SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Share the spreadsheet, because the request is from another employee inside the company.

  Why it's wrong here

  Although the requester is an internal employee, employment status alone never confers a blanket right to view sensitive personal data. Home addresses are classified as personally identifiable information (PII) and are typically protected by organizational data-handling policies, employment agreements, and privacy regulations such as GDPR or CCPA. Before sharing, you must verify that the requester has an approved business purpose, a signed authorization, and a genuine need-to-know under the principle of least privilege. Unauthorized internal disclosure still constitutes a data breach and can expose the organization to legal liability and insider-threat risk.

• ✓

  Confirm the requester is authorized and only provide the minimum personal data allowed by policy.

  Why this is correct

  The best response is to verify authorization and limit the data shared to the minimum needed. Privacy and data-handling rules often restrict personal information such as home addresses and personal phone numbers. Even internal requests should follow approved business purpose, least privilege, and data minimization principles before any disclosure occurs.

• ✗

  Email the full spreadsheet, because internal data is not protected by privacy rules.

  Why it's wrong here

  Emailing the full spreadsheet is wrong because internal data is absolutely subject to privacy and security controls. Home addresses and other personal details qualify as PII, and many jurisdictions (e.g., GDPR, PIPL, or state breach laws) regulate how such data may be processed, even within an organization. Additionally, sending the complete file violates the data minimization principle by exposing unrelated employees' information when only a subset may be needed. Email is also an insecure transport channel that could be intercepted or forwarded, compounding the confidentiality risk.

• ✗

  Delete the spreadsheet immediately so the information cannot be misused.

  Why it's wrong here

  Deleting the spreadsheet without following procedure is an improper response to a legitimate access request. Records retention policies and potential legal holds may require preserving the file, and destruction could obstruct an authorized business need or investigation. The correct approach is to assess the request through the official access-control process, verify the requester's authorization, and release only the minimum data necessary. Erasing data preemptively also prevents audit logging and accountability, making it harder to demonstrate compliant handling if the decision is later reviewed.

Go deeper

Related to this question