SY0-701 Security Program Management and Oversight Practice Test 6 — 15 Questions

Question 1

A payroll SaaS provider has passed initial review, but before contract signing it announces that customer data will be processed by a new subcontractor in another country. The business wants to keep the onboarding timeline short, but security still needs assurance that the change does not increase exposure. What is the BEST next step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the third-party risk assessment and require evidence of the subcontractor's controls before approval.. The introduction of a new subcontractor in a different country represents a material change to the data processing environment, which invalidates the initial risk assessment. Security must update the third-party risk assessment to evaluate the subcontractor's controls, such as data protection, encryption standards, and compliance with local regulations, before approval. This ensures that the change does not increase exposure, even if the primary provider passed initial review.

Answer

Approve the vendor because the primary provider already passed the initial review.

Answer

Wait until the first quarterly audit to review the subcontractor change.

Answer

Accept the change if the vendor provides a marketing brochure describing its security program.

Question 2

An external auditor asks for proof that quarterly privileged access reviews were completed and that any exceptions were tracked to closure during the last year. Which evidence is MOST appropriate to provide?

Accepted Answer

Signed access review records and remediation tickets from the access management process.. Signed access review records provide verifiable proof that quarterly reviews were conducted, and remediation tickets demonstrate that any exceptions (e.g., excessive privileges) were tracked and resolved. This aligns with the principle of audit evidence: it must be objective, verifiable, and show a complete chain of actions from review to closure. A screenshot or policy alone lacks the audit trail of actual completion and exception handling.

Answer

A screenshot of one administrator's account showing current privileges.

Answer

The security policy that says access reviews must happen every quarter.

Answer

An email from the system administrator stating that reviews were completed on time.

Question 3

Based on the exhibit, what is the best risk treatment recommendation for the security manager?

Accepted Answer

Mitigate the risk with compensating controls until the migration is complete.. The exhibit shows a legacy portal with known vulnerabilities that is scheduled for migration to a modern platform. Since backups alone do not address the active security weaknesses, the best recommendation is to mitigate the risk with compensating controls (e.g., web application firewall rules, network segmentation, or strict access controls) to reduce the likelihood or impact of exploitation until the migration is complete. This aligns with the risk treatment strategy of mitigation, as it actively reduces the risk without prematurely retiring the service or relying solely on insurance.

Answer

Accept the risk because backups are already enabled.

Answer

Avoid the risk by immediately retiring the portal.

Answer

Transfer the risk by purchasing cyber insurance only.

Question 4

A company wants to state that customer data must not be emailed externally unless a manager approves the exception. Which document type should contain this rule?

Accepted Answer

Policy, because it establishes mandatory organizational rules. A policy is the correct document type because it establishes mandatory organizational rules that must be followed. The requirement that customer data must not be emailed externally without manager approval is a binding directive, not a suggestion or a step-by-step guide. Policies define high-level security requirements that all employees must comply with, making them the appropriate vehicle for this rule.

Answer

Guideline, because it gives staff flexible suggestions about email use

Answer

Procedure, because it lists the exact button clicks for sending email

Answer

Standard, because it provides a general recommendation for communication

Question 5

Based on the exhibit, which document type should the service desk use for the locked-account workflow?

Accepted Answer

Procedure, because it lists the exact steps analysts must follow in sequence.. A procedure document is the correct choice because it provides a step-by-step sequence of actions that service desk analysts must follow to unlock an account. The locked-account workflow requires precise, ordered steps (e.g., verifying identity, checking lockout status, resetting the account) to ensure consistency and security, which aligns with the definition of a procedure.

Answer

Policy, because it states broad rules for account access.

Answer

Standard, because it defines the minimum password requirements for all users.

Answer

Guideline, because it gives flexible suggestions for handling locked accounts.

Question 6

A business-critical internal reporting portal is exposed to all employees. A scan finds a high-severity vulnerability, but the vendor says a fix will not be available for 30 days. The application is only used by finance once a month, and the business can tolerate a brief outage if needed. Which risk treatment is the BEST immediate action?

Accepted Answer

Apply compensating controls, such as restricting access and adding a temporary control, until the vendor patch is available.. Applying compensating controls—such as restricting access to only the finance team and implementing a temporary web application firewall (WAF) rule—immediately reduces the attack surface while the vendor develops a patch. This aligns with the risk treatment of mitigation, as it lowers the likelihood of exploitation without requiring a full fix. The business can tolerate a brief outage, so a temporary access control list (ACL) or IP whitelist is a practical, immediate measure.

Answer

Accept the risk because the application is used infrequently and the impact is limited.

Answer

Transfer the risk by purchasing cyber insurance for the application.

Answer

Avoid the risk by permanently decommissioning the reporting portal.

Question 7

After a phishing-awareness campaign, which metric best shows that employees are becoming more resistant to phishing attempts?

Accepted Answer

The percentage of users who click phishing test links. The percentage of users who click phishing test links directly measures behavioral change in response to simulated phishing attacks. A decreasing click rate indicates that employees are better at recognizing and avoiding phishing attempts, which is the primary goal of a phishing-awareness campaign.

