SY0-701 Security Program Management and Oversight Practice Test 8 — 15 Questions

Question 1

After a phishing simulation, many employees still almost entered credentials into a fake login page. Leadership wants the fastest improvement without creating training fatigue or disrupting daily work. Which three measures are the best balance of security and usability? Select three.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Provide targeted microtraining only to users who clicked or nearly clicked.. Targeted microtraining focuses only on the users who demonstrated risky behavior (clicking or nearly clicking), which directly addresses the root cause without wasting time on users who did not engage. This approach avoids training fatigue by keeping content brief and relevant, and it does not disrupt daily work for the majority of employees who already exhibit secure behavior.

Answer

Replace email access with a weekly manual approval queue for all messages.

Answer

Publicly identify the worst performers in team meetings to discourage mistakes.

Question 2

A company can patch only one of two internet-facing systems this week. System 1 has a critical vulnerability but is reachable only through the corporate VPN during maintenance windows. System 2 has a medium vulnerability and supports the public payment site, which shows active attack traffic every day. Which system should be prioritized first?

Accepted Answer

System 2, because it is exposed to the public and directly supports a business-critical service. System 2 should be prioritized because it is directly exposed to the public internet and supports a business-critical payment service that is under active attack daily. Even though System 1 has a critical vulnerability, it is only reachable through the corporate VPN during maintenance windows, which significantly reduces its attack surface and exploitability. In risk management, the likelihood of exploitation and business impact often outweigh the CVSS base score alone, making System 2 the higher priority.

Answer

System 1, because the vulnerability is rated critical

Answer

Neither system, because both are internet-facing and must wait for the next maintenance cycle

Answer

System 1, because VPN access always makes a vulnerability more dangerous than a public application issue

Question 3

An engineering tool runs on an unsupported operating system, but the tool is used only occasionally and can be replaced by a supported cloud service with little workflow impact. Which risk treatment is best?

Accepted Answer

Avoid the risk by retiring the unsupported system and replacing it with the supported service. The best risk treatment for an unsupported operating system that is only used occasionally and can be replaced with minimal workflow impact is to avoid the risk entirely. By retiring the unsupported system and migrating to the supported cloud service, the organization eliminates the security vulnerabilities and compliance issues associated with the outdated OS. This aligns with the risk avoidance strategy, which is preferred when the cost of mitigation is low and the risk is high.

Answer

Accept the risk because the tool is old and still functions

Answer

Transfer the risk to the cloud provider without making changes

Answer

Compensate for the risk by adding more user passwords

Question 4

A customer portal team must keep an unsupported Linux appliance online for 60 days while a replacement is built. The appliance processes payment tokens and cannot be patched until the vendor certifies the new image. Which two actions best reduce the residual risk during the 60-day window? Select two.

Accepted Answer

Restrict network paths to only the required upstream and downstream systems through firewall allow-lists.. Restricting network paths to only required upstream and downstream systems via firewall allow-lists reduces the attack surface by limiting the appliance's exposure to unnecessary network traffic. This is a classic network segmentation compensating control that mitigates the risk of lateral movement from an unpatched, vulnerable system. By enforcing strict ingress/egress rules, the team can prevent unauthorized access and contain potential exploits during the 60-day window.

Answer

Move the appliance onto the flat user VLAN so the team can monitor it with standard workstation tools.

Answer

Declare the risk fully accepted and make no configuration changes until the replacement is ready.

Answer

Disable logging because the appliance is already at capacity and logs can slow it down.

Question 5

A records manager discovers 18-month-old paper onboarding forms stored in a cabinet. The retention schedule says the forms must be destroyed after 12 months unless legal hold applies, and no hold has been issued. What is the best next step?

Accepted Answer

Destroy the forms using an approved secure disposal method and document the action.. The retention schedule explicitly requires destruction after 12 months with no legal hold. An approved secure disposal method (e.g., cross-cut shredding or incineration) ensures the sensitive PII on onboarding forms is irrecoverable, and documenting the action provides an audit trail for compliance with data protection regulations like GDPR or HIPAA.

