CCNA Security Program Management and Oversight Questions — Page 2 of 3

Multi-Selecteasy

A help desk team is writing a procedure for resetting MFA after a user loses a phone. Which two details belong in the procedure rather than in the policy? Select two.

Select 2 answers

A.The exact step-by-step verification process the technician must follow

B.The specific screen clicks or tool used to reset the MFA device

C.A statement that all employees must use MFA to access company systems

D.A general goal of protecting accounts from unauthorized access

E.A broad rule that users should protect company credentials

AnswersA, B

The exact step-by-step verification process is the core of any standard operating procedure. For MFA resets, this includes verifying the user's identity via a secondary channel (e.g., manager approval, knowledge-based verification) and enumerating the sequence of admin console actions. This specificity ensures that any technician performs the reset identically, minimizing risk of unauthorized changes and creating an auditable trail.

Why this answer

A procedure must contain the exact step-by-step verification process the technician follows to confirm the user's identity before resetting MFA. This operational detail ensures consistency and security, whereas a policy would only state the high-level requirement (e.g., 'verify identity'). Without precise steps, technicians might skip critical checks, leading to unauthorized MFA resets.

Exam trap

The trap here is confusing policy (broad rules and goals) with procedure (specific, actionable steps), leading candidates to select high-level statements like 'all employees must use MFA' instead of the detailed verification and tool-specific steps that actually belong in a procedure.

Practice this question →

MCQmedium

A vulnerability scan identifies four issues across a small company. Which item should the operations team remediate first?

A.A critical flaw on a disconnected training laptop that is used only in the lab

B.A high-severity flaw on an internet-facing customer portal with public exploit code available

C.A medium-severity flaw on an internal print server that stores no sensitive data

D.A low-severity flaw on an archive server scheduled for retirement next month

AnswerB

This is the best choice because risk is driven by both likelihood and impact. An internet-facing system with public exploit code has a much higher chance of being attacked, and a customer portal can affect sensitive data and business operations. Even if another issue has a higher severity label, exposure and active exploitability make this item the most urgent business risk.

Why this answer

The internet-facing customer portal with a high-severity flaw and public exploit code presents the highest risk to the organization. The combination of high attack surface (exposed to the internet), high severity, and readily available exploit code means an attacker can easily compromise the system, leading to data breach, financial loss, or reputational damage. Remediation prioritization should follow risk-based principles, where likelihood and impact are both high.

Exam trap

The trap here is that candidates often focus solely on the severity score (critical vs. high) without considering the attack surface and exploitability, leading them to pick the critical flaw on the isolated laptop instead of the high-severity flaw on the internet-facing system.

How to eliminate wrong answers

Option A is wrong because a disconnected training laptop used only in a lab has no network connectivity, so the critical flaw cannot be exploited remotely; the risk is effectively zero until it is reconnected, making it a lower priority. Option C is wrong because a medium-severity flaw on an internal print server that stores no sensitive data has limited impact and a lower attack surface (internal only), so it does not warrant immediate remediation over an internet-facing high-severity issue. Option D is wrong because a low-severity flaw on an archive server scheduled for retirement next month poses minimal risk, and the server's impending decommissioning means the flaw will be eliminated soon without active remediation.

Practice this question →

Multi-Selectmedium

HR needs to share a copy of employee records with a benefits contractor for testing. The contractor only needs names and coverage selections, not Social Security numbers or bank details. Which two actions best satisfy data handling requirements? Select two.

Select 2 answers

A.Redact or mask unnecessary sensitive fields before sharing the file.

B.Send the full employee record set because the contractor is trusted.

C.Restrict access to the file to approved HR and project staff only.

D.Upload the file to a public collaboration site so the contractor can retrieve it easily.

E.Keep an unrestricted copy on multiple shared drives for convenience.

