SY0-701 Security Program Management and Oversight Practice Test 4 — 15 Questions

Question 1

Match each procurement need to the vendor due diligence artifact or control that best fits.
1. Procurement wants independent evidence that a SaaS provider's controls operated effectively during the last year.
2. The team wants to know what files, libraries, and modules were included in a supplier's software build.
3. The business needs a signed agreement that defines how customer data is handled and what the vendor must do if an incident occurs.
4. The procurement team wants answers about MFA, logging, and incident response before onboarding a cloud supplier.

Accepted Answer

SOC 2 Type II: Independent evidence that a SaaS provider's controls operated effectively during the last year.. Each artifact or control directly addresses the procurement need: SOC 2 Type II provides independent audit evidence; SBOM lists software components; DPA is the legal agreement for data handling; security questionnaires gather specific security practices; pen test reports validate controls; BCP ensures continuity.

Answer

Pen test report: Independent evidence that a SaaS provider's controls operated effectively during the last year.

Answer

BCP: A signed agreement that defines how customer data is handled and what the vendor must do if an incident occurs.

Question 2

A data analyst needs a copy of a customer file for product testing. The file includes names, email addresses, purchase history, and government ID numbers, but the test team only needs the names and purchase history. What is the BEST handling action?

Accepted Answer

Remove or mask the government ID numbers before sharing the minimum necessary fields.. It applies the principle of least privilege and data minimization. The test team only needs names and purchase history, so removing or masking the government ID numbers before sharing the minimum necessary fields protects sensitive personally identifiable information (PII) and complies with data protection regulations like GDPR or CCPA. This action reduces the risk of unauthorized exposure of high-risk data while still enabling the test team to perform their work.

Answer

Provide the full file because the test team is internal and already trusted.

Answer

Encrypt the file and send it by email to the entire test group.

Answer

Keep the file unchanged and rely on the team not to open the sensitive columns.

Question 3

Based on the exhibit, which document type should define the exact encryption algorithm and minimum key length for all company laptops?

Accepted Answer

Standard. A Standard defines mandatory, specific technical requirements such as the exact encryption algorithm (e.g., AES-256) and minimum key length (e.g., 256 bits) that must be enforced on all company laptops. Policies are high-level statements of intent, while Standards provide the measurable, enforceable criteria to implement that intent. In this context, the encryption algorithm and key length are precise technical specifications, not general guidance or step-by-step instructions.

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 4

A project team identifies a new risk with a high likelihood of minor data exposure during a pilot rollout. The impact is low, but the issue would become harder to address after production launch. The business owner wants the project to proceed. What should the risk owner do NEXT?

Accepted Answer

Document the risk, assign an owner, and escalate for acceptance or treatment before launch.. The risk owner must follow the formal risk management process: document the risk, assign an owner, and escalate it to the business owner for a decision on acceptance or treatment before the pilot launch. Even though the impact is low, the high likelihood and the fact that the issue becomes harder to address post-production mean the risk cannot be ignored or deferred; it requires a documented acceptance or a mitigation plan before proceeding.

Answer

Ignore the issue because the impact is low.

Answer

Wait until after production launch to see whether the issue actually occurs.

Answer

Transfer the risk by moving the pilot to a different business unit.

Question 5

Match each governance need to the document type that best fits.
1. All employees must follow rules for acceptable use of company systems.
2. Every company laptop must use full-disk encryption and a 14-character screen-lock PIN.
3. The service desk follows these exact steps to verify a caller before resetting MFA.
4. Admins are encouraged to place non-production test data in approved folders when practical.

Accepted Answer

AUP: All employees must follow rules for acceptable use of company systems.. AUP is a policy for acceptable use; standards are mandatory requirements; procedures are step-by-step instructions; guidelines are recommendations; policy is a high-level directive; baseline defines minimum configurations.

Answer

Policy: All employees must follow rules for acceptable use of company systems.

Answer

Baseline: Every company laptop must use full-disk encryption and a 14-character screen-lock PIN.

Question 6

A business unit wants to keep using a customer portal even though a low-likelihood, high-impact dependency risk was identified. Leadership does not want to stop the service, but it does want to lower exposure and formally document the remaining risk. Which two actions best fit that approach? Select two.

Accepted Answer

Implement compensating controls to reduce the chance or impact of the event.. Implementing compensating controls is a standard risk mitigation strategy that reduces the likelihood or impact of a dependency risk without stopping the service. For a customer portal, this could include adding web application firewall (WAF) rules, rate limiting, or failover mechanisms to lower exposure while keeping the portal operational.

Answer

Immediately shut down the portal until the dependency risk is completely eliminated.

Answer

Ignore the finding until the next annual audit cycle.

Answer

Transfer the issue to the help desk by opening a routine support ticket.

Question 7

After implementing MFA and stronger monitoring, a department still has a small chance of account misuse that could affect a low-value internal tool. The business owner reviews the remaining exposure and agrees it is within tolerance. What should happen next?

Accepted Answer

Document the residual risk and obtain formal acceptance from the risk owner.. After implementing MFA and stronger monitoring, the remaining exposure is residual risk that must be formally documented and accepted by the risk owner (the business owner). This aligns with the risk management process in Security Program Management, where residual risk that falls within the organization's risk appetite is accepted rather than eliminated. The business owner's agreement indicates formal acceptance, which should be recorded for audit and compliance purposes.

Answer

Escalate the issue to legal because all residual risk must be eliminated.

Answer

Remove MFA because the remaining risk is already low.

Answer

Treat the issue as resolved because monitoring alone eliminates all risk.

Question 8

A desktop engineering team needs the document that sets the mandatory minimum password length and screen-lock timeout for all company laptops. Which document type should they use?