Answer

Keep the forms indefinitely in case a future audit asks for them.

Answer

Scan the forms into a shared folder and then throw away the paper.

Answer

Return the forms to HR so they can be reused for new hires.

Question 6

A security manager wants one document that states employees must protect company laptops and another that defines exact required settings such as disk encryption and a 10-minute screen lock. Which two document types are the best fit? Select two.

Accepted Answer

Policy. A policy is a high-level statement of management intent, such as requiring employees to protect company laptops. A standard defines mandatory, specific technical settings, like requiring disk encryption (e.g., AES-256) and a 10-minute screen lock timeout. Together, they provide the overarching directive (policy) and the enforceable configuration baseline (standard).

Answer

Guideline

Answer

Procedure

Answer

Exception

Question 7

A developer requests a 45-day exception to use an unsupported browser plug-in on two engineering workstations so a legacy design tool can finish a customer deliverable. Which three conditions should be required before approving the exception? Select three.

Accepted Answer

Document a business justification that explains why the plug-in is required for the deliverable.. Documenting a business justification provides a formal record of why the exception is necessary, ensuring that the risk of using an unsupported browser plug-in is understood and accepted by management. This aligns with the principle of risk acceptance, where the business need outweighs the security risk for a limited time. Without a clear justification, the exception could be granted without proper oversight, potentially leading to unchecked vulnerabilities.

Answer

Convert the exception into a permanent waiver to avoid repeated review overhead.

Answer

Allow the requestor to self-approve the exception if the project deadline is urgent.

Question 8

A project team must share a spreadsheet containing customer names, account numbers, and purchase history with an external auditor. The auditor only needs account numbers and totals. What is the best privacy control?

Accepted Answer

Redact unneeded personal data and transfer only the minimum necessary information through an approved encrypted channel. It applies the principle of data minimization and secure transmission. Redacting unneeded personal data (customer names) ensures only the minimum necessary information (account numbers and totals) is shared, reducing exposure. Transferring via an approved encrypted channel (e.g., SFTP, HTTPS, or encrypted email) protects data in transit from interception, which is required for compliance with regulations like GDPR or PCI DSS.

Answer

Send the full spreadsheet through regular email to avoid delaying the audit

Answer

Upload the spreadsheet to a public file-sharing site and protect it with a password

Answer

Compress the file with a password and reuse the same password for all auditors

Question 9

An HR analyst must send a salary file to an external auditor. The auditor only needs names, departments, and salary totals, not Social Security numbers or bank account details. Which two actions should the analyst take first? Select two.

Accepted Answer

Remove unnecessary sensitive fields before sharing. Removing unnecessary sensitive fields (like Social Security numbers and bank account details) before sharing the file reduces the risk of exposing personally identifiable information (PII) and aligns with the principle of data minimization. This step ensures that only the required data (names, departments, salary totals) is transmitted, which is a foundational security control before any data transfer occurs.

Answer

Upload the file to a public link and send the URL by email

Answer

Rename the file to a less obvious name and send it normally

Answer

Save the file locally on a USB drive and hand-deliver it

Question 10

A project team needs to use an unapproved file-sharing application for two weeks because the approved platform cannot support an external client collaboration feature. What is the best security action?

Accepted Answer

Approve a documented temporary exception with compensating controls and a review date. It follows the principle of risk acceptance through a formal exception process. By documenting a temporary exception with compensating controls (e.g., data encryption, access logging, and usage monitoring) and setting a review date, the organization maintains security oversight while addressing the legitimate business need. This approach aligns with the SY0-701 domain of Security Program Management, which emphasizes balancing security with operational requirements through managed risk.

Answer

Deny the request permanently and avoid discussing the business need

Answer

Immediately rewrite the policy so all users may use the unapproved application

Answer

Ask the team to create a detailed step-by-step procedure for using the application

Question 11

A legacy payroll server contains a critical vulnerability. The vendor says a patch is 45 days away, and the system must remain available for payroll processing. Which risk treatment is the best short-term choice?

