SY0-701 Security Program Management and Oversight Practice Test 5 — 15 Questions

Question 1

A business-critical internal reporting portal is exposed to all employees. A scan finds a high-severity vulnerability, but the vendor says a fix will not be available for 30 days. The application is only used by finance once a month, and the business can tolerate a brief outage if needed. Which risk treatment is the BEST immediate action?

Accepted Answer

Apply compensating controls, such as restricting access and adding a temporary control, until the vendor patch is available.. Option B is correct because applying compensating controls—such as restricting access to only the finance team and implementing a temporary web application firewall (WAF) rule—immediately reduces the attack surface while the vendor develops a patch. This aligns with the risk treatment of mitigation, as it lowers the likelihood of exploitation without requiring a full fix. The business can tolerate a brief outage, so a temporary access control list (ACL) or IP whitelist is a practical, immediate measure.

Answer

Accept the risk because the application is used infrequently and the impact is limited.

Answer

Transfer the risk by purchasing cyber insurance for the application.

Answer

Avoid the risk by permanently decommissioning the reporting portal.

Question 2

After a phishing-awareness campaign, which metric best shows that employees are becoming more resistant to phishing attempts?

Accepted Answer

The percentage of users who click phishing test links. Option D is correct because the percentage of users who click phishing test links directly measures behavioral change in response to simulated phishing attacks. A decreasing click rate indicates that employees are better at recognizing and avoiding phishing attempts, which is the primary goal of a phishing-awareness campaign.

Answer

The number of spam emails received by the mail gateway

Answer

The average length of employee passwords

Answer

The count of antivirus alerts on endpoints

Question 3

A business wants to keep operating even if a supplier-related loss occurs, so it purchases cyber insurance to offset possible costs. Which risk treatment is being used?

Accepted Answer

Transfer, because some financial impact is shifted to another party. Purchasing cyber insurance transfers the financial risk of a supplier-related loss to the insurance company. This is a classic risk transfer strategy, where the business does not eliminate or reduce the likelihood of the loss but shifts the financial impact to another party via a contractual agreement.

Answer

Avoidance, because the company is eliminating the supplier relationship

Answer

Mitigation, because insurance removes the risk before it happens

Answer

Acceptance, because the company is doing nothing about the exposure

Question 4

A software supplier used by your organization begins subcontracting a critical part of its service to an unknown hosting company. Which contractual control would BEST help manage this supply chain risk?

Accepted Answer

Require advance notice and approval for subcontractor changes, plus right-to-audit and security obligations.. Option B is correct because it establishes a contractual control that requires the supplier to notify and obtain approval before subcontracting critical services, while also imposing right-to-audit and security obligations. This directly addresses supply chain risk by ensuring the organization can vet and monitor the subcontractor's security posture, as recommended by NIST SP 800-161 for supply chain risk management.

Answer

Require the supplier to send monthly sales updates to the procurement team.

Answer

Ask the supplier to place all responsibility for the subcontractor on the customer.

Answer

Disable all vendor access immediately without reviewing the change.

Question 5

Match each awareness-program metric or pattern to the best interpretation. Use each interpretation once.

Question 6

Match each business situation to the best risk treatment. Use each treatment once.

Question 7

An external auditor asks for proof that emergency firewall changes were reviewed and approved before implementation last quarter. Which two artifacts are the best evidence? Select two.

Accepted Answer

An approved change ticket that shows the reviewer, approver, and timestamps.. An approved change ticket with reviewer, approver, and timestamps directly documents the required pre-approval workflow for emergency firewall changes. This artifact provides an auditable trail showing that the change was reviewed and approved before implementation, which is the exact evidence the auditor is requesting.

Answer

A screenshot of the firewall's current rule base after the change.

Answer

A technician's memory of getting permission over the phone.

Answer

The organization's general information security policy.

Question 8

A small internal reporting server has a low-severity vulnerability. Fixing it now would require several hours of downtime, while the business impact of exploitation is considered low. What is the BEST risk treatment for this situation?

Accepted Answer

Accept the risk after documenting the decision. The best risk treatment is to accept the risk because the vulnerability is low-severity, the business impact of exploitation is low, and the cost of remediation (several hours of downtime) exceeds the potential loss. Documenting the acceptance ensures auditability and informed management approval, which is a standard practice in risk management frameworks like NIST SP 800-37.

Answer

Transfer the risk to a third party

Answer

Avoid the risk by shutting down the server permanently

Answer

Mitigate the risk by immediately replacing the server

Question 9

A software supplier is adding a new subcontractor to process your company's customer data. The security team wants to understand the new exposure before allowing the change. Which three items should it request or review first? Select three.

