SY0-701 Security Program Management and Oversight Practice Test 7 — 15 Questions

Question 1

Paper onboarding forms have reached the end of their retention period, and no legal hold applies. What should happen next?

Accepted Answer

Destroy them using an approved secure disposal method.. Once paper onboarding forms have reached the end of their retention period and no legal hold applies, the organization must destroy them using an approved secure disposal method (e.g., cross-cut shredding, pulping, or incineration) to prevent unauthorized access to personally identifiable information (PII) and comply with data protection regulations such as GDPR or HIPAA. Retaining data beyond its required lifecycle violates the data minimization principle and increases breach risk.

Answer

Store them indefinitely in case the company needs them later.

Answer

Scan them to a personal cloud account so they are not lost.

Answer

Mail copies to every manager for review before disposal.

Question 2

A manager asks how to decide whether a new security issue is worth spending money on. Which two factors should be reviewed first? Select two.

Accepted Answer

Likelihood that the issue will be exploited. The likelihood of exploitation is a fundamental factor in risk assessment. Without understanding how probable it is that a threat actor will exploit a vulnerability, an organization cannot prioritize remediation efforts effectively. This is a core component of risk calculation (Risk = Likelihood × Impact).

Answer

The color used on the vulnerability report

Answer

The number of users in the IT department

Answer

The age of the server name in inventory

Question 3

A small company has two security issues and can fix only one this week. Which should be prioritized first? One issue is an internal lab server with a medium-severity flaw. The other is an internet-facing login portal using default administrator credentials.

Accepted Answer

Fix the internet-facing login portal first because default administrator credentials create a much higher risk.. The internet-facing login portal using default administrator credentials represents an immediate, high-impact risk because it allows unauthorized remote access with administrative privileges. Default credentials are well-known and actively targeted by automated scanners and attackers, making exploitation trivial. In contrast, the internal lab server with a medium-severity flaw is behind network segmentation and requires additional access, so its risk is lower and can be deferred.

Answer

Fix the internal lab server first because every vulnerability should be treated equally.

Answer

Wait until the monthly maintenance window so both issues can be fixed at the same time.

Answer

Ignore both issues until users report symptoms, then respond if something happens.

Question 4

Which document should define mandatory settings such as full-disk encryption, a 10-minute screen-lock timeout, and removal of local administrator rights on company laptops?

Accepted Answer

Standard, because it defines specific required configurations that must be followed.. A standard defines mandatory, specific technical configurations that must be uniformly applied across all company laptops. The question lists concrete settings (full-disk encryption, 10-minute screen-lock timeout, removal of local admin rights) that are not open to interpretation, which aligns precisely with the role of a security standard in enforcing baseline compliance.

Answer

Policy, because it explains the general direction but not the exact settings.

Answer

Procedure, because it lists the steps an end user should take every day.

Answer

Guideline, because it offers flexible recommendations rather than mandatory rules.

Question 5

Several employees nearly entered credentials into a fake mailbox login page. The security team wants to reduce repeat mistakes quickly without overwhelming the whole company. What is the best communication approach?

Accepted Answer

Send a short targeted notice to the affected users with examples, warning signs, and reporting steps. A short targeted notice to the affected users is the best approach because it directly addresses the immediate threat without overwhelming the entire company. This method allows the security team to quickly reinforce specific warning signs (e.g., mismatched URLs, lack of HTTPS/TLS certificates) and reporting procedures, reducing the likelihood of repeat mistakes while maintaining operational efficiency.

Answer

Wait until the annual security training cycle to address the issue

Answer

Disable all external email until the next awareness campaign is completed

Answer

Send a company-wide message naming the affected employees to discourage mistakes

Question 6

An HR analyst needs to send a payroll reconciliation file to an external auditor. The file contains employee names, SSNs, bank account numbers, and salary details, but the auditor only needs employee IDs, payment totals, and a control total. What should the analyst do first?