AnswersA, C

Redaction or masking is a foundational data-minimization control that replaces or removes sensitive fields such as SSNs, bank details, and medical information before any external sharing. This reduces the potential impact of unauthorized disclosure because even if the file is leaked, the exposed data is not sensitive. It also aligns with privacy regulations like GDPR and HIPAA, which require using the minimum necessary data for a given purpose.

Why this answer

Redacting or masking sensitive fields like Social Security numbers and bank details ensures that the contractor receives only the necessary data (names and coverage selections) while protecting personally identifiable information (PII). This aligns with the principle of data minimization and compliance with regulations such as GDPR or HIPAA, which require that only the minimum necessary data be shared for a specific purpose. Masking techniques, such as replacing SSNs with placeholders or applying irreversible hashing, prevent unauthorized exposure even if the file is intercepted.

Exam trap

The trap here is that candidates may assume trust (option B) or convenience (option D or E) justifies sharing full data, but the exam emphasizes that data handling requirements always mandate minimizing exposure and enforcing access controls regardless of trust level.

Practice this question →

Multi-Selectmedium

A business unit asks for a 30-day exception to use an unsupported browser plug-in on two engineering workstations while a replacement is tested. Which three conditions should be required before approval? Select three.

Select 3 answers

A.A documented business justification for why the plug-in is still needed.

B.A defined expiration date and review point before the exception can be extended.

C.A compensating control such as isolating the workstations from the general user network.

D.An open-ended waiver so the team can continue if testing slips.

E.Verbal approval only, with no written record.

AnswersA, B, C

It demonstrates that the exception is not merely for convenience but addresses a genuine operational need, tying the risk acceptance to a specific business outcome. Without this, the exception lacks context for risk owners to evaluate whether the temporary risk is worth taking, and it fails the requirement for risk acceptance to be an informed decision. This documentation also provides the basis for the review at expiration, showing whether the need still exists.

Why this answer

A documented business justification ensures that the exception is necessary and aligns with organizational risk appetite. Without a clear reason, the exception could be granted for convenience rather than critical need, undermining security governance. This justification also provides an audit trail for why an unsupported, potentially vulnerable plug-in is still in use.

Exam trap

The trap here is that candidates might think only one or two conditions are sufficient, but CompTIA expects all three—justification, expiration, and compensating controls—to be required for a valid exception approval.

Practice this question →

MCQmedium

Based on the exhibit, what is the best governance action before the sales team uses the legacy portal without MFA?

A.Update the policy immediately to allow password-only access for all legacy systems.

B.Create a formal time-bound exception with compensating controls, approval, and an expiration date.

C.Have the help desk approve the request informally in the ticket and proceed without further documentation.

D.Ignore the MFA requirement because the portal is owned by a trusted partner.

AnswerB

A formal exception preserves the existing policy while allowing a documented, limited deviation for business need. It should include a risk owner approval, compensating controls such as stricter monitoring or network restrictions, and a review or expiration date so the exception does not become permanent.

Why this answer

Governance requires that any exception to a security policy (such as bypassing MFA) must be formally documented, approved by management, time-bound, and include compensating controls to mitigate risk. In this scenario, the legacy portal lacks MFA support, so a formal exception with an expiration date ensures the risk is tracked and re-evaluated, rather than permanently weakening security posture.

Exam trap

CompTIA often tests the distinction between an informal workaround and a formal governance process, trapping candidates who think a quick approval or policy change is sufficient without understanding the need for documented risk acceptance and compensating controls.

How to eliminate wrong answers

Option A is wrong because immediately updating the policy to allow password-only access for all legacy systems would permanently weaken the security baseline and violate the principle of least privilege, rather than addressing the specific legacy portal issue with a controlled exception. Option C is wrong because informal help desk approval without documentation bypasses audit trails and accountability, failing to meet governance requirements for risk acceptance and compliance. Option D is wrong because ignoring the MFA requirement simply because the portal is owned by a trusted partner disregards the principle of defense in depth and assumes trust without verification, which is a common security failure.

