SY0-701 Security Program Management and Oversight Practice Test 7 — 15 Questions

Question 1

After a phishing simulation, many users still almost submitted credentials to a fake Microsoft login page. Security wants to reduce repeat mistakes quickly without interrupting daily work. Which approach is best?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use short, targeted awareness messages with screenshots of the actual lure and an easy reporting path.. It uses just-in-time, context-specific training that directly addresses the observed behavior without disrupting workflow. By showing users the exact lure they encountered and providing a simple reporting path, the organization reinforces recognition of the specific phishing technique and encourages immediate reporting, which is more effective than generic warnings or lengthy retraining for reducing repeat mistakes quickly.

Answer

Send one enterprise-wide warning email listing every phishing indicator the users should memorize.

Answer

Require all employees to retake the full annual security course immediately.

Answer

Remove email access for any user who clicked the simulation link.

Question 2

An HR analyst must share a spreadsheet with an external auditor. The spreadsheet includes employee names, Social Security numbers, bank account numbers, and salary data, but the auditor only needs employee names and total payroll. Which three actions best protect the data? Select three.

Accepted Answer

Remove fields the auditor does not need before sharing the file.. Removing unnecessary fields (e.g., Social Security numbers, bank account numbers) before sharing the spreadsheet minimizes the exposure of sensitive personally identifiable information (PII) and financial data. This practice, known as data minimization, aligns with the principle of least privilege and reduces the risk of unauthorized access or data breach. By stripping out extraneous columns, the HR analyst ensures the auditor receives only the required data (employee names and total payroll), thereby protecting the organization from compliance violations under regulations like GDPR or PCI DSS.

Answer

Leave the full spreadsheet intact because the auditor requested a copy.

Answer

Post the spreadsheet in a shared public portal for easier access.

Question 3

Paper onboarding forms have reached the end of their retention period, and no legal hold applies. What should happen next?

Accepted Answer

Destroy them using an approved secure disposal method.. Once paper onboarding forms have reached the end of their retention period and no legal hold applies, the organization must destroy them using an approved secure disposal method (e.g., cross-cut shredding, pulping, or incineration) to prevent unauthorized access to personally identifiable information (PII) and comply with data protection regulations such as GDPR or HIPAA. Retaining data beyond its required lifecycle violates the data minimization principle and increases breach risk.

Answer

Store them indefinitely in case the company needs them later.

Answer

Scan them to a personal cloud account so they are not lost.

Answer

Mail copies to every manager for review before disposal.

Question 4

A manager asks how to decide whether a new security issue is worth spending money on. Which two factors should be reviewed first? Select two.

Accepted Answer

Likelihood that the issue will be exploited. The likelihood of exploitation is a fundamental factor in risk assessment. Without understanding how probable it is that a threat actor will exploit a vulnerability, an organization cannot prioritize remediation efforts effectively. This is a core component of risk calculation (Risk = Likelihood × Impact).

Answer

The color used on the vulnerability report

Answer

The number of users in the IT department

Answer

The age of the server name in inventory

Question 5

A small company has two security issues and can fix only one this week. Which should be prioritized first? One issue is an internal lab server with a medium-severity flaw. The other is an internet-facing login portal using default administrator credentials.

Accepted Answer

Fix the internet-facing login portal first because default administrator credentials create a much higher risk.. The internet-facing login portal using default administrator credentials represents an immediate, high-impact risk because it allows unauthorized remote access with administrative privileges. Default credentials are well-known and actively targeted by automated scanners and attackers, making exploitation trivial. In contrast, the internal lab server with a medium-severity flaw is behind network segmentation and requires additional access, so its risk is lower and can be deferred.

Answer

Fix the internal lab server first because every vulnerability should be treated equally.

Answer

Wait until the monthly maintenance window so both issues can be fixed at the same time.

Answer

Ignore both issues until users report symptoms, then respond if something happens.

Question 6

Which document should define mandatory settings such as full-disk encryption, a 10-minute screen-lock timeout, and removal of local administrator rights on company laptops?

