SY0-701 Security Program Management and Oversight Practice Test 9 — 15 Questions

Question 1

A file contains employee Social Security numbers and bank account details. The company uses the labels Public, Internal, Confidential, and Restricted. Which label is most appropriate?

Accepted Answer

Restricted, because it contains highly sensitive personal and financial information. Social Security numbers and bank account details are classified as personally identifiable information (PII) and financial data, which are subject to strict regulatory requirements (e.g., GDPR, PCI DSS). The 'Restricted' label is designed for the most sensitive data that requires the highest level of access control and encryption, making it the correct choice for this scenario.

Answer

Public, because employees may need to share it with outside vendors

Answer

Internal, because only company staff should see it

Answer

Confidential, because the information is sensitive but not highly regulated

Question 2

A manufacturing company must keep a legacy scheduling application running for 60 days while replacement testing finishes. The application supports production orders, and the business cannot tolerate a shutdown. Which three conditions should be required before approving the temporary exception? Select three.

Accepted Answer

Assign a named risk owner who is authorized to accept the residual risk.. Assigning a named risk owner who is authorized to accept residual risk is a fundamental requirement for any risk exception. This ensures accountability and that a specific individual with the authority to accept the potential consequences of running an unsupported system is identified. Without a designated owner, the exception lacks governance and could lead to unmanaged exposure.

Answer

Rely on the vendor's promise that a better version will be available eventually.

Answer

Approve an unlimited waiver so operations do not need to revisit the issue.

Question 3

A development manager wants to copy a production customer database into a test environment so testers can reproduce a bug. The database contains names, addresses, and payment tokens. What is the best security practice before the copy is made?

Accepted Answer

Mask, tokenize, or replace sensitive fields with approved test data before moving it.. Copying production data containing sensitive information (names, addresses, payment tokens) into a test environment without sanitization violates data minimization and privacy principles (e.g., GDPR, PCI DSS). The best practice is to apply data masking, tokenization, or substitution with realistic but non-sensitive test data before the copy, ensuring that the test environment does not expose real customer data. This prevents accidental data leakage and reduces compliance risk while still allowing testers to reproduce the bug with functionally equivalent data.

Answer

Copy the production database unchanged and limit access to the QA team.

Answer

Compress the database export to reduce storage and transfer time.

Answer

Encrypt the database backup and give developers the decryption key.

Question 4

A cloud-hosted invoicing app has a critical vulnerability, but the vendor says a patch will not be available for six weeks. The team adds a web application firewall rule, restricts access to the app subnet, and increases monitoring until the patch arrives. What is this best described as?

Accepted Answer

Compensating control, because temporary safeguards reduce exposure until the patch is available.. The team deployed temporary security measures—a web application firewall (WAF) rule, subnet access restrictions, and enhanced monitoring—to reduce the risk exposure while waiting for the vendor's patch. These are compensating controls, which are alternative safeguards that mitigate a vulnerability when the primary control (the patch) cannot be implemented immediately. The scenario explicitly states the patch is six weeks away, making these interim measures a textbook compensating control.

Answer

Risk avoidance, because the system is being shut down permanently.

Answer

Risk transfer, because the vendor is responsible for the vulnerability.

Answer

Residual risk acceptance, because the vulnerability is being ignored until next quarter.

Question 5

An employee receives an email that appears to be from the CEO and asks for gift cards before a meeting. What should the employee do first?

Accepted Answer

Report the message through the approved security channel and verify the request by a separate method.. The first action in response to a suspected phishing or social engineering attack is to report it through the approved security channel, which ensures the incident is logged and can be investigated. Separately verifying the request—such as by calling the CEO or using a known, trusted contact method—confirms the legitimacy of the request without relying on the potentially compromised email thread. This aligns with security policy best practices for incident response and prevents unauthorized disclosure of funds or credentials.

Answer

Buy the gift cards immediately so the CEO is not delayed.

Answer

Forward the email to coworkers so they can watch for the same request.

Answer

Reply to the sender and ask for more details in the same email thread.

Question 6

A company wants every corporate laptop to use the same required screen-lock timeout, disk encryption setting, and local administrator restriction. Which document should define these mandatory settings?

Accepted Answer

A standard, because it specifies required configuration values. A standard is the correct document type because it mandates specific, measurable configuration values (e.g., screen-lock timeout of 300 seconds, AES-256 disk encryption, removal of local admin rights) that all corporate laptops must enforce. Standards are binding and establish a baseline for security compliance, unlike guidelines which are advisory. This aligns with the company's requirement for mandatory, uniform settings across all devices.

Answer

A guideline, because it offers flexible suggestions for users

Answer

A procedure, because it explains the business reason for security rules

Answer

A memo, because it is the fastest way to communicate changes

Question 7

A vendor-supported application cannot be patched for 30 days, but the business must keep it online. What is the best short-term risk treatment?

Accepted Answer

Apply a compensating control, such as restricting access and monitoring traffic. When a known vulnerability cannot be patched immediately, applying a compensating control—such as restricting network access via firewall rules (e.g., allowing only specific source IPs) and enabling deep packet inspection (DPI) or an intrusion prevention system (IPS) to monitor for exploit attempts—reduces the risk to an acceptable level without taking the application offline. This approach aligns with the principle of defense in depth, buying time until the vendor patch is available.

Answer

Accept the risk without any additional controls

Answer

Delete the application so the vulnerability no longer exists

Answer

Transfer the risk by telling users to work faster

Question 8

After a phishing simulation, many users still nearly entered credentials on the fake page. Security wants the fastest improvement without scheduling long training sessions. What is the best response?