Accepted Answer

Standard. A standard specifies mandatory technical requirements, such as minimum password length and screen-lock timeout, that must be implemented on all company laptops. Unlike a policy, which is high-level and states management intent, a standard provides the specific, enforceable configuration settings. This aligns with the desktop engineering team's need for a document that dictates exact technical parameters.

Answer

Policy

Answer

Guideline

Answer

Procedure

Question 9

After several password-reset incidents, the security team wants one document that sets mandatory minimum controls for privileged accounts and another that tells the help desk the exact steps to verify identity and reset access. Which two document types should they use? Select two.

Accepted Answer

Standard, because it defines the mandatory minimum requirements that everyone must follow.. A standard defines mandatory minimum requirements that must be followed, such as password length, complexity, and MFA enforcement for privileged accounts. This ensures consistent security controls across the organization without ambiguity, unlike a policy which is high-level intent.

Answer

Policy, because it explains the organization's overall security intent in broad terms.

Answer

Guideline, because it provides recommended practices that staff may ignore if needed.

Answer

Baseline, because it is mainly used as a casual reference document for analysts.

Question 10

A software supplier used by your company is adding a new library to its product and says the change is "internal only." Your security team wants better visibility into future component risks before the next renewal. What requirement would BEST support supply chain due diligence?

Accepted Answer

Require an updated software bill of materials and a notification process for material component changes.. A Software Bill of Materials (SBOM) provides a detailed inventory of all components in a product, enabling the security team to assess risks from new libraries. Requiring an SBOM plus a notification process for material changes gives proactive visibility into component risks, directly supporting supply chain due diligence as recommended by frameworks like NIST SP 800-161.

Answer

Require the supplier to provide a marketing summary of its development process.

Answer

Ask the supplier to promise that future vulnerabilities will never affect the product.

Answer

Approve the change if the new library is open source and widely used.

Question 11

HR needs to share a copy of employee records with a benefits contractor for testing. The contractor only needs names and coverage selections, not Social Security numbers or bank details. Which two actions best satisfy data handling requirements? Select two.

Accepted Answer

Redact or mask unnecessary sensitive fields before sharing the file.. Redacting or masking sensitive fields like Social Security numbers and bank details ensures that the contractor receives only the necessary data (names and coverage selections) while protecting personally identifiable information (PII). This aligns with the principle of data minimization and compliance with regulations such as GDPR or HIPAA, which require that only the minimum necessary data be shared for a specific purpose. Masking techniques, such as replacing SSNs with placeholders or applying irreversible hashing, prevent unauthorized exposure even if the file is intercepted.

Answer

Send the full employee record set because the contractor is trusted.

Answer

Upload the file to a public collaboration site so the contractor can retrieve it easily.

Answer

Keep an unrestricted copy on multiple shared drives for convenience.

Question 12

HR needs to send a benefits contractor a file for testing, but the contractor only needs employee names and plan selections. What is the best action before sharing the file?

Accepted Answer

Remove all fields the contractor does not need for the task. Data minimization is a core security principle: you should only share the minimum necessary data for the task. By removing all fields the contractor does not need (e.g., Social Security numbers, addresses, salary data), you reduce the attack surface and limit exposure of sensitive personally identifiable information (PII) in case of a breach or misuse.

Answer

Send the full file because the contractor is trusted

Answer

Post the file to a public collaboration site with a password

Answer

Rename the file so the contents are harder to identify

Question 13

A company is considering a new SaaS vendor that will process customer records. What is the best first action before signing the contract?

Accepted Answer

Perform vendor due diligence and review the vendor's security controls. Performing vendor due diligence and reviewing the vendor's security controls is the best first action because it proactively assesses the SaaS vendor's ability to protect customer records before any data is shared. This aligns with the principle of 'trust but verify' and ensures that the vendor's security posture meets the company's compliance requirements (e.g., GDPR, HIPAA) and risk tolerance before signing a legally binding contract.

Answer

Allow the vendor access immediately and monitor for misuse afterward

Answer

Ask the vendor to send a marketing brochure and pricing sheet only

Answer

Wait until a security incident occurs before reviewing the vendor

Question 14

The legal team wants to confirm that customer records are being deleted on schedule after the retention period expires. Which two artifacts best demonstrate compliance? Select two.

Accepted Answer

An approved retention schedule or retention policy that defines the deletion period.. An approved retention schedule or policy is the authoritative document that defines the required deletion period for customer records. It serves as the legal mandate against which compliance is measured. Option C is correct because system or audit logs provide verifiable evidence that the deletion job executed successfully, confirming that the policy was actually followed. Together, these two artifacts demonstrate both the requirement (policy) and the execution (logs) needed to prove compliance.

Answer

A folder of employee social media posts about data cleanup.

Answer

A list of all printers in the office environment.

Answer

A draft policy from last year that was never approved.

Question 15

A finance application has a known vulnerability in a third-party reporting component. The vendor says a patch will not be available for six months, but the business cannot stop using the application. What is the BEST risk treatment for the organization to pursue next?

Accepted Answer

Mitigate the risk by adding compensating controls and tracking residual risk until the patch is available.. When a known vulnerability exists in a third-party component and patching is delayed, the best risk treatment is to implement compensating controls (such as network segmentation, WAF rules, or input validation) to reduce the likelihood or impact of exploitation. This approach allows the business to continue operations while actively tracking residual risk until the vendor releases the patch. It aligns with the NIST risk management framework, which prioritizes mitigation when avoidance is not feasible.

Answer

Avoid the risk by shutting down the finance application immediately.

Answer

Transfer the risk by asking the vendor to guarantee that no incident will occur.

Answer

Accept the risk because any delay in patching is automatically low priority.