Practice this question →

Multi-Selecthard

An accounts payable specialist receives an email inside an existing vendor thread that asks for a last-minute bank-account change before a payment run. The wording is professional, the signature matches, and the request is urgent. Which three actions should the specialist take? Select three.

Select 3 answers

A.Verify the request through a known out-of-band contact method for the vendor.

B.Pause the payment and require secondary approval before any bank details are updated.

C.Report the message through the security and vendor-validation process.

D.Reply in the same thread because the address and signature look legitimate.

E.Process the change immediately to avoid delaying the vendor relationship.

AnswersA, B, C

A compromised email thread is fully controlled by the attacker, so any reply or embedded link stays within an untrusted channel. Using a known out-of-band method—such as a phone number previously documented in the vendor master file, or a secure portal that was already established—creates a second, independent channel the attacker cannot intercept or modify. This directly defeats business email compromise (BEC) by verifying the authenticity of the bank detail change before any sensitive update is executed.

Why this answer

Verifying the request through a known out-of-band contact method (e.g., a phone call to a previously documented vendor number) directly mitigates the risk of business email compromise (BEC). Attackers often hijack or spoof legitimate email threads, so in-band verification (replying within the thread) is unreliable. This aligns with the principle of dual control and independent verification for sensitive financial changes.

Exam trap

The trap here is that candidates assume a professional-looking email with a matching signature is sufficient proof of authenticity, overlooking that BEC attacks can perfectly replicate these details within a compromised thread.

Practice this question →

MCQeasy

HR needs to send a benefits contractor a file for testing, but the contractor only needs employee names and plan selections. What is the best action before sharing the file?

A.Send the full file because the contractor is trusted

B.Remove all fields the contractor does not need for the task

C.Post the file to a public collaboration site with a password

D.Rename the file so the contents are harder to identify

AnswerB

Removing fields that are irrelevant to the testing task enforces data minimization and least privilege: the contractor gets only the attributes necessary to validate the file format, calculations, or logic, with no residual PII. This directly reduces the impact of any potential breach and helps satisfy privacy regulations (e.g., HIPAA, GDPR, or state data protection laws) that mandate limiting collection and disclosure. In practice, you might also replace identifiers with synthetic values, but field removal is the minimal, targeted control.

Why this answer

Data minimization is a core security principle: you should only share the minimum necessary data for the task. By removing all fields the contractor does not need (e.g., Social Security numbers, addresses, salary data), you reduce the attack surface and limit exposure of sensitive personally identifiable information (PII) in case of a breach or misuse.

Exam trap

The trap here is that candidates confuse trust with security, assuming a trusted third party eliminates the need for data minimization, when in reality least privilege applies regardless of trust level.

How to eliminate wrong answers

Option A is wrong because trust does not eliminate risk; a trusted contractor could still have a compromised endpoint or accidentally expose the full file, violating the principle of least privilege. Option C is wrong because posting the file to a public collaboration site, even with a password, exposes it to cloud storage risks (e.g., misconfigured permissions, password sharing, or brute-force attacks) and violates data minimization. Option D is wrong because renaming the file does not remove sensitive data; it only obscures the filename, leaving all sensitive fields intact and accessible if the file is opened.

Practice this question →

MCQmedium

A development team needs to release a security fix to a customer portal, but the change must not introduce a new outage or bypass review controls. Which practice best supports a secure and repeatable release?

A.Apply the change directly in production so users get the fix immediately

B.Use an approved pipeline with peer review, automated testing, and rollback steps

C.Skip testing because security fixes should always be deployed quickly

D.Let any on-call developer approve and deploy without documentation

AnswerB

An approved pipeline that enforces peer review, automated testing, and rollback steps aligns with secure change and release management: the code is built once into an immutable artifact, tested automatically against unit, integration, and security regression suites, and deployed in a controlled manner with rollback procedures defined in advance. This reduces the probability of introducing new vulnerabilities while ensuring that, if an issue occurs, the team can rapidly restore service. It also provides a full audit trail for compliance and accountability.