Accepted Answer

A list of the subcontractor's locations and where the data will be processed.. Option A is correct because understanding where data will be processed and the subcontractor's physical locations is critical for assessing jurisdictional risks, data sovereignty requirements, and compliance with regulations like GDPR or CCPA. The security team needs this information to evaluate potential exposure to different legal frameworks and physical security controls before granting access to customer data.

Answer

The subcontractor's logo and marketing brochure.

Answer

The supplier's quarterly sales forecast.

Question 10

A desktop engineering team asks for the document that specifies the exact minimum encryption setting, screen-lock timer, and password length for company laptops. Which type of document should they follow?

Accepted Answer

Standard, because it defines mandatory uniform requirements for a specific control baseline.. A standard defines mandatory, uniform technical requirements for a specific control baseline, such as exact encryption settings (e.g., AES-256), screen-lock timer (e.g., 15 minutes), and password length (e.g., 14 characters). Unlike a policy, which states high-level intent, a standard provides the precise, enforceable configuration that the desktop engineering team must implement on company laptops.

Answer

Policy, because it states the organization's general intent and high-level direction.

Answer

Procedure, because it gives the organization-wide security purpose statement.

Answer

Guideline, because it provides optional suggestions that every laptop must obey.

Question 11

Based on the exhibit, which item is the strongest evidence that quarterly privileged access reviews occurred?

Accepted Answer

Signed access review spreadsheet with reviewer, date, and exceptions.. A signed access review spreadsheet with reviewer, date, and exceptions provides direct, non-repudiable evidence that a formal review of privileged access was completed. Unlike logs or policies, it explicitly documents the reviewer's identity, the date of review, and any exceptions, satisfying audit requirements for quarterly privileged access reviews.

Answer

SIEM export of administrator logins.

Answer

Help desk ticket for a password reset.

Answer

Screenshot of the access review policy.

Question 12

After a phishing simulation, many users still almost submitted credentials to a fake Microsoft login page. Security wants to reduce repeat mistakes quickly without interrupting daily work. Which approach is best?

Accepted Answer

Use short, targeted awareness messages with screenshots of the actual lure and an easy reporting path.. Option C is correct because it uses just-in-time, context-specific training that directly addresses the observed behavior without disrupting workflow. By showing users the exact lure they encountered and providing a simple reporting path, the organization reinforces recognition of the specific phishing technique and encourages immediate reporting, which is more effective than generic warnings or lengthy retraining for reducing repeat mistakes quickly.

Answer

Send one enterprise-wide warning email listing every phishing indicator the users should memorize.

Answer

Require all employees to retake the full annual security course immediately.

Answer

Remove email access for any user who clicked the simulation link.

Question 13

An HR analyst must share a spreadsheet with an external auditor. The spreadsheet includes employee names, Social Security numbers, bank account numbers, and salary data, but the auditor only needs employee names and total payroll. Which three actions best protect the data? Select three.

Accepted Answer

Remove fields the auditor does not need before sharing the file.. Option A is correct because removing unnecessary fields (e.g., Social Security numbers, bank account numbers) before sharing the spreadsheet minimizes the exposure of sensitive personally identifiable information (PII) and financial data. This practice, known as data minimization, aligns with the principle of least privilege and reduces the risk of unauthorized access or data breach. By stripping out extraneous columns, the HR analyst ensures the auditor receives only the required data (employee names and total payroll), thereby protecting the organization from compliance violations under regulations like GDPR or PCI DSS.

Answer

Leave the full spreadsheet intact because the auditor requested a copy.

Answer

Post the spreadsheet in a shared public portal for easier access.

Question 14

Paper onboarding forms have reached the end of their retention period, and no legal hold applies. What should happen next?

Accepted Answer

Destroy them using an approved secure disposal method.. Once paper onboarding forms have reached the end of their retention period and no legal hold applies, the organization must destroy them using an approved secure disposal method (e.g., cross-cut shredding, pulping, or incineration) to prevent unauthorized access to personally identifiable information (PII) and comply with data protection regulations such as GDPR or HIPAA. Retaining data beyond its required lifecycle violates the data minimization principle and increases breach risk.

Answer

Store them indefinitely in case the company needs them later.

Answer

Scan them to a personal cloud account so they are not lost.

Answer

Mail copies to every manager for review before disposal.

Question 15

A manager asks how to decide whether a new security issue is worth spending money on. Which two factors should be reviewed first? Select two.

Accepted Answer

Likelihood that the issue will be exploited. Option A is correct because the likelihood of exploitation is a fundamental factor in risk assessment. Without understanding how probable it is that a threat actor will exploit a vulnerability, an organization cannot prioritize remediation efforts effectively. This is a core component of risk calculation (Risk = Likelihood × Impact).

Answer

The color used on the vulnerability report

Answer

The number of users in the IT department

Answer

The age of the server name in inventory