Accepted Answer

Redact or remove unnecessary sensitive fields before sharing the minimum required data.. The principle of data minimization requires that only the necessary data (employee IDs, payment totals, control total) be shared with the external auditor. Redacting or removing unnecessary sensitive fields (SSNs, bank account numbers, salary details) reduces the risk of exposure and complies with privacy regulations. This step should occur before any encryption or transmission to ensure the auditor never receives data they do not need.

Answer

Encrypt the full spreadsheet and send it without changing the contents.

Answer

Compress the file into a password-protected archive and email the password separately.

Answer

Copy the file to a personal cloud storage account to make sharing easier.

Question 7

An HR analyst must send a compensation spreadsheet to an external auditor. The auditor only needs employee names, departments, and salary totals; Social Security numbers and bank account fields are not required. What should the analyst do before sharing the file?

Accepted Answer

Remove or redact the fields the auditor does not need, then share only the minimum necessary data.. The principle of data minimization requires sharing only the information necessary for the task. By removing or redacting the Social Security numbers and bank account fields, the analyst reduces the risk of exposing sensitive personally identifiable information (PII) to the external auditor, aligning with least privilege and need-to-know principles.

Answer

Encrypt the spreadsheet and send the full file as-is to preserve all records.

Answer

Store the file in a shared cloud folder and grant the auditor read-only access.

Answer

Convert the file to PDF so the sensitive information is harder to edit.

Question 8

A vendor-supported legacy application can run only with a deprecated browser plug-in on two engineering workstations for 30 days while a replacement is tested. Management wants to allow the exception without weakening the security program. What is the best action?

Accepted Answer

Document a time-bound exception, record the risk, apply compensating controls, and schedule review before expiration.. It follows the formal exception process required by a mature security program: documenting the exception with a specific time bound (30 days), recording the associated risk, applying compensating controls (such as network segmentation or host-based firewall rules to isolate the deprecated plug-in), and scheduling a review before expiration ensures the risk is managed and the exception does not become permanent. This aligns with the SY0-701 objective of implementing risk management processes, where time-bound exceptions with compensating controls are the standard way to handle legacy dependencies without weakening the overall security posture.

Answer

Approve the exception informally by email and revisit it if problems appear.

Answer

Disable all monitoring on the workstations so the application will function normally.

Answer

Publish the exception as a permanent guideline so other teams can follow it.

Question 9

A records clerk finds paper forms containing customer identifiers. The retention period has expired, and no legal hold applies. Which two actions are appropriate next? Select two.

Accepted Answer

Verify that the retention schedule has been satisfied and no hold exists. Before disposing of any records, the records clerk must confirm that the retention period has fully elapsed and that no legal hold (such as a litigation hold or regulatory hold) is active. This verification step ensures compliance with organizational data governance policies and avoids spoliation of evidence. Option B is correct because once verification is complete, the approved disposal method (e.g., cross-cut shredding, incineration, or secure shredding service) must be used to render the customer identifiers irrecoverable, aligning with data minimization and privacy requirements.

Answer

Keep the forms in a personal desk drawer until someone asks for them

Answer

Take the papers home for safe keeping before shredding later

Answer

Refile the forms in an archive cabinet because they are old records

Question 10

An engineering team requests a 30-day exception to use an unsupported browser plug-in on two workstations so a customer deliverable can be finished. Security agrees the business need is legitimate, but wants to reduce exposure. What must be included before the exception is approved?

Accepted Answer

A documented exception with an end date, compensating controls, and approval by the risk owner.. A documented exception with a defined end date, compensating controls, and risk-owner approval is the correct approach. Security exceptions should be controlled, reviewable, and temporary whenever possible. That structure shows the business need was acknowledged while ensuring someone has formally accepted the residual risk and the organization can reassess the exception before it becomes indefinite.

Why others are wrong: A verbal approval is not enough for auditability or accountability. A standing waiver without a review date can quietly become permanent and increase exposure. A guideline does not authorize deviation from policy or provide the controls required for an exception process. The question is about formal exception handling, not informal advice.

