SY0-701 Security Program Management and Oversight Practice Test 5 — 15 Questions

Question 1

The legal team wants to confirm that customer records are being deleted on schedule after the retention period expires. Which two artifacts best demonstrate compliance? Select two.

Accepted Answer

An approved retention schedule or retention policy that defines the deletion period.. An approved retention schedule or policy is the authoritative document that defines the required deletion period for customer records. It serves as the legal mandate against which compliance is measured. Option C is correct because system or audit logs provide verifiable evidence that the deletion job executed successfully, confirming that the policy was actually followed. Together, these two artifacts demonstrate both the requirement (policy) and the execution (logs) needed to prove compliance.

Answer

A folder of employee social media posts about data cleanup.

Answer

A list of all printers in the office environment.

Answer

A draft policy from last year that was never approved.

Question 2

A finance application has a known vulnerability in a third-party reporting component. The vendor says a patch will not be available for six months, but the business cannot stop using the application. What is the BEST risk treatment for the organization to pursue next?

Accepted Answer

Mitigate the risk by adding compensating controls and tracking residual risk until the patch is available.. When a known vulnerability exists in a third-party component and patching is delayed, the best risk treatment is to implement compensating controls (such as network segmentation, WAF rules, or input validation) to reduce the likelihood or impact of exploitation. This approach allows the business to continue operations while actively tracking residual risk until the vendor releases the patch. It aligns with the NIST risk management framework, which prioritizes mitigation when avoidance is not feasible.

Answer

Avoid the risk by shutting down the finance application immediately.

Answer

Transfer the risk by asking the vendor to guarantee that no incident will occur.

Answer

Accept the risk because any delay in patching is automatically low priority.

Question 3

The service desk needs a document that tells analysts exactly how to verify a caller and reset a password for a locked account. Which document type should they use?

Accepted Answer

Procedure, because it provides exact steps staff must follow in order. A procedure is the correct document type because it provides a step-by-step sequence of actions that staff must follow to complete a specific operational task, such as verifying a caller's identity and resetting a password. Unlike policies or standards, procedures are mandatory and detail the exact commands, verification checks, and escalation paths required to ensure consistent and secure execution of the task.

Answer

Policy, because it states the organization's high-level security expectations

Answer

Guideline, because it offers helpful suggestions that staff may choose to follow

Answer

Standard, because it defines a general topic without operational detail

Question 4

Based on the exhibit, what is the best next step before onboarding the vendor?

Accepted Answer

Require a security addendum with breach-notification timing, subprocessor approval, and audit rights.. The exhibit indicates the vendor has not yet provided a security addendum, which is a critical contractual document that defines security obligations such as breach-notification timing, subprocessor approval, and audit rights. Without this addendum, the organization lacks enforceable guarantees for data protection and incident response, making onboarding premature. Option B directly addresses this gap by requiring the addendum before proceeding.

Answer

Approve the vendor because it already passed a penetration test.

Answer

Ask the vendor to provide source code so developers can review it.

Answer

Move the workload to an internal shared drive until the vendor is ready.

Question 5

Match each requirement or instruction to the correct governance document type. Use each document type once.

Accepted Answer

Policy: High-level statement of management intent. These matches align with common governance document types in IT security frameworks: policy provides high-level direction, standard sets mandatory rules, procedure gives step-by-step instructions, guideline offers non-mandatory recommendations, baseline defines minimum configurations, and framework provides a structured approach.

Answer

Procedure: Recommended best practices, not mandatory

Answer

Guideline: Step-by-step instructions for performing a task

Question 6

The help desk needs a document that tells analysts exactly how to verify a caller, reset a password, and record the ticket when a user is locked out. What type of document is this?

Accepted Answer

Procedure. A procedure is the correct type of document because it provides step-by-step instructions for performing a specific task, such as verifying a caller's identity, resetting a password, and recording a ticket. Unlike a policy, which states high-level rules, a procedure details the exact actions to take in a given scenario, making it ideal for help desk operations.

Answer

Policy

Answer

Standard

Answer

Guideline

Question 7

Match each procurement or oversight need to the best vendor due diligence artifact or clause. Use each item once.

Accepted Answer

Assess security controls: Security questionnaire. These artifacts support vendor due diligence: questionnaires assess controls, SOC 2 reports provide independent assurance, audit clauses enable customer verification, DPAs govern data handling, BCPs ensure resilience, and pen tests validate security.

Answer

Assess security controls: SOC 2 report

Answer

Data protection: Business continuity plan

Question 8

Based on the exhibit, which artifact is the strongest evidence that the firewall change was reviewed and approved before implementation?

Accepted Answer

The change request record with CAB approval timestamp and implementation time.. The change request record with a CAB approval timestamp and implementation time provides a clear, auditable trail that the firewall change was formally reviewed and authorized by the Change Advisory Board before it was executed. This aligns with the change management process required for security program oversight, ensuring that changes are not implemented without proper governance.

Answer

The engineer's post-implementation email, because it confirms someone checked the change.