Accepted Answer

Mitigate the risk with compensating controls such as segmentation, restricted access, and monitoring.. Compensating controls like network segmentation, strict access controls, and enhanced monitoring can reduce the risk of exploitation while keeping the legacy payroll server operational. This approach directly addresses the need for availability during the 45-day patch window, aligning with the principle of defense-in-depth for unpatched systems.

Answer

Accept the risk until the patch arrives because the server is needed for payroll processing.

Answer

Avoid the risk by permanently decommissioning the server this week.

Answer

Transfer the risk by purchasing support coverage and waiting for the patch.

Question 12

A business owner asks whether to proceed with a medium-risk issue on an internal reporting system. The vulnerability is unlikely to be exploited because the system is reachable only from a segmented admin network, and no sensitive data is stored there. The owner wants to postpone remediation until the next planned upgrade window. Which risk treatment is being chosen?

Accepted Answer

Risk acceptance, because the business is choosing to live with the remaining risk for now.. Risk acceptance is the deliberate decision to acknowledge and tolerate a risk without immediate remediation. In this scenario, the business owner understands the vulnerability is low-likelihood (segmented admin network, no sensitive data) and chooses to postpone fixing it until the next planned upgrade, thereby accepting the residual risk for that period.

Answer

Risk avoidance, because the system will be upgraded later.

Answer

Risk transfer, because the upgrade window shifts responsibility to the vendor.

Answer

Risk escalation, because the issue is being sent to the help desk for tracking.

Question 13

A hospital's claims portal has two open risks. Risk A is an internet-facing login page with a low-severity software flaw, but monitoring shows a steady increase in automated login attempts. Risk B is an internal file share with a medium-severity patch gap, but only a small admin group can access it and no exploitation is observed. Leadership can fund only one remediation this month. Which risk should be prioritized first?

Accepted Answer

Prioritize Risk A because it is exposed to the internet and already shows active attack interest.. Risk A should be prioritized because the internet-facing login page is exposed to the public attack surface, and the steady increase in automated login attempts indicates active reconnaissance or credential-stuffing attacks. Even though the software flaw is low severity, the combination of internet exposure and active attacker interest significantly elevates the likelihood of exploitation, making it a higher priority than an internal file share with no observed exploitation.

Answer

Prioritize Risk B because a medium-severity flaw is always more important than a low-severity flaw.

Answer

Accept Risk A because no confirmed compromise has occurred yet.

Answer

Transfer Risk A to an insurer because public-facing exposure cannot be reduced.

Question 14

A file contains employee Social Security numbers and bank account details. The company uses the labels Public, Internal, Confidential, and Restricted. Which label is most appropriate?

Accepted Answer

Restricted, because it contains highly sensitive personal and financial information. Social Security numbers and bank account details are classified as personally identifiable information (PII) and financial data, which are subject to strict regulatory requirements (e.g., GDPR, PCI DSS). The 'Restricted' label is designed for the most sensitive data that requires the highest level of access control and encryption, making it the correct choice for this scenario.

Answer

Public, because employees may need to share it with outside vendors

Answer

Internal, because only company staff should see it

Answer

Confidential, because the information is sensitive but not highly regulated

Question 15

A manufacturing company must keep a legacy scheduling application running for 60 days while replacement testing finishes. The application supports production orders, and the business cannot tolerate a shutdown. Which three conditions should be required before approving the temporary exception? Select three.

Accepted Answer

Assign a named risk owner who is authorized to accept the residual risk.. Assigning a named risk owner who is authorized to accept residual risk is a fundamental requirement for any risk exception. This ensures accountability and that a specific individual with the authority to accept the potential consequences of running an unsupported system is identified. Without a designated owner, the exception lacks governance and could lead to unmanaged exposure.

Answer

Rely on the vendor's promise that a better version will be available eventually.

Answer

Approve an unlimited waiver so operations do not need to revisit the issue.