flexible suggestions about email use

Answer

Procedure, because it lists the exact button clicks for sending email

Answer

Standard, because it provides a general recommendation for communication

Question 15

Based on the exhibit, which document type should the service desk use for the locked-account workflow?

Accepted Answer

Procedure, because it lists the exact steps analysts must follow in sequence.. A procedure document is the correct choice because it provides a step-by-step sequence of actions that service desk analysts must follow to unlock an account. The locked-account workflow requires precise, ordered steps (e.g., verifying identity, checking lockout status, resetting the account) to ensure consistency and security, which aligns with the definition of a procedure.

Answer

Policy, because it states broad rules for account access.

Answer

Standard, because it defines the minimum password requirements for all users.

Answer

Guideline, because it gives flexible suggestions for handling locked accounts.

SY0-701 Security Program Management and Oversight Practice Test 4 — 15 Questions

Exhibit

SY0-701 Security Program Management and Oversight Practice Test 4 — 15 Questions

Exhibit