SY0-701 Security Program Management and Oversight Practice Test 7 — 15 Questions

Question 1

An accounts payable specialist receives an email inside an existing vendor thread that asks for a last-minute bank-account change before a payment run. The wording is professional, the signature matches, and the request is urgent. Which three actions should the specialist take? Select three.

Accepted Answer

Verify the request through a known out-of-band contact method for the vendor.. Option A is correct because verifying the request through a known out-of-band contact method (e.g., a phone call to a previously documented vendor number) directly mitigates the risk of business email compromise (BEC). Attackers often hijack or spoof legitimate email threads, so in-band verification (replying within the thread) is unreliable. This aligns with the principle of dual control and independent verification for sensitive financial changes.

Answer

Reply in the same thread because the address and signature look legitimate.

Answer

Process the change immediately to avoid delaying the vendor relationship.

Question 2

After a phishing simulation, many employees still almost entered credentials into a fake login page. Leadership wants the fastest improvement without creating training fatigue or disrupting daily work. Which three measures are the best balance of security and usability? Select three.

Accepted Answer

Provide targeted microtraining only to users who clicked or nearly clicked.. Option A is correct because targeted microtraining focuses only on the users who demonstrated risky behavior (clicking or nearly clicking), which directly addresses the root cause without wasting time on users who did not engage. This approach avoids training fatigue by keeping content brief and relevant, and it does not disrupt daily work for the majority of employees who already exhibit secure behavior.

Answer

Replace email access with a weekly manual approval queue for all messages.

Answer

Publicly identify the worst performers in team meetings to discourage mistakes.

Question 3

A company can patch only one of two internet-facing systems this week. System 1 has a critical vulnerability but is reachable only through the corporate VPN during maintenance windows. System 2 has a medium vulnerability and supports the public payment site, which shows active attack traffic every day. Which system should be prioritized first?

Accepted Answer

System 2, because it is exposed to the public and directly supports a business-critical service. System 2 should be prioritized because it is directly exposed to the public internet and supports a business-critical payment service that is under active attack daily. Even though System 1 has a critical vulnerability, it is only reachable through the corporate VPN during maintenance windows, which significantly reduces its attack surface and exploitability. In risk management, the likelihood of exploitation and business impact often outweigh the CVSS base score alone, making System 2 the higher priority.

Answer

System 1, because the vulnerability is rated critical

Answer

Neither system, because both are internet-facing and must wait for the next maintenance cycle

Answer

System 1, because VPN access always makes a vulnerability more dangerous than a public application issue

Question 4

An engineering tool runs on an unsupported operating system, but the tool is used only occasionally and can be replaced by a supported cloud service with little workflow impact. Which risk treatment is best?

Accepted Answer

Avoid the risk by retiring the unsupported system and replacing it with the supported service. Option C is correct because the best risk treatment for an unsupported operating system that is only used occasionally and can be replaced with minimal workflow impact is to avoid the risk entirely. By retiring the unsupported system and migrating to the supported cloud service, the organization eliminates the security vulnerabilities and compliance issues associated with the outdated OS. This aligns with the risk avoidance strategy, which is preferred when the cost of mitigation is low and the risk is high.

Answer

Accept the risk because the tool is old and still functions

Answer

Transfer the risk to the cloud provider without making changes

Answer

Compensate for the risk by adding more user passwords

Question 5

A customer portal team must keep an unsupported Linux appliance online for 60 days while a replacement is built. The appliance processes payment tokens and cannot be patched until the vendor certifies the new image. Which two actions best reduce the residual risk during the 60-day window? Select two.

Accepted Answer

Restrict network paths to only the required upstream and downstream systems through firewall allow-lists.. Option B is correct because restricting network paths to only required upstream and downstream systems via firewall allow-lists reduces the attack surface by limiting the appliance's exposure to unnecessary network traffic. This is a classic network segmentation compensating control that mitigates the risk of lateral movement from an unpatched, vulnerable system. By enforcing strict ingress/egress rules, the team can prevent unauthorized access and contain potential exploits during the 60-day window.

