SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Send the full spreadsheet through regular email to avoid delaying the audit

  Why it's wrong here

  Sending the full spreadsheet over ordinary email exposes the auditor to an unnecessarily broad set of personal identifiers (for example, SSNs, addresses, account numbers) beyond the audit scope, violating the data minimization principle. Email transmissions are typically not encrypted end-to-end and may be stored in plaintext on mail servers, proxy logs, or backup archives, increasing the risk of unauthorized access or accidental forwarding. It also leaves no granular access control or audit trail over the copy, so the organization cannot track who read it or revoke access after the audit.

• ✓

  Redact unneeded personal data and transfer only the minimum necessary information through an approved encrypted channel

  Why this is correct

  This is the best privacy control because it applies data minimization and secure transmission together. The auditor receives only what is needed to complete the review, which reduces exposure of personal information and limits the blast radius if the file is mishandled. Using an approved encrypted channel also helps protect the data in transit and supports governance requirements.

• ✗

  Upload the spreadsheet to a public file-sharing site and protect it with a password

  Why it's wrong here

  A public sharing site creates unnecessary exposure and can bypass normal security monitoring. A password alone is not enough if the link is shared too broadly or the site is not approved for sensitive data.

• ✗

  Compress the file with a password and reuse the same password for all auditors

  Why it's wrong here

  Password-protected ZIP files often rely on the legacy ZipCrypto algorithm, which is vulnerable to known-plaintext and ciphertext-only attacks unless the archive is re-encrypted with a strong AES implementation; additionally, the decryption password must be shared out-of-band, creating an extra exposure path. Reusing the same password for all auditors eliminates individual accountability, and revoking one auditor's access requires re-encrypting the entire file and reissuing credentials to everyone. This approach also fails to reduce the volume of personal data in the archive, so the underlying privacy risk remains even if the encryption held.