SY0-701 Security Program Management and Oversight Practice Test 6 — 15 Questions

Question 1

A small company has two security issues and can fix only one this week. Which should be prioritized first? One issue is an internal lab server with a medium-severity flaw. The other is an internet-facing login portal using default administrator credentials.

Accepted Answer

Fix the internet-facing login portal first because default administrator credentials create a much higher risk.. The internet-facing login portal using default administrator credentials represents an immediate, high-impact risk because it allows unauthorized remote access with administrative privileges. Default credentials are well-known and actively targeted by automated scanners and attackers, making exploitation trivial. In contrast, the internal lab server with a medium-severity flaw is behind network segmentation and requires additional access, so its risk is lower and can be deferred.

Answer

Fix the internal lab server first because every vulnerability should be treated equally.

Answer

Wait until the monthly maintenance window so both issues can be fixed at the same time.

Answer

Ignore both issues until users report symptoms, then respond if something happens.

Question 2

Which document should define mandatory settings such as full-disk encryption, a 10-minute screen-lock timeout, and removal of local administrator rights on company laptops?

Accepted Answer

Standard, because it defines specific required configurations that must be followed.. Option B is correct because a standard defines mandatory, specific technical configurations that must be uniformly applied across all company laptops. The question lists concrete settings (full-disk encryption, 10-minute screen-lock timeout, removal of local admin rights) that are not open to interpretation, which aligns precisely with the role of a security standard in enforcing baseline compliance.

Answer

Policy, because it explains the general direction but not the exact settings.

Answer

Procedure, because it lists the steps an end user should take every day.

Answer

Guideline, because it offers flexible recommendations rather than mandatory rules.

Question 3

Several employees nearly entered credentials into a fake mailbox login page. The security team wants to reduce repeat mistakes quickly without overwhelming the whole company. What is the best communication approach?

Accepted Answer

Send a short targeted notice to the affected users with examples, warning signs, and reporting steps. A short targeted notice to the affected users is the best approach because it directly addresses the immediate threat without overwhelming the entire company. This method allows the security team to quickly reinforce specific warning signs (e.g., mismatched URLs, lack of HTTPS/TLS certificates) and reporting procedures, reducing the likelihood of repeat mistakes while maintaining operational efficiency.

Answer

Wait until the annual security training cycle to address the issue

Answer

Disable all external email until the next awareness campaign is completed

Answer

Send a company-wide message naming the affected employees to discourage mistakes

Question 4

After a phishing simulation, many users still nearly entered credentials. Leadership wants to reduce repeat mistakes without causing long training sessions. Which two actions are the best balance of security and usability? Select two.

Accepted Answer

Send a short targeted refresher focused on the exact mistake. Option A is correct because a short, targeted refresher directly addresses the specific mistake (e.g., entering credentials on a phishing page) without overwhelming users. This approach leverages microlearning principles, which improve retention and reduce cognitive load compared to lengthy training. It balances security by reinforcing the exact behavior to avoid, while maintaining usability by minimizing time away from work.

Answer

Require every employee to attend a full-day annual course this week

Answer

Publicly post the names of employees who clicked the simulation

Answer

Disable all email attachments for every user

Question 5

An HR analyst needs to send a payroll reconciliation file to an external auditor. The file contains employee names, SSNs, bank account numbers, and salary details, but the auditor only needs employee IDs, payment totals, and a control total. What should the analyst do first?

Accepted Answer

Redact or remove unnecessary sensitive fields before sharing the minimum required data.. Option B is correct because the principle of data minimization requires that only the necessary data (employee IDs, payment totals, control total) be shared with the external auditor. Redacting or removing unnecessary sensitive fields (SSNs, bank account numbers, salary details) reduces the risk of exposure and complies with privacy regulations. This step should occur before any encryption or transmission to ensure the auditor never receives data they do not need.

Answer

Encrypt the full spreadsheet and send it without changing the contents.

Answer

Compress the file into a password-protected archive and email the password separately.

Answer

Copy the file to a personal cloud storage account to make sharing easier.