Answer

A verbal approval from the engineering manager and no additional documentation.

Answer

A standing waiver that remains in place until the project finishes, with no review date.

Answer

A guideline reminding the team to avoid risky behavior when practical.

Question 11

An HR spreadsheet contains employee names, Social Security numbers, and bank account numbers. Which label is most appropriate under a Public, Internal, Confidential, and Restricted scheme?

Accepted Answer

Restricted, because it contains highly sensitive personal and financial data.. A spreadsheet containing employee names, Social Security numbers, and bank account numbers includes personally identifiable information (PII) and financial account data, which are subject to strict regulatory controls (e.g., GDPR, GLBA, or state breach notification laws). Under a Public/Internal/Confidential/Restricted classification scheme, 'Restricted' is the most appropriate label because it indicates the highest level of sensitivity and requires access control mechanisms such as encryption at rest (e.g., AES-256), strict least-privilege permissions, and audit logging to prevent unauthorized disclosure or modification.

Answer

Public, because it is used by the HR department and not shared externally.

Answer

Internal, because only employees should see it.

Answer

Confidential, because the information should be kept private but not tightly controlled.

Question 12

A help desk team is writing a procedure for resetting MFA after a user loses a phone. Which two details belong in the procedure rather than in the policy? Select two.

Accepted Answer

The exact step-by-step verification process the technician must follow. A procedure must contain the exact step-by-step verification process the technician follows to confirm the user's identity before resetting MFA. This operational detail ensures consistency and security, whereas a policy would only state the high-level requirement (e.g., 'verify identity'). Without precise steps, technicians might skip critical checks, leading to unauthorized MFA resets.

Answer

A statement that all employees must use MFA to access company systems

Answer

A general goal of protecting accounts from unauthorized access

Answer

A broad rule that users should protect company credentials

Question 13

A vulnerability scan identifies four issues across a small company. Which item should the operations team remediate first?

Accepted Answer

A high-severity flaw on an internet-facing customer portal with public exploit code available. The internet-facing customer portal with a high-severity flaw and public exploit code presents the highest risk to the organization. The combination of high attack surface (exposed to the internet), high severity, and readily available exploit code means an attacker can easily compromise the system, leading to data breach, financial loss, or reputational damage. Remediation prioritization should follow risk-based principles, where likelihood and impact are both high.

Answer

A critical flaw on a disconnected training laptop that is used only in the lab

Answer

A medium-severity flaw on an internal print server that stores no sensitive data

Answer

A low-severity flaw on an archive server scheduled for retirement next month

Question 14

A business unit asks for a 30-day exception to use an unsupported browser plug-in on two engineering workstations while a replacement is tested. Which three conditions should be required before approval? Select three.

Accepted Answer

A documented business justification for why the plug-in is still needed.. A documented business justification ensures that the exception is necessary and aligns with organizational risk appetite. Without a clear reason, the exception could be granted for convenience rather than critical need, undermining security governance. This justification also provides an audit trail for why an unsupported, potentially vulnerable plug-in is still in use.

Answer

An open-ended waiver so the team can continue if testing slips.

Answer

Verbal approval only, with no written record.

Question 15

An accounts payable specialist receives an email inside an existing vendor thread that asks for a last-minute bank-account change before a payment run. The wording is professional, the signature matches, and the request is urgent. Which three actions should the specialist take? Select three.

Accepted Answer

Verify the request through a known out-of-band contact method for the vendor.. Verifying the request through a known out-of-band contact method (e.g., a phone call to a previously documented vendor number) directly mitigates the risk of business email compromise (BEC). Attackers often hijack or spoof legitimate email threads, so in-band verification (replying within the thread) is unreliable. This aligns with the principle of dual control and independent verification for sensitive financial changes.

Answer

Reply in the same thread because the address and signature look legitimate.

Answer

Process the change immediately to avoid delaying the vendor relationship.