SY0-701 Security Program Management and Oversight Practice Question
Exhibit
Procurement review notes: - Vendor provides a desktop application for invoice reconciliation - Installer is signed, but the vendor cannot provide a software bill of materials this quarter - The application will run on 12 finance workstations only - Access will be limited to read-only invoice data from a nonproduction export - Proposed controls: application allowlisting, standard user accounts, and network segmentation - Security concern: The business wants to approve the pilot immediately
Based on the exhibit, what should the security team recommend for the finance workstation pilot?
⚠ Common exam trap
The trap here is that candidates may focus on the application being signed or read-only data access (Option A) as sufficient security, overlooking that supply-chain documentation is a foundational requirement for verifying the trustworthiness of the entire workstation, not just the application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require the vendor to provide the missing supply-chain documentation or an approved compensating-control plan before approval.
The exhibit indicates missing supply-chain documentation for the finance workstation pilot. Without this documentation, the security team cannot verify the integrity and provenance of the hardware and software, which is critical for a pilot involving sensitive financial data. Requiring the vendor to provide the missing documentation or an approved compensating-control plan ensures compliance with supply-chain risk management policies before approval.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Approve the pilot because the workstations are limited to read-only data and the application is signed.
Why it's wrong here
A signed installer and limited data scope help, but they do not remove the supply-chain visibility gap created by the missing software bill of materials. The risk still needs review and controls need to be validated.
- ✓
Require the vendor to provide the missing supply-chain documentation or an approved compensating-control plan before approval.
Why this is correct
The exhibit shows a supply-chain transparency gap, so the organization should not approve based only on convenience. Requiring the missing documentation or a documented compensating-control plan supports informed risk management and reduces the chance of approving software that cannot be adequately assessed.
- ✗
Disable segmentation so the pilot can access more systems if troubleshooting is needed.
Why it's wrong here
Disabling segmentation would widen the attack surface and permit lateral movement if the pilot workstation is compromised, directly contradicting the exhibit's blast-radius containment controls. The missing supply-chain documentation is not remediated by broader network access; in fact, the proposed segmentation is an existing compensating control that should remain enforced.
- ✗
Let the finance director sign an informal email and skip the security review.
Why it's wrong here
An informal email from the finance director is not a recognized security control or risk acceptance artifact; it lacks the audit trail, approval chain, and technical validation required to address the supply-chain visibility gap. Skipping the formal security review would leave the organization unable to verify whether acceptable compensating controls exist, and would delegate a technical risk decision to a non-technical authority without documented oversight.
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.