Answer

Move the appliance onto the flat user VLAN so the team can monitor it with standard workstation tools.

Answer

Declare the risk fully accepted and make no configuration changes until the replacement is ready.

Answer

Disable logging because the appliance is already at capacity and logs can slow it down.

Question 6

A records manager discovers 18-month-old paper onboarding forms stored in a cabinet. The retention schedule says the forms must be destroyed after 12 months unless legal hold applies, and no hold has been issued. What is the best next step?

Accepted Answer

Destroy the forms using an approved secure disposal method and document the action.. Option C is correct because the retention schedule explicitly requires destruction after 12 months with no legal hold. An approved secure disposal method (e.g., cross-cut shredding or incineration) ensures the sensitive PII on onboarding forms is irrecoverable, and documenting the action provides an audit trail for compliance with data protection regulations like GDPR or HIPAA.

Answer

Keep the forms indefinitely in case a future audit asks for them.

Answer

Scan the forms into a shared folder and then throw away the paper.

Answer

Return the forms to HR so they can be reused for new hires.

Question 7

A security manager wants one document that states employees must protect company laptops and another that defines exact required settings such as disk encryption and a 10-minute screen lock. Which two document types are the best fit? Select two.

Accepted Answer

Policy. A policy is a high-level statement of management intent, such as requiring employees to protect company laptops. A standard defines mandatory, specific technical settings, like requiring disk encryption (e.g., AES-256) and a 10-minute screen lock timeout. Together, they provide the overarching directive (policy) and the enforceable configuration baseline (standard).

Answer

Guideline

Answer

Procedure

Answer

Exception

Question 8

A developer requests a 45-day exception to use an unsupported browser plug-in on two engineering workstations so a legacy design tool can finish a customer deliverable. Which three conditions should be required before approving the exception? Select three.

Accepted Answer

Document a business justification that explains why the plug-in is required for the deliverable.. Option A is correct because documenting a business justification provides a formal record of why the exception is necessary, ensuring that the risk of using an unsupported browser plug-in is understood and accepted by management. This aligns with the principle of risk acceptance, where the business need outweighs the security risk for a limited time. Without a clear justification, the exception could be granted without proper oversight, potentially leading to unchecked vulnerabilities.

Answer

Convert the exception into a permanent waiver to avoid repeated review overhead.

Answer

Allow the requestor to self-approve the exception if the project deadline is urgent.

Question 9

A project team must share a spreadsheet containing customer names, account numbers, and purchase history with an external auditor. The auditor only needs account numbers and totals. What is the best privacy control?

Accepted Answer

Redact unneeded personal data and transfer only the minimum necessary information through an approved encrypted channel. Option B is correct because it applies the principle of data minimization and secure transmission. Redacting unneeded personal data (customer names) ensures only the minimum necessary information (account numbers and totals) is shared, reducing exposure. Transferring via an approved encrypted channel (e.g., SFTP, HTTPS, or encrypted email) protects data in transit from interception, which is required for compliance with regulations like GDPR or PCI DSS.

Answer

Send the full spreadsheet through regular email to avoid delaying the audit

Answer

Upload the spreadsheet to a public file-sharing site and protect it with a password

Answer

Compress the file with a password and reuse the same password for all auditors

Question 10

An HR analyst must send a salary file to an external auditor. The auditor only needs names, departments, and salary totals, not Social Security numbers or bank account details. Which two actions should the analyst take first? Select two.

Accepted Answer

Remove unnecessary sensitive fields before sharing. Option A is correct because removing unnecessary sensitive fields (like Social Security numbers and bank account details) before sharing the file reduces the risk of exposing personally identifiable information (PII) and aligns with the principle of data minimization. This step ensures that only the required data (names, departments, salary totals) is transmitted, which is a foundational security control before any data transfer occurs.