Why this answer

An approved pipeline with peer review, automated testing, and rollback steps ensures that the security fix is deployed in a controlled, repeatable manner. This approach prevents unauthorized changes, validates the fix through testing, and provides a safety net via rollback, directly addressing the requirement to avoid new outages and bypass review controls.

Exam trap

The trap here is that candidates may confuse 'speed' with 'security' and choose direct production deployment (Option A) or skipping testing (Option C), failing to recognize that a controlled pipeline with rollback is the only way to meet both the security and reliability requirements simultaneously.

How to eliminate wrong answers

Option A is wrong because applying the change directly in production bypasses all review and testing controls, violating the requirement to avoid outages and maintain oversight. Option C is wrong because skipping testing for security fixes increases the risk of introducing new vulnerabilities or breaking functionality, contradicting the need for a secure and repeatable release. Option D is wrong because allowing any on-call developer to approve and deploy without documentation eliminates peer review and traceability, undermining change management and audit requirements.

Practice this question →

MCQmedium

A records manager learns that emails related to a harassment investigation are scheduled for deletion next week under the retention policy. Legal issues a hold because the case may go to court. What should the records manager do?

A.Delete the emails after creating a summary report

B.Archive the emails permanently in the same mailbox

C.Suspend deletion until the legal hold is lifted

D.Anonymize the sender names and keep the messages

AnswerC

A legal hold overrides the retention schedule, so the records manager must suspend deletion of the relevant emails until the hold is lifted. Destroying them would constitute spoliation of evidence in the pending harassment case.

Why this answer

A legal hold overrides standard retention policies because it preserves electronically stored information (ESI) that may be relevant to litigation. The records manager must immediately suspend deletion to avoid spoliation, which could result in legal sanctions. This aligns with the eDiscovery process and the duty to preserve evidence once litigation is reasonably anticipated.

Exam trap

CompTIA often tests the distinction between retention policies (which automate deletion based on time) and legal holds (which override those policies to preserve evidence), and the trap here is assuming that a summary report or anonymization satisfies legal preservation requirements when only a full suspension of deletion is acceptable.

How to eliminate wrong answers

Option A is wrong because deleting the emails after creating a summary report destroys the original ESI, which may be required as native evidence in court; a summary is not a substitute for the original messages. Option B is wrong because archiving emails permanently in the same mailbox does not prevent them from being overwritten or altered by normal mailbox operations, and it does not implement a proper legal hold that preserves the data in a forensically sound manner. Option D is wrong because anonymizing sender names alters the evidence, potentially destroying metadata and context needed for the investigation and violating the integrity of the ESI under legal hold requirements.

Practice this question →

MCQmedium

A security manager at a healthcare organization is responsible for maintaining the information security policy. A project manager requests a policy exception to use a cloud-based analytics platform that stores patient data. The platform currently encrypts data at rest with AES-128 instead of the required AES-256. The security manager assesses the risk and determines that the likelihood of data exposure is low due to other compensating controls already in place, but the impact would be high. The residual risk is within the organization's risk appetite. Which of the following is the most appropriate action for the security manager to take?

A.Deny the exception and require the project to use an approved platform that meets the AES-256 requirement.

B.Approve the exception and document the compensating controls and a review date.

C.Accept the risk and allow the project to proceed without a formal exception.

D.Escalate the request to the chief information officer for a final decision.

AnswerB

This is correct because a formal exception process with documented compensating controls and a scheduled review ensures that the risk is managed, tracked, and reassessed over time. This aligns with security program management best practices.

Why this answer

The security manager has assessed the risk, determined that compensating controls reduce the likelihood of data exposure, and confirmed that the residual risk is within the organization's risk appetite. Formally approving the exception with documented compensating controls and a review date ensures governance, accountability, and a timeline for reassessment, which aligns with the policy exception process in security program management.

