SY0-701 Security Program Management and Oversight Practice Question
A project team must share a spreadsheet containing customer names, account numbers, and purchase history with an external auditor. The auditor only needs account numbers and totals. What is the best privacy control?
⚠ Common exam trap
Many exam-takers think password-protecting a file or using a public sharing site is sufficient, but the exam tests the understanding that data minimization and approved encrypted channels are required for privacy compliance, not just any form of access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Redact unneeded personal data and transfer only the minimum necessary information through an approved encrypted channel
It applies the principle of data minimization and secure transmission. Redacting unneeded personal data (customer names) ensures only the minimum necessary information (account numbers and totals) is shared, reducing exposure. Transferring via an approved encrypted channel (e.g., SFTP, HTTPS, or encrypted email) protects data in transit from interception, which is required for compliance with regulations like GDPR or PCI DSS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Send the full spreadsheet through regular email to avoid delaying the audit
Why it's wrong here
Sending the full spreadsheet over ordinary email exposes the auditor to an unnecessarily broad set of personal identifiers (for example, SSNs, addresses, account numbers) beyond the audit scope, violating the data minimization principle. Email transmissions are typically not encrypted end-to-end and may be stored in plaintext on mail servers, proxy logs, or backup archives, increasing the risk of unauthorized access or accidental forwarding. It also leaves no granular access control or audit trail over the copy, so the organization cannot track who read it or revoke access after the audit.
- ✓
Redact unneeded personal data and transfer only the minimum necessary information through an approved encrypted channel
Why this is correct
This is the best privacy control because it applies data minimization and secure transmission together. The auditor receives only what is needed to complete the review, which reduces exposure of personal information and limits the blast radius if the file is mishandled. Using an approved encrypted channel also helps protect the data in transit and supports governance requirements.
- ✗
Upload the spreadsheet to a public file-sharing site and protect it with a password
Why it's wrong here
A public sharing site creates unnecessary exposure and can bypass normal security monitoring. A password alone is not enough if the link is shared too broadly or the site is not approved for sensitive data.
- ✗
Compress the file with a password and reuse the same password for all auditors
Why it's wrong here
Password-protected ZIP files often rely on the legacy ZipCrypto algorithm, which is vulnerable to known-plaintext and ciphertext-only attacks unless the archive is re-encrypted with a strong AES implementation; additionally, the decryption password must be shared out-of-band, creating an extra exposure path. Reusing the same password for all auditors eliminates individual accountability, and revoking one auditor's access requires re-encrypting the entire file and reissuing credentials to everyone. This approach also fails to reduce the volume of personal data in the archive, so the underlying privacy risk remains even if the encryption held.
Go deeper
Related to this question
Learn chapter
Compliance and Regulatory Frameworks
Key term
GDPR
The General Data Protection Regulation (GDPR) is a European Union law that sets strict rules for how organizations collect, store, process, and protect the personal data of individuals within the EU.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.