Accepted Answer

Standard, because it defines specific required configurations that must be followed.. A standard defines mandatory, specific technical configurations that must be uniformly applied across all company laptops. The question lists concrete settings (full-disk encryption, 10-minute screen-lock timeout, removal of local admin rights) that are not open to interpretation, which aligns precisely with the role of a security standard in enforcing baseline compliance.

Answer

Policy, because it explains the general direction but not the exact settings.

Answer

Procedure, because it lists the steps an end user should take every day.

Answer

Guideline, because it offers flexible recommendations rather than mandatory rules.

Question 7

Several employees nearly entered credentials into a fake mailbox login page. The security team wants to reduce repeat mistakes quickly without overwhelming the whole company. What is the best communication approach?

Accepted Answer

Send a short targeted notice to the affected users with examples, warning signs, and reporting steps. A short targeted notice to the affected users is the best approach because it directly addresses the immediate threat without overwhelming the entire company. This method allows the security team to quickly reinforce specific warning signs (e.g., mismatched URLs, lack of HTTPS/TLS certificates) and reporting procedures, reducing the likelihood of repeat mistakes while maintaining operational efficiency.

Answer

Wait until the annual security training cycle to address the issue

Answer

Disable all external email until the next awareness campaign is completed

Answer

Send a company-wide message naming the affected employees to discourage mistakes

Question 8

An HR analyst needs to send a payroll reconciliation file to an external auditor. The file contains employee names, SSNs, bank account numbers, and salary details, but the auditor only needs employee IDs, payment totals, and a control total. What should the analyst do first?

Accepted Answer

Redact or remove unnecessary sensitive fields before sharing the minimum required data.. The principle of data minimization requires that only the necessary data (employee IDs, payment totals, control total) be shared with the external auditor. Redacting or removing unnecessary sensitive fields (SSNs, bank account numbers, salary details) reduces the risk of exposure and complies with privacy regulations. This step should occur before any encryption or transmission to ensure the auditor never receives data they do not need.

Answer

Encrypt the full spreadsheet and send it without changing the contents.

Answer

Compress the file into a password-protected archive and email the password separately.

Answer

Copy the file to a personal cloud storage account to make sharing easier.

Question 9

An HR analyst must send a compensation spreadsheet to an external auditor. The auditor only needs employee names, departments, and salary totals; Social Security numbers and bank account fields are not required. What should the analyst do before sharing the file?

Accepted Answer

Remove or redact the fields the auditor does not need, then share only the minimum necessary data.. The principle of data minimization requires sharing only the information necessary for the task. By removing or redacting the Social Security numbers and bank account fields, the analyst reduces the risk of exposing sensitive personally identifiable information (PII) to the external auditor, aligning with least privilege and need-to-know principles.

Answer

Encrypt the spreadsheet and send the full file as-is to preserve all records.

Answer

Store the file in a shared cloud folder and grant the auditor read-only access.

Answer

Convert the file to PDF so the sensitive information is harder to edit.

Question 10

A vendor-supported legacy application can run only with a deprecated browser plug-in on two engineering workstations for 30 days while a replacement is tested. Management wants to allow the exception without weakening the security program. What is the best action?

Accepted Answer

Document a time-bound exception, record the risk, apply compensating controls, and schedule review before expiration.. It follows the formal exception process required by a mature security program: documenting the exception with a specific time bound (30 days), recording the associated risk, applying compensating controls (such as network segmentation or host-based firewall rules to isolate the deprecated plug-in), and scheduling a review before expiration ensures the risk is managed and the exception does not become permanent. This aligns with the SY0-701 objective of implementing risk management processes, where time-bound exceptions with compensating controls are the standard way to handle legacy dependencies without weakening the overall security posture.

Answer

Approve the exception informally by email and revisit it if problems appear.

Answer

Disable all monitoring on the workstations so the application will function normally.

Answer

Publish the exception as a permanent guideline so other teams can follow it.

Question 11

A records clerk finds paper forms containing customer identifiers. The retention period has expired, and no legal hold applies. Which two actions are appropriate next? Select two.

