SY0-701 Security Program Management and Oversight Practice Question
An HR manager wants to share employee data with a benefits analytics vendor. The dataset includes names, employee IDs, home addresses, and medical leave codes. Security wants to reduce privacy exposure while still allowing the vendor to complete the analysis. What is the best first step?
⚠ Common exam trap
Test-takers frequently assume a legal agreement (Option A) or confidentiality marking (Option C) is sufficient for data protection, but CompTIA emphasizes that technical controls like data minimization and pseudonymization are the first and most effective steps to reduce privacy exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Provide only the minimum necessary fields and replace direct identifiers with project IDs
It implements data minimization, a core privacy principle, by providing only the minimum necessary fields and replacing direct identifiers (names, employee IDs) with project-specific pseudonyms. This reduces exposure of personally identifiable information (PII) while preserving the vendor's ability to perform analytics on the medical leave codes and other non-identifying data. It aligns with the CompTIA SY0-701 objective of applying privacy-enhancing techniques like anonymization and data masking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Send the full file as-is if the vendor agrees not to disclose it
Why it's wrong here
Sending the full file as-is because the vendor agrees not to disclose it relies solely on a contractual promise, which does not reduce the actual exposure of sensitive personal data. If the file is intercepted, leaked, or mishandled by the vendor's insiders, all direct identifiers and full datasets are compromised. Agreements are a weak safeguard compared to technical controls; they cannot prevent breaches, only provide after-the-fact recourse. The principle of least privilege demands that data sharing be minimized regardless of contractual assurances.
- ✓
Provide only the minimum necessary fields and replace direct identifiers with project IDs
Why this is correct
Providing only the minimum necessary fields and replacing direct identifiers with project IDs is a data minimization and pseudonymization technique. It reduces the amount of personal data exposed and lowers re-identification risk, while the vendor can still fulfill the benefits processing purpose. This aligns with privacy frameworks like GDPR's data minimization principle and HIPAA's minimum necessary standard, and is far stronger than relying on promises or labeling.
- ✗
Keep the names but mark the spreadsheet confidential before sending it
Why it's wrong here
Keeping the names but marking the spreadsheet confidential before sending it merely adds a label, which is a handling instruction and not a technical protection. The file still contains all direct identifiers and any unnecessary fields, so the vendor receives the full sensitive dataset. Confidentiality markings do not encrypt data, restrict access, or prevent accidental disclosure; they only signal that the recipient should be careful, which is insufficient for protecting employee PII. This approach fails to address the root problem of over-sharing personal data.
- ✗
Upload the file to a public cloud folder and restrict the link to the vendor
Why it's wrong here
Uploading the file to a public cloud folder and restricting the link to the vendor is insecure because a public folder relies on the secrecy of a URL for access control, and that URL can be forwarded, leaked, or indexed. There is no strong authentication beyond possession of the link, so anyone who obtains it can access the data. Additionally, this expands the attack surface by placing sensitive data in a public-facing environment, and it does not involve any minimization or pseudonymization. A proper solution would use authenticated, encrypted access controls and data-sharing agreements, not a shared link.
Go deeper
Related to this question
Learn chapter
Risk Assessment and Analysis
Key term
PII
PII stands for Personally Identifiable Information, which is any data that can be used to identify a specific individual.
Key term
IDS
An IDS is a security system that monitors network or system traffic for suspicious activity and alerts administrators to potential threats, but does not actively block them.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.