Question 6

An HR analyst must send a compensation spreadsheet to an external auditor. The auditor only needs employee names, departments, and salary totals; Social Security numbers and bank account fields are not required. What should the analyst do before sharing the file?

Accepted Answer

Remove or redact the fields the auditor does not need, then share only the minimum necessary data.. Option B is correct because the principle of data minimization requires sharing only the information necessary for the task. By removing or redacting the Social Security numbers and bank account fields, the analyst reduces the risk of exposing sensitive personally identifiable information (PII) to the external auditor, aligning with least privilege and need-to-know principles.

Answer

Encrypt the spreadsheet and send the full file as-is to preserve all records.

Answer

Store the file in a shared cloud folder and grant the auditor read-only access.

Answer

Convert the file to PDF so the sensitive information is harder to edit.

Question 7

A vendor-supported legacy application can run only with a deprecated browser plug-in on two engineering workstations for 30 days while a replacement is tested. Management wants to allow the exception without weakening the security program. What is the best action?

Accepted Answer

Document a time-bound exception, record the risk, apply compensating controls, and schedule review before expiration.. Option B is correct because it follows the formal exception process required by a mature security program: documenting the exception with a specific time bound (30 days), recording the associated risk, applying compensating controls (such as network segmentation or host-based firewall rules to isolate the deprecated plug-in), and scheduling a review before expiration ensures the risk is managed and the exception does not become permanent. This aligns with the SY0-701 objective of implementing risk management processes, where time-bound exceptions with compensating controls are the standard way to handle legacy dependencies without weakening the overall security posture.

Answer

Approve the exception informally by email and revisit it if problems appear.

Answer

Disable all monitoring on the workstations so the application will function normally.

Answer

Publish the exception as a permanent guideline so other teams can follow it.

Question 8

After several near-miss phishing attempts, leadership wants to reduce mistakes quickly without disrupting daily work. Which three measures are the best balance of security and usability? Select three.

Accepted Answer

Run short role-based phishing training for higher-risk user groups.. Option A is correct because targeted, role-based phishing training focuses on users who handle sensitive data or financial transactions, reducing the attack surface without overwhelming the entire workforce. This approach leverages the principle of least privilege in security awareness, ensuring that training is relevant and immediately applicable to the specific phishing tactics those roles face, thus minimizing disruption while improving detection rates.

Answer

Disable email for all staff until phishing activity stops.

Answer

Block all external senders permanently.

Question 9

A records clerk finds paper forms containing customer identifiers. The retention period has expired, and no legal hold applies. Which two actions are appropriate next? Select two.

Accepted Answer

Verify that the retention schedule has been satisfied and no hold exists. Option A is correct because before disposing of any records, the records clerk must confirm that the retention period has fully elapsed and that no legal hold (such as a litigation hold or regulatory hold) is active. This verification step ensures compliance with organizational data governance policies and avoids spoliation of evidence. Option B is correct because once verification is complete, the approved disposal method (e.g., cross-cut shredding, incineration, or secure shredding service) must be used to render the customer identifiers irrecoverable, aligning with data minimization and privacy requirements.

Answer

Keep the forms in a personal desk drawer until someone asks for them

Answer

Take the papers home for safe keeping before shredding later

Answer

Refile the forms in an archive cabinet because they are old records

Question 10

An engineering team requests a 30-day exception to use an unsupported browser plug-in on two workstations so a customer deliverable can be finished. Security agrees the business need is legitimate, but wants to reduce exposure. What must be included before the exception is approved?

Accepted Answer

A documented exception with an end date, compensating controls, and approval by the risk owner.. A documented exception with a defined end date, compensating controls, and risk-owner approval is the correct approach. Security exceptions should be controlled, reviewable, and temporary whenever possible. That structure shows the business need was acknowledged while ensuring someone has formally accepted the residual risk and the organization can reassess the exception before it becomes indefinite.