Accepted Answer

Verify that the retention schedule has been satisfied and no hold exists. Before disposing of any records, the records clerk must confirm that the retention period has fully elapsed and that no legal hold (such as a litigation hold or regulatory hold) is active. This verification step ensures compliance with organizational data governance policies and avoids spoliation of evidence. Option B is correct because once verification is complete, the approved disposal method (e.g., cross-cut shredding, incineration, or secure shredding service) must be used to render the customer identifiers irrecoverable, aligning with data minimization and privacy requirements.

Answer

Keep the forms in a personal desk drawer until someone asks for them

Answer

Take the papers home for safe keeping before shredding later

Answer

Refile the forms in an archive cabinet because they are old records

Question 12

An engineering team requests a 30-day exception to use an unsupported browser plug-in on two workstations so a customer deliverable can be finished. Security agrees the business need is legitimate, but wants to reduce exposure. What must be included before the exception is approved?

Accepted Answer

A documented exception with an end date, compensating controls, and approval by the risk owner.. A documented exception with a defined end date, compensating controls, and risk-owner approval is the correct approach. Security exceptions should be controlled, reviewable, and temporary whenever possible. That structure shows the business need was acknowledged while ensuring someone has formally accepted the residual risk and the organization can reassess the exception before it becomes indefinite.

Why others are wrong: A verbal approval is not enough for auditability or accountability. A standing waiver without a review date can quietly become permanent and increase exposure. A guideline does not authorize deviation from policy or provide the controls required for an exception process. The question is about formal exception handling, not informal advice.

Answer

A verbal approval from the engineering manager and no additional documentation.

Answer

A standing waiver that remains in place until the project finishes, with no review date.

Answer

A guideline reminding the team to avoid risky behavior when practical.

Question 13

An HR spreadsheet contains employee names, Social Security numbers, and bank account numbers. Which label is most appropriate under a Public, Internal, Confidential, and Restricted scheme?

Accepted Answer

Restricted, because it contains highly sensitive personal and financial data.. A spreadsheet containing employee names, Social Security numbers, and bank account numbers includes personally identifiable information (PII) and financial account data, which are subject to strict regulatory controls (e.g., GDPR, GLBA, or state breach notification laws). Under a Public/Internal/Confidential/Restricted classification scheme, 'Restricted' is the most appropriate label because it indicates the highest level of sensitivity and requires access control mechanisms such as encryption at rest (e.g., AES-256), strict least-privilege permissions, and audit logging to prevent unauthorized disclosure or modification.

Answer

Public, because it is used by the HR department and not shared externally.

Answer

Internal, because only employees should see it.

Answer

Confidential, because the information should be kept private but not tightly controlled.

Question 14

A help desk team is writing a procedure for resetting MFA after a user loses a phone. Which two details belong in the procedure rather than in the policy? Select two.

Accepted Answer

The exact step-by-step verification process the technician must follow. A procedure must contain the exact step-by-step verification process the technician follows to confirm the user's identity before resetting MFA. This operational detail ensures consistency and security, whereas a policy would only state the high-level requirement (e.g., 'verify identity'). Without precise steps, technicians might skip critical checks, leading to unauthorized MFA resets.

Answer

A statement that all employees must use MFA to access company systems

Answer

A general goal of protecting accounts from unauthorized access

Answer

A broad rule that users should protect company credentials

Question 15

A vulnerability scan identifies four issues across a small company. Which item should the operations team remediate first?

Accepted Answer

A high-severity flaw on an internet-facing customer portal with public exploit code available. The internet-facing customer portal with a high-severity flaw and public exploit code presents the highest risk to the organization. The combination of high attack surface (exposed to the internet), high severity, and readily available exploit code means an attacker can easily compromise the system, leading to data breach, financial loss, or reputational damage. Remediation prioritization should follow risk-based principles, where likelihood and impact are both high.

Answer

A critical flaw on a disconnected training laptop that is used only in the lab

Answer

A medium-severity flaw on an internal print server that stores no sensitive data

Answer

A low-severity flaw on an archive server scheduled for retirement next month