Answer

Upload the file to a public link and send the URL by email

Answer

Rename the file to a less obvious name and send it normally

Answer

Save the file locally on a USB drive and hand-deliver it

Question 11

A project team needs to use an unapproved file-sharing application for two weeks because the approved platform cannot support an external client collaboration feature. What is the best security action?

Accepted Answer

Approve a documented temporary exception with compensating controls and a review date. Option B is correct because it follows the principle of risk acceptance through a formal exception process. By documenting a temporary exception with compensating controls (e.g., data encryption, access logging, and usage monitoring) and setting a review date, the organization maintains security oversight while addressing the legitimate business need. This approach aligns with the SY0-701 domain of Security Program Management, which emphasizes balancing security with operational requirements through managed risk.

Answer

Deny the request permanently and avoid discussing the business need

Answer

Immediately rewrite the policy so all users may use the unapproved application

Answer

Ask the team to create a detailed step-by-step procedure for using the application

Question 12

A legacy payroll server contains a critical vulnerability. The vendor says a patch is 45 days away, and the system must remain available for payroll processing. Which risk treatment is the best short-term choice?

Accepted Answer

Mitigate the risk with compensating controls such as segmentation, restricted access, and monitoring.. Option B is correct because compensating controls like network segmentation, strict access controls, and enhanced monitoring can reduce the risk of exploitation while keeping the legacy payroll server operational. This approach directly addresses the need for availability during the 45-day patch window, aligning with the principle of defense-in-depth for unpatched systems.

Answer

Accept the risk until the patch arrives because the server is needed for payroll processing.

Answer

Avoid the risk by permanently decommissioning the server this week.

Answer

Transfer the risk by purchasing support coverage and waiting for the patch.

Question 13

A business owner asks whether to proceed with a medium-risk issue on an internal reporting system. The vulnerability is unlikely to be exploited because the system is reachable only from a segmented admin network, and no sensitive data is stored there. The owner wants to postpone remediation until the next planned upgrade window. Which risk treatment is being chosen?

Accepted Answer

Risk acceptance, because the business is choosing to live with the remaining risk for now.. Option B is correct because risk acceptance is the deliberate decision to acknowledge and tolerate a risk without immediate remediation. In this scenario, the business owner understands the vulnerability is low-likelihood (segmented admin network, no sensitive data) and chooses to postpone fixing it until the next planned upgrade, thereby accepting the residual risk for that period.

Answer

Risk avoidance, because the system will be upgraded later.

Answer

Risk transfer, because the upgrade window shifts responsibility to the vendor.

Answer

Risk escalation, because the issue is being sent to the help desk for tracking.

Question 14

A weekly risk review lists several findings. Which two should be addressed first based on likelihood of exploitation and business impact? Select two.

Accepted Answer

An internet-facing VPN appliance with a known exploit and no vendor patch available yet.. Option A is correct because an internet-facing VPN appliance with a known exploit presents a high likelihood of exploitation — attackers actively scan for such vulnerabilities — and the lack of a vendor patch means no immediate mitigation is available, leaving the business exposed to potential data breaches or network compromise. The combination of high exploitability (public-facing, known exploit) and high business impact (VPN access often leads to internal network access) makes this a critical risk that must be addressed first.

Answer

An internal lab system with an outdated browser component, isolated from production and not customer-facing.

Answer

A training virtual machine used offline once per month in a disconnected lab.

Answer

A documentation site with a spelling error in its banner text.

Question 15

A security manager is writing baseline requirements for all corporate laptops. Which three statements belong in the standard rather than in a policy or guideline? Select three.

Accepted Answer

Full-disk encryption must be enabled using approved encryption software.. Option A is correct because it is a mandatory, enforceable requirement that specifies exactly what must be done (enable full-disk encryption) and with what (approved encryption software). This level of specificity and obligation belongs in a standard, which defines compulsory technical controls, unlike a policy (high-level intent) or guideline (suggested best practice).

Answer

Users should consider keeping their devices updated whenever convenient.

Answer

Employees must follow the company's acceptable use policy at all times.