Exam trap

The trap here is that candidates may assume any deviation from policy must be denied (Option A) or escalated (Option D), failing to recognize that a formal exception process with compensating controls and a review date is the correct risk-based action when residual risk is within appetite.

Why the other options are wrong

Denying the exception outright ignores the risk assessment showing low likelihood and residual risk within appetite, and fails to leverage compensating controls that reduce risk.

Accepting risk without a formal exception bypasses the required documentation and review process, which is critical for compliance and auditability in a healthcare organization handling patient data.

The security manager has the authority to approve exceptions within the organization's risk appetite, and the scenario does not indicate that escalation is required. Escalating to the CIO would be unnecessary and inefficient when the manager can make the decision themselves.

Practice this question →

MCQeasy

A company is considering a new SaaS vendor that will process customer records. What is the best first action before signing the contract?

A.Perform vendor due diligence and review the vendor's security controls

B.Allow the vendor access immediately and monitor for misuse afterward

C.Ask the vendor to send a marketing brochure and pricing sheet only

D.Wait until a security incident occurs before reviewing the vendor

AnswerA

Vendor due diligence evaluates the SaaS provider's security controls, certifications, data handling and breach history before contractual commitment, exposing risks that contract terms cannot retroactively fix. This satisfies the stem's requirement for the best first action prior to signing, since assessment must precede agreement.

Why this answer

Performing vendor due diligence and reviewing the vendor's security controls is the best first action because it proactively assesses the SaaS vendor's ability to protect customer records before any data is shared. This aligns with the principle of 'trust but verify' and ensures that the vendor's security posture meets the company's compliance requirements (e.g., GDPR, HIPAA) and risk tolerance before signing a legally binding contract.

Exam trap

The trap here is that candidates may think 'allowing access immediately and monitoring' is acceptable due to a false sense of security from logging tools, but CompTIA tests that proactive due diligence is mandatory before any data sharing, as monitoring alone cannot prevent contractual or compliance violations.

How to eliminate wrong answers

Option B is wrong because allowing immediate access without prior security review violates the principle of least privilege and exposes customer records to potential data breaches or unauthorized use, with no contractual safeguards in place. Option C is wrong because a marketing brochure and pricing sheet provide no technical or operational details about the vendor's security controls, encryption standards, or incident response capabilities, making it impossible to assess risk. Option D is wrong because waiting for a security incident before reviewing the vendor is a reactive, high-risk approach that could lead to regulatory fines, reputational damage, and legal liability for compromised customer data.

Practice this question →

Multi-Selectmedium

The legal team wants to confirm that customer records are being deleted on schedule after the retention period expires. Which two artifacts best demonstrate compliance? Select two.

Select 2 answers

A.An approved retention schedule or retention policy that defines the deletion period.

B.A folder of employee social media posts about data cleanup.

C.System or audit logs showing the deletion job ran successfully.

D.A list of all printers in the office environment.

E.A draft policy from last year that was never approved.

AnswersA, C

An approved retention schedule or retention policy is the authoritative legal and operational document that specifies how long customer records must be kept before deletion. It defines the deletion period precisely, creating an enforceable rule that the organization must follow. Without an approved, current policy, there is no clear compliance baseline, and auditors cannot validate whether data disposal practices meet regulatory or contractual obligations.

Why this answer

An approved retention schedule or policy is the authoritative document that defines the required deletion period for customer records. It serves as the legal mandate against which compliance is measured. Option C is correct because system or audit logs provide verifiable evidence that the deletion job executed successfully, confirming that the policy was actually followed.

Together, these two artifacts demonstrate both the requirement (policy) and the execution (logs) needed to prove compliance.

Exam trap

The trap here is that candidates may confuse a draft or unapproved policy (Option E) with an approved one, or mistakenly think that informal evidence like social media posts (Option B) can substitute for authoritative documentation and verifiable logs.

Practice this question →

Multi-Selecthard

After a phishing simulation, many employees still almost entered credentials into a fake login page. Leadership wants the fastest improvement without creating training fatigue or disrupting daily work. Which three measures are the best balance of security and usability? Select three.

