SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Approve the vendor because the primary provider already passed the initial review.

  Why it's wrong here

  Approving the vendor solely because it passed an initial review is insufficient because that review assessed the original service model, not the newly introduced subcontractor. In vendor risk management, a material change such as adding a subcontractor invalidates the prior assessment and creates a new attack surface for payroll data. The initial review's conclusions cannot be extended to an unvetted downstream party, which may have different security controls, legal obligations, or data-handling practices. Security must re-evaluate the entire supply chain before granting continued approval.

• ✓

  Update the third-party risk assessment and require evidence of the subcontractor's controls before approval.

  Why this is correct

  This is the best next step because the change in subcontracting materially alters the risk profile. Security should reassess the provider, review the downstream party's controls, and confirm contractual obligations such as incident notification, data handling, and location requirements. This balances speed with due diligence and ensures the organization has current evidence before customer data is exposed to a new party.

• ✗

  Wait until the first quarterly audit to review the subcontractor change.

  Why it's wrong here

  Waiting until the first quarterly audit before reviewing the subcontractor change leaves a window of unmonitored risk, and in that interval the subcontractor will already be processing sensitive payroll data. Third-party risk must be assessed before the new relationship becomes operational, not after the fact, because an adverse security event could occur before any audit catches it. The principle is that risk is accepted the moment data is shared, so due diligence must precede data sharing. Deferring review converts a controllable decision into an incident-response scenario.

• ✗

  Accept the change if the vendor provides a marketing brochure describing its security program.

  Why it's wrong here

  A marketing brochure is not evidence of control effectiveness because it is promotional material with no independent verification of the subcontractor's actual security posture. Accepting it would bypass the requirement for verifiable documentation such as SOC 2 Type II reports, ISO 27001 certificates, or evidence of penetration testing. Marketing claims may highlight capabilities while omitting known weaknesses or incidents. The organization needs objective, third-party attestation to make an informed approval decision.

Go deeper

Related to this question