SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Store them indefinitely in a cabinet for future reference

  Why it's wrong here

  Retaining expired paper forms indefinitely in a cabinet directly violates the organization's records retention schedule and data minimization principles. It needlessly expands the attack surface for physical theft, unauthorized access, or accidental disclosure of customer PII/PCI data. Even if space is available, there is no legitimate business or legal justification to keep records beyond their required lifecycle, and doing so may expose the organization to compliance penalties during an audit.

• ✓

  Dispose of them using approved secure destruction methods

  Why this is correct

  Approved secure destruction methods, such as cross-cut shredding, incineration, or pulping, render customer paper records unreadable and non-recoverable before disposal. The organization should follow its records retention policy to confirm the records are eligible for destruction and then execute the disposal through a vetted process, often documenting it with a certificate of destruction. This minimizes the risk of dumpster diving or forensic reconstruction and satisfies both internal governance and regulatory requirements.

• ✗

  Send them to another team without checking the retention schedule

  Why it's wrong here

  Handing expired customer forms to another team without consulting the retention schedule bypasses the mandatory disposition controls that determine whether records should be archived, transferred, or destroyed. If the records are already past their retention period, the only compliant action is secure disposal, not continued circulation among internal departments. Furthermore, an undocumented handoff creates no audit trail, making it impossible to prove that the records were handled according to policy and leaving the department unable to demonstrate accountability if the data later surfaces inappropriately.

• ✗

  Scan them to personal email so the department can keep a copy

  Why it's wrong here

  Scanning the finished paper forms to a personal email account moves customer data outside the enterprise's secured email infrastructure and approved retention repositories, creating an unauthorized and unmanaged copy. Personal email services typically lack the required encryption, access controls, and audit logging needed to protect sensitive customer information, so any subsequent account compromise could expose the data in this document. This action also defeats the purpose of disposition, because it preserves the records indefinitely in an unapproved location rather than destroying them according to policy.