Question 144 of 1,152

Security Program Management and Oversight →mediumMultiple ChoiceObjective-mapped

Quick Answer

The correct answer is to provide only the minimum fields required and remove the government ID numbers. This response directly applies the principles of data minimization and least privilege, ensuring that the marketing team receives only the personally identifiable information (PII) essential for building a campaign list—such as names and email addresses—while excluding sensitive data like government ID numbers that pose unnecessary risk. On the Security+ SY0-701 exam, this scenario tests your understanding of how to balance business needs with data protection regulations like GDPR or CCPA, often appearing as a scenario where an overreaching request for PII must be denied. A common trap is assuming any requested data is acceptable if the requester has a legitimate role, but the key is that least privilege limits access to only what is strictly necessary for the task. Memory tip: “Minimize the fields, maximize the shield”—always strip out high-risk PII like IDs before sharing data for marketing.

SY0-701 Security Program Management and Oversight Practice Question

This SY0-701 practice question tests your understanding of security program management and oversight. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A marketing analyst asks for a spreadsheet containing customer names, email addresses, purchase history, and government ID numbers so the team can build a campaign list. What is the BEST security response?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

Question 1mediummultiple choice

Full question →

A
Approve the request because the data is needed for any marketing activity.
Why wrong: Need alone is not enough when highly sensitive personal data is requested; the organization must limit collection and sharing to what is necessary.
B
Provide only the minimum fields required and remove the government ID numbers.
This follows data minimization and handling requirements by sharing only what is necessary for the business purpose. Government ID numbers are highly sensitive and are not needed for a typical marketing campaign. Limiting the dataset reduces privacy exposure, lowers compliance risk, and helps ensure the data is used appropriately.
C
Send the full file, but ask the analyst not to store it permanently.
Why wrong: A verbal instruction does not control the exposure created by sharing unnecessary sensitive data in the first place.
D
Classify the file as public so it can be shared more easily with the marketing team.
Why wrong: Reclassifying sensitive personal data as public would violate handling requirements and create unnecessary privacy risk.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Provide only the minimum fields required and remove the government ID numbers.

The best security response is to apply the principle of least privilege and data minimization. Government ID numbers are sensitive personally identifiable information (PII) that are not necessary for building a marketing campaign list; providing only the minimum required fields (e.g., names and email addresses) reduces the risk of exposure and complies with data protection regulations like GDPR or CCPA.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Approve the request because the data is needed for any marketing activity.
Why it's wrong here
Need alone is not enough when highly sensitive personal data is requested; the organization must limit collection and sharing to what is necessary.
✓
Provide only the minimum fields required and remove the government ID numbers.
Why this is correct
This follows data minimization and handling requirements by sharing only what is necessary for the business purpose. Government ID numbers are highly sensitive and are not needed for a typical marketing campaign. Limiting the dataset reduces privacy exposure, lowers compliance risk, and helps ensure the data is used appropriately.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Send the full file, but ask the analyst not to store it permanently.
Why it's wrong here
A verbal instruction does not control the exposure created by sharing unnecessary sensitive data in the first place.
✗
Classify the file as public so it can be shared more easily with the marketing team.
Why it's wrong here
Reclassifying sensitive personal data as public would violate handling requirements and create unnecessary privacy risk.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates may think 'asking not to store it permanently' is a sufficient control, but the SY0-701 exam emphasizes that administrative controls without technical enforcement (like DLP policies or data classification labels) are ineffective against data leakage.

Detailed technical explanation

How to think about this question

Data minimization is a core principle of privacy frameworks like the NIST Privacy Framework and GDPR Article 5(1)(c), which require that personal data be adequate, relevant, and limited to what is necessary. In practice, this means using attribute-based access control (ABAC) or role-based access control (RBAC) to restrict fields in exported datasets, and applying data masking or tokenization for fields like government ID numbers. A real-world scenario is a marketing team accidentally exposing a full customer database with SSNs because they were given unnecessary fields, leading to mandatory breach notifications and fines.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A SOC analyst notices unusual lateral movement in the network at 2 AM. The IR playbook dictates: identify and contain (isolate the affected machine), then eradicate (remove the malware), then recover (restore from backup), then document. Skipping containment before eradication risks the attacker regaining access. Questions like this test the sequence and rationale of incident response phases.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related SY0-701 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

General Security Concepts practice questions

Practise SY0-701 questions linked to General Security Concepts.

Threats, Vulnerabilities, and Mitigations practice questions

Practise SY0-701 questions linked to Threats, Vulnerabilities, and Mitigations.

Security Architecture practice questions

Practise SY0-701 questions linked to Security Architecture.

Security Operations practice questions

Practise SY0-701 questions linked to Security Operations.

Security Program Management and Oversight practice questions

Practise SY0-701 questions linked to Security Program Management and Oversight.

Security+ social engineering questions

Practise SY0-701 questions linked to Security+ social engineering questions.

Security+ cryptography practice questions

Practise SY0-701 questions linked to Security+ cryptography.

Security+ IAM questions

Practise SY0-701 questions linked to Security+ IAM questions.

Security+ risk management questions

Practise SY0-701 questions linked to Security+ risk management questions.

Security+ incident response questions

Practise SY0-701 questions linked to Security+ incident response questions.

Security+ malware questions

Practise SY0-701 questions linked to Security+ malware questions.

Security+ vulnerability management questions

Practise SY0-701 questions linked to Security+ vulnerability management questions.

Practice this exam

Start a free SY0-701 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

SY0-701 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SY0-701 question test?

Security Program Management and Oversight — This question tests Security Program Management and Oversight — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Provide only the minimum fields required and remove the government ID numbers. — The best security response is to apply the principle of least privilege and data minimization. Government ID numbers are sensitive personally identifiable information (PII) that are not necessary for building a marketing campaign list; providing only the minimum required fields (e.g., names and email addresses) reduces the risk of exposure and complies with data protection regulations like GDPR or CCPA.

What should I do if I get this SY0-701 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.