Why others are wrong: A verbal approval is not enough for auditability or accountability. A standing waiver without a review date can quietly become permanent and increase exposure. A guideline does not authorize deviation from policy or provide the controls required for an exception process. The question is about formal exception handling, not informal advice.

Answer

A verbal approval from the engineering manager and no additional documentation.

Answer

A standing waiver that remains in place until the project finishes, with no review date.

Answer

A guideline reminding the team to avoid risky behavior when practical.

Question 11

The exhibit shows a weekly risk register for a small enterprise. Which three findings should be remediated first based on likelihood of exploitation and business impact? Select three.

Accepted Answer

Finding 1, because the customer portal is internet-facing and protects a high-value administrative path.. Finding 1 is correct because the customer portal is internet-facing and protects a high-value administrative path. An unpatched or misconfigured portal could allow an attacker to bypass authentication and directly access administrative functions, leading to a full system compromise. The combination of external exposure and high business impact makes this the highest priority for remediation.

Answer

Finding 2, because any default setting should always outrank all other issues automatically.

Answer

Finding 5, because any outdated software should be fixed before higher-impact business systems.

Question 12

An HR spreadsheet contains employee names, Social Security numbers, and bank account numbers. Which label is most appropriate under a Public, Internal, Confidential, and Restricted scheme?

Accepted Answer

Restricted, because it contains highly sensitive personal and financial data.. A spreadsheet containing employee names, Social Security numbers, and bank account numbers includes personally identifiable information (PII) and financial account data, which are subject to strict regulatory controls (e.g., GDPR, GLBA, or state breach notification laws). Under a Public/Internal/Confidential/Restricted classification scheme, 'Restricted' is the most appropriate label because it indicates the highest level of sensitivity and requires access control mechanisms such as encryption at rest (e.g., AES-256), strict least-privilege permissions, and audit logging to prevent unauthorized disclosure or modification.

Answer

Public, because it is used by the HR department and not shared externally.

Answer

Internal, because only employees should see it.

Answer

Confidential, because the information should be kept private but not tightly controlled.

Question 13

A help desk team is writing a procedure for resetting MFA after a user loses a phone. Which two details belong in the procedure rather than in the policy? Select two.

Accepted Answer

The exact step-by-step verification process the technician must follow. Option A is correct because a procedure must contain the exact step-by-step verification process the technician follows to confirm the user's identity before resetting MFA. This operational detail ensures consistency and security, whereas a policy would only state the high-level requirement (e.g., 'verify identity'). Without precise steps, technicians might skip critical checks, leading to unauthorized MFA resets.

Answer

A statement that all employees must use MFA to access company systems

Answer

A general goal of protecting accounts from unauthorized access

Answer

A broad rule that users should protect company credentials

Question 14

A vulnerability scan identifies four issues across a small company. Which item should the operations team remediate first?

Accepted Answer

A high-severity flaw on an internet-facing customer portal with public exploit code available. Option B is correct because the internet-facing customer portal with a high-severity flaw and public exploit code presents the highest risk to the organization. The combination of high attack surface (exposed to the internet), high severity, and readily available exploit code means an attacker can easily compromise the system, leading to data breach, financial loss, or reputational damage. Remediation prioritization should follow risk-based principles, where likelihood and impact are both high.

Answer

A critical flaw on a disconnected training laptop that is used only in the lab

Answer

A medium-severity flaw on an internal print server that stores no sensitive data

Answer

A low-severity flaw on an archive server scheduled for retirement next month

Question 15

A business unit asks for a 30-day exception to use an unsupported browser plug-in on two engineering workstations while a replacement is tested. Which three conditions should be required before approval? Select three.

Accepted Answer

A documented business justification for why the plug-in is still needed.. Option A is correct because a documented business justification ensures that the exception is necessary and aligns with organizational risk appetite. Without a clear reason, the exception could be granted for convenience rather than critical need, undermining security governance. This justification also provides an audit trail for why an unsupported, potentially vulnerable plug-in is still in use.

Answer

An open-ended waiver so the team can continue if testing slips.

Answer

Verbal approval only, with no written record.