SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Approve the request because the data is needed for any marketing activity.

  Why it's wrong here

  Need alone is not a sufficient justification; data minimization requires assessing the specific business purpose, and marketing does not inherently require government ID numbers. Granting blanket access to all customer data without a legitimate purpose limitation violates privacy principles such as NIST SP 800-122 and GDPR data minimization, and it expands the organization's attack surface. The request should be evaluated against the minimum necessary standard, not simply because the requester is a marketing analyst.

• ✓

  Provide only the minimum fields required and remove the government ID numbers.

  Why this is correct

  This follows data minimization and handling requirements by sharing only what is necessary for the business purpose. Government ID numbers are highly sensitive and are not needed for a typical marketing campaign. Limiting the dataset reduces privacy exposure, lowers compliance risk, and helps ensure the data is used appropriately.

• ✗

  Send the full file, but ask the analyst not to store it permanently.

  Why it's wrong here

  A verbal instruction to not permanently store the file does not constitute a technical or administrative control; once the full dataset is transmitted, the recipient possesses all sensitive fields and the organization loses control over copying, forwarding, or accidental exposure. Prohibiting permanent storage does not mitigate the immediate risk of redundant data residing in email inboxes, temporary downloads, or analytics pipelines, nor does it address the unnecessary inclusion of government IDs. Instead, the data must be minimized at the source before any sharing occurs, with technical protections such as encryption and access logging in place.

• ✗

  Classify the file as public so it can be shared more easily with the marketing team.

  Why it's wrong here

  Reclassifying customer personally identifiable information from internal or restricted to public would authorize broader access and undermine the data classification requirements established in the organization's security policy. Public classification removes the need for access controls and encryption, potentially exposing the data to unauthorized individuals and violating legal data protection obligations. This action increases the likelihood of a breach and is not an appropriate way to facilitate an internal marketing request.