Accepted Answer

Send a short targeted awareness message with examples, warning signs, and reporting steps.. A short targeted awareness message directly addresses the observed risky behavior with minimal time investment, providing immediate reinforcement of warning signs and reporting procedures. This approach leverages just-in-time training, which is proven to improve retention and behavior change more effectively than lengthy sessions, aligning with the goal of fastest improvement without disrupting operations.

Answer

Require a full-day classroom course for every employee immediately.

Answer

Ignore the results because no actual breach occurred.

Answer

Reset every employee password as the main way to prevent future clicks.

Question 9

A security manager wants every corporate laptop to use the same mandatory settings, including disk encryption, a 10-minute screen lock, and removal of local administrator rights. Which document should define these specific requirements?

Accepted Answer

Standard. A standard defines mandatory, specific technical requirements that must be uniformly applied across all systems, such as enforcing AES-256 disk encryption, a 600-second screen lock timeout, and removal of local administrator rights. Unlike a policy, which is high-level and goal-oriented, a standard provides the precise configuration settings that implement the policy's intent. This aligns with the CompTIA SY0-701 domain of Security Program Management and Oversight, where standards bridge the gap between policy and technical implementation.

Answer

Policy

Answer

Guideline

Answer

Procedure

Question 10

A company has two security issues to address this week. One is a public-facing login portal that uses default administrator credentials. The other is an internal lab system used only by one tester. Which issue should be prioritized first?

Accepted Answer

The public-facing login portal, because it has a higher likelihood and impact. The public-facing login portal with default administrator credentials is a critical risk because it is exposed to the internet, making it easily discoverable and exploitable by attackers. Default credentials are widely known and often targeted in automated attacks, leading to a high likelihood of compromise and potential impact such as data breach or system takeover. This aligns with risk management principles where priority is given to vulnerabilities with the highest risk score (likelihood × impact).

Answer

The internal lab system, because it is easier to fix quickly

Answer

Both issues have the same priority because they are both vulnerabilities

Answer

Neither issue should be addressed until the next annual review

Question 11

A security team wants to reduce repeated user mistakes after a phishing campaign without overwhelming employees with long training sessions. Which approach is best?

Accepted Answer

Send a short, targeted reminder to the affected users with a clear reporting path. It applies targeted, immediate reinforcement to the specific users who made mistakes, using a short reminder that clarifies the reporting path. This approach leverages just-in-time training, which has been shown to improve retention and behavior change without overwhelming employees. It directly addresses the root cause—repeated user errors—by providing a clear, actionable step (e.g., 'Report suspicious emails using the PhishAlarm button') rather than generic awareness.

Answer

Require every employee to attend a full-day security class immediately

Answer

Wait until the next annual training cycle and do nothing now

Answer

Disable email access for all employees until they pass a new test

Question 12

A department finished using paper forms that contain customer information, and the retention period has expired. What is the best next step?

Accepted Answer

Dispose of them using approved secure destruction methods. Once the retention period has expired, the organization must securely destroy the paper forms to prevent unauthorized access to customer information. Approved secure destruction methods for paper records include cross-cut shredding, incineration, or pulping, which render the data irrecoverable and comply with data protection regulations like GDPR or HIPAA.

Answer

Store them indefinitely in a cabinet for future reference

Answer

Send them to another team without checking the retention schedule

Answer

Scan them to personal email so the department can keep a copy

Question 13

A vendor says a patch for a critical flaw in a public-facing application will not be available for 30 days, but the service must stay online. What is the best short-term risk treatment?

Accepted Answer

Implement compensating controls, such as tighter filtering and temporary restrictions, until the patch is released.. When a critical patch is unavailable, the best short-term risk treatment is to implement compensating controls that reduce the likelihood or impact of exploitation. For a public-facing application, this could include deploying a web application firewall (WAF) with tighter rule sets, rate limiting, IP allowlisting, or temporarily disabling non-essential functionality. These controls provide a defense-in-depth layer until the vendor releases the patch, keeping the service online while reducing risk.

Answer

Accept the risk without making any changes because the patch is not available yet.

Answer

Avoid the risk by permanently shutting down the application.

Answer

Transfer the risk to an insurance policy and wait for the patch.

Question 14

A help desk technician receives a call from someone claiming to be a contractor whose MFA device was lost during travel. The caller knows the company org chart and asks for a new device enrollment. Which three responses are appropriate? Select three.

Accepted Answer

Refuse to bypass identity verification requirements.. Bypassing identity verification for MFA device enrollment would undermine the security that MFA provides. The caller's knowledge of the org chart does not constitute proof of identity; social engineering attacks often leverage such information. Refusing to bypass verification ensures that only authorized users can enroll new MFA tokens, maintaining the integrity of the authentication process.

Answer

Read the current MFA reset code over the phone to speed up recovery.

Answer

Enroll the new device immediately because the caller knows company names and roles.

Question 15

An employee receives an email that says, 'This is the CEO. Buy gift cards now and reply with the codes before the meeting starts.' What should the employee do?

Accepted Answer

Verify the request through an approved channel and report the message. The email exhibits classic social engineering indicators—spoofed authority, urgency, and a request for non-standard financial transactions (gift cards). The employee must verify the request through an approved communication channel (e.g., a phone call to the CEO's known number) and report the message to the security team for incident response. This aligns with security policy for phishing and business email compromise (BEC) prevention, as per NIST SP 800-61 and organizational security awareness training.

Answer

Reply with the codes because the request appears urgent

Answer

Forward the email to coworkers so they can watch for similar messages

Answer

Delete the email and ignore it without telling anyone