SY0-701 Security Program Management and Oversight Practice Test 5 — 15 Questions

Question 1

The service desk needs a document that tells analysts exactly how to verify a caller and reset a password for a locked account. Which document type should they use?

Accepted Answer

Procedure, because it provides exact steps staff must follow in order. A procedure is the correct document type because it provides a step-by-step sequence of actions that staff must follow to complete a specific operational task, such as verifying a caller's identity and resetting a password. Unlike policies or standards, procedures are mandatory and detail the exact commands, verification checks, and escalation paths required to ensure consistent and secure execution of the task.

Answer

Policy, because it states the organization's high-level security expectations

Answer

Guideline, because it offers helpful suggestions that staff may choose to follow

Answer

Standard, because it defines a general topic without operational detail

Question 2

Based on the exhibit, what is the best next step before onboarding the vendor?

Accepted Answer

Require a security addendum with breach-notification timing, subprocessor approval, and audit rights.. The exhibit indicates the vendor has not yet provided a security addendum, which is a critical contractual document that defines security obligations such as breach-notification timing, subprocessor approval, and audit rights. Without this addendum, the organization lacks enforceable guarantees for data protection and incident response, making onboarding premature. Option B directly addresses this gap by requiring the addendum before proceeding.

Answer

Approve the vendor because it already passed a penetration test.

Answer

Ask the vendor to provide source code so developers can review it.

Answer

Move the workload to an internal shared drive until the vendor is ready.

Question 3

Match each requirement or instruction to the correct governance document type. Use each document type once.

Accepted Answer

Policy: High-level statement of management intent. These matches align with common governance document types in IT security frameworks: policy provides high-level direction, standard sets mandatory rules, procedure gives step-by-step instructions, guideline offers non-mandatory recommendations, baseline defines minimum configurations, and framework provides a structured approach.

Answer

Procedure: Recommended best practices, not mandatory

Answer

Guideline: Step-by-step instructions for performing a task

Question 4

The help desk needs a document that tells analysts exactly how to verify a caller, reset a password, and record the ticket when a user is locked out. What type of document is this?

Accepted Answer

Procedure. A procedure is the correct type of document because it provides step-by-step instructions for performing a specific task, such as verifying a caller's identity, resetting a password, and recording a ticket. Unlike a policy, which states high-level rules, a procedure details the exact actions to take in a given scenario, making it ideal for help desk operations.

Answer

Policy

Answer

Standard

Answer

Guideline

Question 5

Match each procurement or oversight need to the best vendor due diligence artifact or clause. Use each item once.

Accepted Answer

Assess security controls: Security questionnaire. These artifacts support vendor due diligence: questionnaires assess controls, SOC 2 reports provide independent assurance, audit clauses enable customer verification, DPAs govern data handling, BCPs ensure resilience, and pen tests validate security.

Answer

Assess security controls: SOC 2 report

Answer

Data protection: Business continuity plan

Question 6

Based on the exhibit, which artifact is the strongest evidence that the firewall change was reviewed and approved before implementation?

Accepted Answer

The change request record with CAB approval timestamp and implementation time.. The change request record with a CAB approval timestamp and implementation time provides a clear, auditable trail that the firewall change was formally reviewed and authorized by the Change Advisory Board before it was executed. This aligns with the change management process required for security program oversight, ensuring that changes are not implemented without proper governance.

Answer

The engineer's post-implementation email, because it confirms someone checked the change.

Answer

The firewall logs, because they show the rule was applied successfully on the device.

Answer

The vendor's maintenance notice, because it explains why the rule was needed.

Question 7

Match each business scenario to the most appropriate risk treatment.
1. A legacy reporting server is expensive to replace, and leadership is willing to monitor the low expected loss for now.
2. A public web portal is being hit by credential stuffing, so the team adds MFA and rate limiting.
3. The organization wants protection from a costly third-party outage by purchasing cyber insurance.
4. A proposed project would collect regulated data that the business has decided not to process at all.

Accepted Answer

Risk acceptance: A legacy reporting server is expensive to replace, and leadership is willing to monitor the low expected loss for now.. Risk acceptance acknowledges the risk without action; mitigation reduces risk via controls; transfer shifts risk to insurance; avoidance eliminates the risk activity; reduction and sharing are related but less direct matches to the scenarios.

Answer

Risk acceptance: A proposed project would collect regulated data that the business has decided not to process.

Answer

Risk mitigation: The organization wants protection from a costly third-party outage by purchasing cyber insurance.

Question 8

Match each data example to the most appropriate classification label.
1. A public marketing flyer approved for external posting.
2. An internal org chart and office directory meant only for employees.
3. A customer case file with contact details and order history.
4. A vault export containing API keys and encryption secrets.

Accepted Answer

A public marketing flyer approved for external posting: Public. These matches follow a typical data classification scheme: Public for non-sensitive info, Internal for company-only data, Confidential for customer PII, and Restricted for highly sensitive secrets.

Answer

A vault export containing API keys and encryption secrets: Confidential

Answer

A public marketing flyer approved for external posting: Internal

Question 9

Based on the exhibit, what should the security team add before approving the vendor's requested change?