Answer

The number of spam emails received by the mail gateway

Answer

The average length of employee passwords

Answer

The count of antivirus alerts on endpoints

Question 8

A business wants to keep operating even if a supplier-related loss occurs, so it purchases cyber insurance to offset possible costs. Which risk treatment is being used?

Accepted Answer

Transfer, because some financial impact is shifted to another party. Purchasing cyber insurance transfers the financial risk of a supplier-related loss to the insurance company. This is a classic risk transfer strategy, where the business does not eliminate or reduce the likelihood of the loss but shifts the financial impact to another party via a contractual agreement.

Answer

Avoidance, because the company is eliminating the supplier relationship

Answer

Mitigation, because insurance removes the risk before it happens

Answer

Acceptance, because the company is doing nothing about the exposure

Question 9

A software supplier used by your organization begins subcontracting a critical part of its service to an unknown hosting company. Which contractual control would BEST help manage this supply chain risk?

Accepted Answer

Require advance notice and approval for subcontractor changes, plus right-to-audit and security obligations.. It establishes a contractual control that requires the supplier to notify and obtain approval before subcontracting critical services, while also imposing right-to-audit and security obligations. This directly addresses supply chain risk by ensuring the organization can vet and monitor the subcontractor's security posture, as recommended by NIST SP 800-161 for supply chain risk management.

Answer

Require the supplier to send monthly sales updates to the procurement team.

Answer

Ask the supplier to place all responsibility for the subcontractor on the customer.

Answer

Disable all vendor access immediately without reviewing the change.

Question 10

Match each awareness-program metric or pattern to the best interpretation. Use each interpretation once.

Accepted Answer

Phishing click rate: Susceptibility. Phishing click rate measures susceptibility, reporting rate indicates vigilance, training completion rate shows participation, repeat offender rate identifies high-risk users, time to report reflects responsiveness, and knowledge assessment score measures understanding.

Answer

Training completion rate: Responsiveness

Answer

Time to report: Understanding

Answer

Knowledge assessment score: Participation

Question 11

Match each business situation to the best risk treatment. Use each treatment once.

Accepted Answer

Minor error with low probability: Accept. Risk treatment decisions are based on likelihood and impact: accept low risks, avoid high-high risks, mitigate medium risks, and transfer risks that are high likelihood but low impact or low likelihood but high impact.

Answer

Minor error with low probability: Transfer

Answer

Catastrophic event with high probability: Mitigate

Question 12

A small internal reporting server has a low-severity vulnerability. Fixing it now would require several hours of downtime, while the business impact of exploitation is considered low. What is the BEST risk treatment for this situation?

Accepted Answer

Accept the risk after documenting the decision. The best risk treatment is to accept the risk because the vulnerability is low-severity, the business impact of exploitation is low, and the cost of remediation (several hours of downtime) exceeds the potential loss. Documenting the acceptance ensures auditability and informed management approval, which is a standard practice in risk management frameworks like NIST SP 800-37.

Answer

Transfer the risk to a third party

Answer

Avoid the risk by shutting down the server permanently

Answer

Mitigate the risk by immediately replacing the server

Question 13

A software supplier is adding a new subcontractor to process your company's customer data. The security team wants to understand the new exposure before allowing the change. Which three items should it request or review first? Select three.

Accepted Answer

A list of the subcontractor's locations and where the data will be processed.. Understanding where data will be processed and the subcontractor's physical locations is critical for assessing jurisdictional risks, data sovereignty requirements, and compliance with regulations like GDPR or CCPA. The security team needs this information to evaluate potential exposure to different legal frameworks and physical security controls before granting access to customer data.

Answer

The subcontractor's logo and marketing brochure.

Answer

The supplier's quarterly sales forecast.

Question 14

A desktop engineering team asks for the document that specifies the exact minimum encryption setting, screen-lock timer, and password length for company laptops. Which type of document should they follow?

Accepted Answer

Standard, because it defines mandatory uniform requirements for a specific control baseline.. A standard defines mandatory, uniform technical requirements for a specific control baseline, such as exact encryption settings (e.g., AES-256), screen-lock timer (e.g., 15 minutes), and password length (e.g., 14 characters). Unlike a policy, which states high-level intent, a standard provides the precise, enforceable configuration that the desktop engineering team must implement on company laptops.

Answer

Policy, because it states the organization's general intent and high-level direction.

Answer

Procedure, because it gives the organization-wide security purpose statement.

Answer

Guideline, because it provides optional suggestions that every laptop must obey.

Question 15

Based on the exhibit, which item is the strongest evidence that quarterly privileged access reviews occurred?

Accepted Answer

Signed access review spreadsheet with reviewer, date, and exceptions.. A signed access review spreadsheet with reviewer, date, and exceptions provides direct, non-repudiable evidence that a formal review of privileged access was completed. Unlike logs or policies, it explicitly documents the reviewer's identity, the date of review, and any exceptions, satisfying audit requirements for quarterly privileged access reviews.

Answer

SIEM export of administrator logins.

Answer

Help desk ticket for a password reset.

Answer

Screenshot of the access review policy.