Select 3 answers

A.Provide targeted microtraining only to users who clicked or nearly clicked.

B.Add a one-click report-phish button and acknowledge employee reports quickly.

C.Use just-in-time warning banners or link-check prompts when users follow external login pages.

D.Replace email access with a weekly manual approval queue for all messages.

E.Publicly identify the worst performers in team meetings to discourage mistakes.

AnswersA, B, C

Targeted microtraining is grounded in the principle that learning is most effective when immediately relevant to an individual's observed behavior. By focusing exclusively on employees who clicked or nearly clicked in the simulation, you provide specific, actionable feedback that addresses the actual risk without wasting the time of users who already demonstrated secure decision-making. This proportionate response also respects employee attention and maintains a collaborative security culture, while directly reinforcing the correct behavior for those who need it most.

Why this answer

Targeted microtraining focuses only on the users who demonstrated risky behavior (clicking or nearly clicking), which directly addresses the root cause without wasting time on users who did not engage. This approach avoids training fatigue by keeping content brief and relevant, and it does not disrupt daily work for the majority of employees who already exhibit secure behavior.

Exam trap

The trap here is that candidates may confuse 'fastest improvement' with 'most aggressive technical control' (like option D) or 'public shaming' (like option E), failing to recognize that behavioral change through targeted, low-friction interventions (microtraining, reporting, and just-in-time prompts) yields faster and more sustainable results without alienating users.

Practice this question →

MCQeasy

Based on the exhibit, what should the security team recommend before sharing the report?

A.Share the report exactly as requested, because the vendor signed a nondisclosure agreement.

B.Remove unnecessary personal fields and share only the minimum data needed for the analysis.

C.Keep all fields and encrypt the file before sending it to the vendor.

D.Store the report in a shared folder so the vendor can access it later if needed.

AnswerB

This is the correct privacy-by-design response because the vendor only needs department-level trends. The organization should minimize the data shared, especially sensitive or unnecessary fields like home addresses and medical leave codes. Limiting the dataset reduces privacy risk, supports compliance, and follows the principle of collecting and disclosing only what is needed for the stated business purpose.

Why this answer

The principle of data minimization requires that only the minimum necessary data be shared to fulfill the analysis purpose. Removing unnecessary personal fields reduces the risk of exposing PII and aligns with privacy regulations such as GDPR and HIPAA, even when a nondisclosure agreement (NDA) is in place.

Exam trap

CompTIA often tests the misconception that a signed NDA or encryption alone is sufficient to share sensitive data, when in fact data minimization and least privilege are the primary security controls required.

How to eliminate wrong answers

Option A is wrong because an NDA does not justify sharing all data fields; it only provides a legal framework for confidentiality, not a technical safeguard against data exposure or misuse. Option C is wrong because encrypting the file protects data in transit but does not address the core issue of sharing unnecessary personal fields; encryption alone does not comply with data minimization principles. Option D is wrong because storing the report in a shared folder introduces additional access control risks and does not limit the data shared to only what is needed for analysis, violating the principle of least privilege.

Practice this question →

MCQmedium

A company can patch only one of two internet-facing systems this week. System 1 has a critical vulnerability but is reachable only through the corporate VPN during maintenance windows. System 2 has a medium vulnerability and supports the public payment site, which shows active attack traffic every day. Which system should be prioritized first?

A.System 1, because the vulnerability is rated critical

B.System 2, because it is exposed to the public and directly supports a business-critical service

C.Neither system, because both are internet-facing and must wait for the next maintenance cycle

D.System 1, because VPN access always makes a vulnerability more dangerous than a public application issue

AnswerB

System 2 should be patched first because risk depends on both exposure and business impact. A medium issue on a public payment site with active attacks presents a higher real-world risk than a critical issue on a system with narrower access. The payment service is also directly tied to revenue and customer trust, so delaying its remediation would create greater business exposure.

