SY0-701 Security Program Management and Oversight Practice Test 8 — 15 Questions

Question 1

A hospital's claims portal has two open risks. Risk A is an internet-facing login page with a low-severity software flaw, but monitoring shows a steady increase in automated login attempts. Risk B is an internal file share with a medium-severity patch gap, but only a small admin group can access it and no exploitation is observed. Leadership can fund only one remediation this month. Which risk should be prioritized first?

Accepted Answer

Prioritize Risk A because it is exposed to the internet and already shows active attack interest.. Risk A should be prioritized because the internet-facing login page is exposed to the public attack surface, and the steady increase in automated login attempts indicates active reconnaissance or credential-stuffing attacks. Even though the software flaw is low severity, the combination of internet exposure and active attacker interest significantly elevates the likelihood of exploitation, making it a higher priority than an internal file share with no observed exploitation.

Answer

Prioritize Risk B because a medium-severity flaw is always more important than a low-severity flaw.

Answer

Accept Risk A because no confirmed compromise has occurred yet.

Answer

Transfer Risk A to an insurer because public-facing exposure cannot be reduced.

Question 2

A file contains employee Social Security numbers and bank account details. The company uses the labels Public, Internal, Confidential, and Restricted. Which label is most appropriate?

Accepted Answer

Restricted, because it contains highly sensitive personal and financial information. Social Security numbers and bank account details are classified as personally identifiable information (PII) and financial data, which are subject to strict regulatory requirements (e.g., GDPR, PCI DSS). The 'Restricted' label is designed for the most sensitive data that requires the highest level of access control and encryption, making it the correct choice for this scenario.

Answer

Public, because employees may need to share it with outside vendors

Answer

Internal, because only company staff should see it

Answer

Confidential, because the information is sensitive but not highly regulated

Question 3

A small company can only remediate two findings this week. Which two should be fixed first based on risk to the business? Select two.

Accepted Answer

An internet-facing VPN appliance with a critical vulnerability and a public exploit. Option A is correct because an internet-facing VPN appliance with a critical vulnerability and a public exploit represents an immediate, high-impact risk. Attackers can leverage the public exploit to gain unauthorized remote access to the internal network, potentially compromising all connected systems and data. The combination of internet exposure and known exploit makes this the highest priority for remediation.

Answer

An internal training VM used by one student with a medium vulnerability and no sensitive data

Answer

A discontinued server already removed from the network but still listed in inventory

Answer

A low-severity cosmetic issue on a noncritical dashboard page

Question 4

A records manager confirms that paper onboarding forms containing government IDs are past retention, no legal hold exists, and the files are no longer needed. Which three actions should happen next? Select three.

Accepted Answer

Destroy the forms using approved secure disposal methods.. Option A is correct because once records are past their retention period, no legal hold exists, and they are no longer needed, the organization must destroy them using approved secure disposal methods (e.g., cross-cut shredding, incineration, or pulping) to prevent unauthorized access to sensitive PII. This aligns with the principle of data minimization and compliance with privacy regulations like GDPR or HIPAA.

Answer

Store the forms in a desk drawer for another quarter just in case.

Answer

Email scans of the forms to managers so they can keep a copy.

Question 5

A manufacturing company must keep a legacy scheduling application running for 60 days while replacement testing finishes. The application supports production orders, and the business cannot tolerate a shutdown. Which three conditions should be required before approving the temporary exception? Select three.

Accepted Answer

Assign a named risk owner who is authorized to accept the residual risk.. Assigning a named risk owner who is authorized to accept residual risk is a fundamental requirement for any risk exception. This ensures accountability and that a specific individual with the authority to accept the potential consequences of running an unsupported system is identified. Without a designated owner, the exception lacks governance and could lead to unmanaged exposure.

Answer

Rely on the vendor's promise that a better version will be available eventually.

Answer

Approve an unlimited waiver so operations do not need to revisit the issue.

Question 6

A development manager wants to copy a production customer database into a test environment so testers can reproduce a bug. The database contains names, addresses, and payment tokens. What is the best security practice before the copy is made?

Accepted Answer

Mask, tokenize, or replace sensitive fields with approved test data before moving it.. Option B is correct because copying production data containing sensitive information (names, addresses, payment tokens) into a test environment without sanitization violates data minimization and privacy principles (e.g., GDPR, PCI DSS). The best practice is to apply data masking, tokenization, or substitution with realistic but non-sensitive test data before the copy, ensuring that the test environment does not expose real customer data. This prevents accidental data leakage and reduces compliance risk while still allowing testers to reproduce the bug with functionally equivalent data.

Answer

Copy the production database unchanged and limit access to the QA team.

Answer

Compress the database export to reduce storage and transfer time.

Answer

Encrypt the database backup and give developers the decryption key.

Question 7

A cloud-hosted invoicing app has a critical vulnerability, but the vendor says a patch will not be available for six weeks. The team adds a web application firewall rule, restricts access to the app subnet, and increases monitoring until the patch arrives. What is this best described as?

Accepted Answer

Compensating control, because temporary safeguards reduce exposure until the patch is available.. Option C is correct because the team deployed temporary security measures—a web application firewall (WAF) rule, subnet access restrictions, and enhanced monitoring—to reduce the risk exposure while waiting for the vendor's patch. These are compensating controls, which are alternative safeguards that mitigate a vulnerability when the primary control (the patch) cannot be implemented immediately. The scenario explicitly states the patch is six weeks away, making these interim measures a textbook compensating control.

Answer

Risk avoidance, because the system is being shut down permanently.

Answer

Risk transfer, because the vendor is responsible for the vulnerability.

Answer

Residual risk acceptance, because the vulnerability is being ignored until next quarter.

Question 8

An employee receives an email that appears to be from the CEO and asks for gift cards before a meeting. What should the employee do first?

