SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Export the full dataset and restrict access with a shared password

  Why it's wrong here

  Exporting the full dataset with a shared password does not reduce the volume of exposed personal data and provides no individual accountability, as everyone uses the same credential. A password alone is a weak and easily shared access control, failing to support data minimization or privacy requirements. The support team should instead de-identify unnecessary identifiers, ensuring the export contains only relevant non-sensitive information.

• ✓

  Remove or tokenize unneeded personal identifiers before export

  Why this is correct

  Removing or tokenizing unneeded personal identifiers before export directly implements data minimization and privacy-by-design, ensuring that only the minimum necessary information leaves the production environment. Tokenization replaces sensitive values with random placeholders that retain data format or logic for testing while preventing the recovery of original personal data without access to the token mapping. This significantly reduces the risk of unintended exposure and aligns with data protection regulations like GDPR and HIPAA.

• ✗

  Keep the data unchanged because the test environment is internal

  Why it's wrong here

  The belief that an internal test environment makes unchanged data acceptable is false because insider threats, misconfigured environments, or future re-purposing can still expose personal information. Data protection laws apply regardless of where data resides, and copying production data to an internal test environment without sanitization violates the principle of purpose limitation. The team should generate synthetic or masked test data that preserves realistic relationships without carrying actual personal identifiers.

• ✗

  Store the export indefinitely because development data is exempt from retention rules

  Why it's wrong here

  Development data is not automatically exempt from retention rules, and indefinite storage of exported customer tickets creates a larger attack surface and increases the duration of compliance obligations. Most regulations explicitly require personal data not be kept longer than necessary, with retention schedules applying equally to dev, test, or staging environments. The support team should apply the company's data retention policy to the export, establishing a defined deletion window and auditing its lifecycle.