Why this answer

System 2 should be prioritized because it is directly exposed to the public internet and supports a business-critical payment service that is under active attack daily. Even though System 1 has a critical vulnerability, it is only reachable through the corporate VPN during maintenance windows, which significantly reduces its attack surface and exploitability. In risk management, the likelihood of exploitation and business impact often outweigh the CVSS base score alone, making System 2 the higher priority.

Exam trap

The trap here is that candidates fixate on the CVSS critical rating (System 1) and ignore the crucial context of attack surface and active threat, leading them to choose A instead of applying risk-based prioritization.

How to eliminate wrong answers

Option A is wrong because it focuses solely on the CVSS severity rating (critical) without considering the reduced attack surface due to VPN-only access, which lowers the actual risk. Option C is wrong because delaying patching for both systems ignores the immediate threat to the public-facing payment service under active attack, violating the principle of prioritizing based on risk and business impact. Option D is wrong because VPN access does not inherently make a vulnerability more dangerous; in fact, it restricts the attack vector to authenticated users, whereas a public-facing system is exposed to the entire internet, including automated attack traffic.

Practice this question →

MCQmedium

After several employees clicked on phishing emails, management wants to reduce future click rates and show measurable improvement across finance, HR, and executive assistants. Which control best meets that goal?

A.Send a one-time company-wide memo reminding users not to click suspicious links.

B.Use role-based security awareness training with phishing simulations and metrics tracking.

C.Disable all external email attachments for every department indefinitely.

D.Require employees to complete annual policy acknowledgment without testing.

AnswerB

Role-based awareness training with phishing simulations is the best fit because it directly targets user behavior and lets the security team measure results. Different job roles face different lures, so tailoring content to finance, HR, and executive assistants improves relevance. Tracking click rates, report rates, and repeat offenders also shows whether the program is working and supports continuous improvement.

Why this answer

Role-based security awareness training with phishing simulations and metrics tracking directly addresses the human factor by tailoring content to specific job roles (finance, HR, executive assistants) and provides measurable improvement through simulation click-rate data. This approach aligns with the NIST SP 800-50 framework for continuous security awareness, enabling management to track reduction in click rates over time.

Exam trap

The trap here is that candidates often choose Option A or D because they equate 'training' with a one-time communication or annual sign-off, failing to recognize that measurable improvement requires simulation, role-specific content, and ongoing metrics tracking as specified in the CompTIA SY0-701 objectives for security awareness programs.

How to eliminate wrong answers

Option A is wrong because a one-time memo lacks reinforcement, metrics, and simulation, so it cannot provide measurable improvement or change long-term behavior. Option C is wrong because disabling all external email attachments for every department indefinitely is overly restrictive, breaks legitimate business workflows (e.g., finance receiving invoices, HR receiving resumes), and does not train users to recognize phishing. Option D is wrong because annual policy acknowledgment without testing or simulation does not measure actual user behavior or reduce click rates; it only confirms policy receipt, not comprehension or application.

Practice this question →

MCQmedium

An engineering tool runs on an unsupported operating system, but the tool is used only occasionally and can be replaced by a supported cloud service with little workflow impact. Which risk treatment is best?

A.Accept the risk because the tool is old and still functions

B.Transfer the risk to the cloud provider without making changes

C.Avoid the risk by retiring the unsupported system and replacing it with the supported service

D.Compensate for the risk by adding more user passwords

AnswerC

Avoiding the risk is the best treatment because the organization has a practical replacement that does not significantly disrupt the workflow. Retiring the unsupported system removes the vulnerability source instead of merely reducing exposure. When a lower-risk alternative is available and business impact is manageable, elimination of the risk is often better than accepting or compensating for it.