Answer

The firewall logs, because they show the rule was applied successfully on the device.

Answer

The vendor's maintenance notice, because it explains why the rule was needed.

Question 9

Match each business scenario to the most appropriate risk treatment.
1. A legacy reporting server is expensive to replace, and leadership is willing to monitor the low expected loss for now.
2. A public web portal is being hit by credential stuffing, so the team adds MFA and rate limiting.
3. The organization wants protection from a costly third-party outage by purchasing cyber insurance.
4. A proposed project would collect regulated data that the business has decided not to process at all.

Accepted Answer

Risk acceptance: A legacy reporting server is expensive to replace, and leadership is willing to monitor the low expected loss for now.. Risk acceptance acknowledges the risk without action; mitigation reduces risk via controls; transfer shifts risk to insurance; avoidance eliminates the risk activity; reduction and sharing are related but less direct matches to the scenarios.

Answer

Risk acceptance: A proposed project would collect regulated data that the business has decided not to process.

Answer

Risk mitigation: The organization wants protection from a costly third-party outage by purchasing cyber insurance.

Question 10

Match each data example to the most appropriate classification label.
1. A public marketing flyer approved for external posting.
2. An internal org chart and office directory meant only for employees.
3. A customer case file with contact details and order history.
4. A vault export containing API keys and encryption secrets.

Accepted Answer

A public marketing flyer approved for external posting: Public. These matches follow a typical data classification scheme: Public for non-sensitive info, Internal for company-only data, Confidential for customer PII, and Restricted for highly sensitive secrets.

Answer

A vault export containing API keys and encryption secrets: Confidential

Answer

A public marketing flyer approved for external posting: Internal

Question 11

Based on the exhibit, what should the security team add before approving the vendor's requested change?

Accepted Answer

A contract clause requiring prior written approval for new subprocessors and flow-down security obligations.. The exhibit shows the vendor requesting a change to use a new subprocessor for data storage. The security team must ensure that the vendor's contract includes a clause requiring prior written approval for new subprocessors and that security obligations flow down to them. This directly addresses the risk of unauthorized data handling by third parties, which is a key concern in vendor risk management.

Answer

A broader employee awareness training requirement for the vendor's staff.

Answer

A larger cyber insurance policy to cover possible losses if the vendor is breached.

Answer

A request for the vendor to send monthly screenshots of its backup jobs.

Question 12

Based on the exhibit, which risk treatment should the security manager recommend first?

Accepted Answer

Mitigate the risk by replacing or isolating the appliance and removing direct internet exposure.. The exhibit shows a legacy file transfer appliance with direct internet exposure and known unpatched vulnerabilities. The most immediate and effective risk treatment is to mitigate the risk by replacing or isolating the appliance and removing its direct internet exposure. This directly reduces the likelihood of exploitation by eliminating the attack surface, which aligns with the principle of defense-in-depth and is the first step before considering acceptance, avoidance, or transfer.

Answer

Accept the risk and document it for the next quarterly review.

Answer

Avoid the risk by permanently shutting down the file transfer service.

Answer

Transfer the risk by purchasing cyber insurance and keeping the current configuration.

Question 13

Based on the exhibit, what is the best data-handling action before sharing the file with the third party?

Accepted Answer

Redact the unnecessary sensitive fields and provide only the minimum necessary extract after approval.. Data minimization and the principle of least privilege require that only the minimum necessary sensitive data be shared with a third party. Redacting unnecessary sensitive fields and obtaining approval ensures compliance with data protection policies and reduces the risk of unauthorized exposure, even if the recipient has signed an NDA.

Answer

Send the full spreadsheet encrypted and let the vendor filter out the extra columns.

Answer

Mark the spreadsheet as internal and share it through the benefits contractor's cloud portal.

Answer

Send the file unchanged because the contractor signed a nondisclosure agreement.

Question 14

Based on the exhibit, which metric best shows that employees are recognizing and escalating phishing attempts more quickly?

Accepted Answer

Median report time, because it shows how quickly users notify security after spotting a phish.. The median report time directly measures the speed at which employees notify the security team after identifying a phishing simulation email. A decreasing median report time indicates that users are recognizing phishing attempts more quickly and escalating them, which is the key behavioral change this metric captures. Unlike click rate, which only measures failure, report time measures the positive action of reporting.

Answer

Click rate, because a lower click rate is the only useful awareness metric.

Answer

Training completion rate, because it proves every employee attended the awareness session.

Answer

Number of simulation emails sent, because a larger campaign is always a better metric.

Question 15

Based on the exhibit, which metric best indicates improved phishing resistance?

Accepted Answer

Phish report rate.. The phish report rate measures how many users report a simulated phishing email to the security team, which directly indicates their ability to recognize and respond to phishing attempts. A higher report rate demonstrates improved security awareness and resistance because users are actively identifying threats rather than ignoring or falling for them. This metric is a key performance indicator in security awareness programs because it reflects behavioral change, not just training completion.

Answer

Training completion rate.

Answer

Number of phishing emails sent by attackers.

Answer

Total number of help desk tickets.