Accepted Answer

Report the message through the approved security channel and verify the request by a separate method.. Option A is correct because the first action in response to a suspected phishing or social engineering attack is to report it through the approved security channel, which ensures the incident is logged and can be investigated. Separately verifying the request—such as by calling the CEO or using a known, trusted contact method—confirms the legitimacy of the request without relying on the potentially compromised email thread. This aligns with security policy best practices for incident response and prevents unauthorized disclosure of funds or credentials.

Answer

Buy the gift cards immediately so the CEO is not delayed.

Answer

Forward the email to coworkers so they can watch for the same request.

Answer

Reply to the sender and ask for more details in the same email thread.

Question 9

A company wants every corporate laptop to use the same required screen-lock timeout, disk encryption setting, and local administrator restriction. Which document should define these mandatory settings?

Accepted Answer

A standard, because it specifies required configuration values. A standard is the correct document type because it mandates specific, measurable configuration values (e.g., screen-lock timeout of 300 seconds, AES-256 disk encryption, removal of local admin rights) that all corporate laptops must enforce. Standards are binding and establish a baseline for security compliance, unlike guidelines which are advisory. This aligns with the company's requirement for mandatory, uniform settings across all devices.

Answer

A guideline, because it offers flexible suggestions for users

Answer

A procedure, because it explains the business reason for security rules

Answer

A memo, because it is the fastest way to communicate changes

Question 10

A vendor-supported application cannot be patched for 30 days, but the business must keep it online. What is the best short-term risk treatment?

Accepted Answer

Apply a compensating control, such as restricting access and monitoring traffic. Option B is correct because when a known vulnerability cannot be patched immediately, applying a compensating control—such as restricting network access via firewall rules (e.g., allowing only specific source IPs) and enabling deep packet inspection (DPI) or an intrusion prevention system (IPS) to monitor for exploit attempts—reduces the risk to an acceptable level without taking the application offline. This approach aligns with the principle of defense in depth, buying time until the vendor patch is available.

Answer

Accept the risk without any additional controls

Answer

Delete the application so the vulnerability no longer exists

Answer

Transfer the risk by telling users to work faster

Question 11

After a phishing simulation, many users still nearly entered credentials on the fake page. Security wants the fastest improvement without scheduling long training sessions. What is the best response?

Accepted Answer

Send a short targeted awareness message with examples, warning signs, and reporting steps.. Option C is correct because a short targeted awareness message directly addresses the observed risky behavior with minimal time investment, providing immediate reinforcement of warning signs and reporting procedures. This approach leverages just-in-time training, which is proven to improve retention and behavior change more effectively than lengthy sessions, aligning with the goal of fastest improvement without disrupting operations.

Answer

Require a full-day classroom course for every employee immediately.

Answer

Ignore the results because no actual breach occurred.

Answer

Reset every employee password as the main way to prevent future clicks.

Question 12

A security manager wants every corporate laptop to use the same mandatory settings, including disk encryption, a 10-minute screen lock, and removal of local administrator rights. Which document should define these specific requirements?

Accepted Answer

Standard. A standard defines mandatory, specific technical requirements that must be uniformly applied across all systems, such as enforcing AES-256 disk encryption, a 600-second screen lock timeout, and removal of local administrator rights. Unlike a policy, which is high-level and goal-oriented, a standard provides the precise configuration settings that implement the policy's intent. This aligns with the CompTIA SY0-701 domain of Security Program Management and Oversight, where standards bridge the gap between policy and technical implementation.

Answer

Policy

Answer

Guideline

Answer

Procedure

Question 13

An employee receives a text message claiming their email password expired and asks them to tap a link and confirm a one-time code. Which two responses are appropriate? Select two.

Accepted Answer

Do not tap the link or share the one-time code. Option A is correct because tapping the link or sharing the one-time code would allow an attacker to complete a credential harvesting or MFA bypass attack. The message is a classic phishing attempt designed to trick the recipient into providing a one-time code that the attacker can use to authenticate as the victim. The correct response is to never interact with the link or code.

Answer

Reply to the sender and ask them to prove they are legitimate

Answer

Enter the code to see whether the message is real

Answer

Forward the text to coworkers so they can compare it

Question 14

A company has two security issues to address this week. One is a public-facing login portal that uses default administrator credentials. The other is an internal lab system used only by one tester. Which issue should be prioritized first?

Accepted Answer

The public-facing login portal, because it has a higher likelihood and impact. The public-facing login portal with default administrator credentials is a critical risk because it is exposed to the internet, making it easily discoverable and exploitable by attackers. Default credentials are widely known and often targeted in automated attacks, leading to a high likelihood of compromise and potential impact such as data breach or system takeover. This aligns with risk management principles where priority is given to vulnerabilities with the highest risk score (likelihood × impact).

Answer

The internal lab system, because it is easier to fix quickly

Answer

Both issues have the same priority because they are both vulnerabilities

Answer

Neither issue should be addressed until the next annual review

Question 15

A security team wants to reduce repeated user mistakes after a phishing campaign without overwhelming employees with long training sessions. Which approach is best?

Accepted Answer

Send a short, targeted reminder to the affected users with a clear reporting path. Option A is correct because it applies targeted, immediate reinforcement to the specific users who made mistakes, using a short reminder that clarifies the reporting path. This approach leverages just-in-time training, which has been shown to improve retention and behavior change without overwhelming employees. It directly addresses the root cause—repeated user errors—by providing a clear, actionable step (e.g., 'Report suspicious emails using the PhishAlarm button') rather than generic awareness.

Answer

Require every employee to attend a full-day security class immediately

Answer

Wait until the next annual training cycle and do nothing now

Answer

Disable email access for all employees until they pass a new test