SY0-701 Security Program Management and Oversight Practice Question
An HR analyst must send a salary file to an external auditor. The auditor only needs names, departments, and salary totals, not Social Security numbers or bank account details. Which two actions should the analyst take first? Select two.
⚠ Common exam trap
It's easy for candidates to think renaming a file (Option D) or using a USB drive (Option E) provides sufficient security, when in fact these methods lack encryption and proper access controls, which are essential for protecting sensitive data in transit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove unnecessary sensitive fields before sharing
Removing unnecessary sensitive fields (like Social Security numbers and bank account details) before sharing the file reduces the risk of exposing personally identifiable information (PII) and aligns with the principle of data minimization. This step ensures that only the required data (names, departments, salary totals) is transmitted, which is a foundational security control before any data transfer occurs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Remove unnecessary sensitive fields before sharing
Why this is correct
Data minimization is a core privacy control: by stripping out personally identifiable information (PII) such as Social Security numbers, bank account numbers, or performance ratings that the auditor does not need, you reduce the potential impact of any unauthorised access. This aligns with the least-privilege principle and with regulations like GDPR or CCPA that mandate processing only the minimum necessary data. Even if encryption were to fail, the exposed data is far less sensitive, making this a critical first line of defense.
- ✓
Use an approved encrypted transfer method
Why this is correct
Encrypting the file in transit with an approved method, such as TLS-protected email, SFTP, or a permission-restricted secure file-sharing portal, ensures that the salary data remains unreadable to any party that intercepts it on the network. Approved methods also provide authentication, integrity checking, and an audit trail, so you can verify that the intended auditor indeed received the file. This is a preventive confidentiality control that directly protects the data's secrecy while it is being transmitted from the organisation to the external auditor.
- ✗
Upload the file to a public link and send the URL by email
Why it's wrong here
Uploading the file to a public link exposes the salary data to anyone who obtains the URL, violating the confidentiality requirement for sensitive financial information; the correct action would use a secure, access-controlled method such as encrypted email or a permission-restricted SharePoint link. This option is tempting because public links are convenient for sharing large files with external parties when the data is non-sensitive, such as a public marketing brochure.
- ✗
Rename the file to a less obvious name and send it normally
Why it's wrong here
Renaming the file to something inconspicuous is security-by-obscurity, which provides no cryptographic protection; the file is still transmitted over the network in its original, unencrypted form if sent via normal email or FTP. An attacker who captures the packet stream can read the raw salary data regardless of the filename, and the data is also stored unprotected on both the sender's and recipient's mail servers. This option completely fails to address confidentiality, integrity, or access control, so it leaves the sensitive information fully exposed.
- ✗
Save the file locally on a USB drive and hand-deliver it
Why it's wrong here
Hand-delivering a USB drive transfers the risk from network interception to physical security: the drive can be lost, stolen, copied, or infected with malware, and unless the drive is encrypted, anyone who finds it can read the data without any authentication. It also does nothing to reduce the data set, so the auditor receives every sensitive field, and there is no auditable trail of who accessed or copied the file. Furthermore, many organisations have policies against removable media precisely because USB drives are a common vector for data breaches.
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Security control
A security control is a safeguard or countermeasure designed to protect the confidentiality, integrity, and availability of information systems and data.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.