Accepted Answer

A contract clause requiring prior written approval for new subprocessors and flow-down security obligations.. The exhibit shows the vendor requesting a change to use a new subprocessor for data storage. The security team must ensure that the vendor's contract includes a clause requiring prior written approval for new subprocessors and that security obligations flow down to them. This directly addresses the risk of unauthorized data handling by third parties, which is a key concern in vendor risk management.

Answer

A broader employee awareness training requirement for the vendor's staff.

Answer

A larger cyber insurance policy to cover possible losses if the vendor is breached.

Answer

A request for the vendor to send monthly screenshots of its backup jobs.

Question 10

Based on the exhibit, which risk treatment should the security manager recommend first?

Accepted Answer

Mitigate the risk by replacing or isolating the appliance and removing direct internet exposure.. The exhibit shows a legacy file transfer appliance with direct internet exposure and known unpatched vulnerabilities. The most immediate and effective risk treatment is to mitigate the risk by replacing or isolating the appliance and removing its direct internet exposure. This directly reduces the likelihood of exploitation by eliminating the attack surface, which aligns with the principle of defense-in-depth and is the first step before considering acceptance, avoidance, or transfer.

Answer

Accept the risk and document it for the next quarterly review.

Answer

Avoid the risk by permanently shutting down the file transfer service.

Answer

Transfer the risk by purchasing cyber insurance and keeping the current configuration.

Question 11

Based on the exhibit, what is the best data-handling action before sharing the file with the third party?

Accepted Answer

Redact the unnecessary sensitive fields and provide only the minimum necessary extract after approval.. Data minimization and the principle of least privilege require that only the minimum necessary sensitive data be shared with a third party. Redacting unnecessary sensitive fields and obtaining approval ensures compliance with data protection policies and reduces the risk of unauthorized exposure, even if the recipient has signed an NDA.

Answer

Send the full spreadsheet encrypted and let the vendor filter out the extra columns.

Answer

Mark the spreadsheet as internal and share it through the benefits contractor's cloud portal.

Answer

Send the file unchanged because the contractor signed a nondisclosure agreement.

Question 12

Based on the exhibit, which metric best shows that employees are recognizing and escalating phishing attempts more quickly?

Accepted Answer

Median report time, because it shows how quickly users notify security after spotting a phish.. The median report time directly measures the speed at which employees notify the security team after identifying a phishing simulation email. A decreasing median report time indicates that users are recognizing phishing attempts more quickly and escalating them, which is the key behavioral change this metric captures. Unlike click rate, which only measures failure, report time measures the positive action of reporting.

Answer

Click rate, because a lower click rate is the only useful awareness metric.

Answer

Training completion rate, because it proves every employee attended the awareness session.

Answer

Number of simulation emails sent, because a larger campaign is always a better metric.

Question 13

Based on the exhibit, which metric best indicates improved phishing resistance?

Accepted Answer

Phish report rate.. The phish report rate measures how many users report a simulated phishing email to the security team, which directly indicates their ability to recognize and respond to phishing attempts. A higher report rate demonstrates improved security awareness and resistance because users are actively identifying threats rather than ignoring or falling for them. This metric is a key performance indicator in security awareness programs because it reflects behavioral change, not just training completion.

Answer

Training completion rate.

Answer

Number of phishing emails sent by attackers.

Answer

Total number of help desk tickets.

Question 14

A payroll SaaS provider has passed initial review, but before contract signing it announces that customer data will be processed by a new subcontractor in another country. The business wants to keep the onboarding timeline short, but security still needs assurance that the change does not increase exposure. What is the BEST next step?

Accepted Answer

Update the third-party risk assessment and require evidence of the subcontractor's controls before approval.. The introduction of a new subcontractor in a different country represents a material change to the data processing environment, which invalidates the initial risk assessment. Security must update the third-party risk assessment to evaluate the subcontractor's controls, such as data protection, encryption standards, and compliance with local regulations, before approval. This ensures that the change does not increase exposure, even if the primary provider passed initial review.

Answer

Approve the vendor because the primary provider already passed the initial review.

Answer

Wait until the first quarterly audit to review the subcontractor change.

Answer

Accept the change if the vendor provides a marketing brochure describing its security program.

Question 15

An external auditor asks for proof that quarterly privileged access reviews were completed and that any exceptions were tracked to closure during the last year. Which evidence is MOST appropriate to provide?

Accepted Answer

Signed access review records and remediation tickets from the access management process.. Signed access review records provide verifiable proof that quarterly reviews were conducted, and remediation tickets demonstrate that any exceptions (e.g., excessive privileges) were tracked and resolved. This aligns with the principle of audit evidence: it must be objective, verifiable, and show a complete chain of actions from review to closure. A screenshot or policy alone lacks the audit trail of actual completion and exception handling.

Answer

A screenshot of one administrator's account showing current privileges.

Answer

The security policy that says access reviews must happen every quarter.

Answer

An email from the system administrator stating that reviews were completed on time.