Why this answer

The best risk treatment for an unsupported operating system that is only used occasionally and can be replaced with minimal workflow impact is to avoid the risk entirely. By retiring the unsupported system and migrating to the supported cloud service, the organization eliminates the security vulnerabilities and compliance issues associated with the outdated OS. This aligns with the risk avoidance strategy, which is preferred when the cost of mitigation is low and the risk is high.

Exam trap

The trap here is that candidates may confuse risk acceptance with a viable option when the tool 'still functions,' failing to recognize that unsupported systems pose an active security threat that cannot be safely accepted without compensating controls.

How to eliminate wrong answers

Option A is wrong because accepting the risk for an unsupported operating system ignores the lack of security patches, leaving the system vulnerable to exploits that could compromise the entire network. Option B is wrong because transferring the risk to a cloud provider without making changes implies that the unsupported system remains in place, and risk transfer typically involves insurance or contracts, not simply using a cloud service without migration. Option D is wrong because compensating with more user passwords does not address the core issue of an unsupported OS; password policies cannot patch kernel vulnerabilities or missing security updates.

Practice this question →

MCQmedium

A finance application has a known vulnerability in a third-party reporting component. The vendor says a patch will not be available for six months, but the business cannot stop using the application. What is the BEST risk treatment for the organization to pursue next?

A.Avoid the risk by shutting down the finance application immediately.

B.Mitigate the risk by adding compensating controls and tracking residual risk until the patch is available.

C.Transfer the risk by asking the vendor to guarantee that no incident will occur.

D.Accept the risk because any delay in patching is automatically low priority.

AnswerB

This approach reduces the likelihood or impact of exploitation while keeping the business service running. Compensating controls such as increased monitoring, segmentation, additional access restrictions, and temporary workarounds are appropriate when a patch is unavailable. The organization can then document the remaining risk, assign an owner, and revisit the issue when the vendor releases the fix.

Why this answer

When a known vulnerability exists in a third-party component and patching is delayed, the best risk treatment is to implement compensating controls (such as network segmentation, WAF rules, or input validation) to reduce the likelihood or impact of exploitation. This approach allows the business to continue operations while actively tracking residual risk until the vendor releases the patch. It aligns with the NIST risk management framework, which prioritizes mitigation when avoidance is not feasible.

Exam trap

The trap here is that candidates confuse 'accepting risk' with 'doing nothing,' but in CompTIA's framework, risk acceptance requires a formal decision by management after evaluating the risk level, not an automatic deferral due to a delayed patch.

How to eliminate wrong answers

Option A is wrong because shutting down the finance application immediately would avoid the risk but is not feasible as the business cannot stop using the application, making this an impractical business decision. Option C is wrong because risk transfer requires a third party to accept financial liability (e.g., through insurance or outsourcing), and asking a vendor to 'guarantee no incident' is not a valid risk transfer mechanism—vendors typically do not assume operational risk for unpatched vulnerabilities. Option D is wrong because accepting risk without analysis or compensating controls is negligent; the vulnerability is known and the application is critical, so acceptance should only be considered after a formal risk assessment and only if the residual risk is within the organization's appetite, not automatically due to a delayed patch.

Practice this question →

Multi-Selecthard

A customer portal team must keep an unsupported Linux appliance online for 60 days while a replacement is built. The appliance processes payment tokens and cannot be patched until the vendor certifies the new image. Which two actions best reduce the residual risk during the 60-day window? Select two.

Select 2 answers

A.Move the appliance onto the flat user VLAN so the team can monitor it with standard workstation tools.

B.Restrict network paths to only the required upstream and downstream systems through firewall allow-lists.

C.Declare the risk fully accepted and make no configuration changes until the replacement is ready.

D.Add compensating controls such as application allow-listing, enhanced logging, and SIEM alerting.

E.Disable logging because the appliance is already at capacity and logs can slow it down.

AnswersB, D

Enforcing firewall allow-lists to permit only the specific upstream and downstream systems and required ports creates a strict micro-perimeter around the appliance. Because the unsupported OS cannot be patched, this drastically reduces the attack surface by blocking all other network traffic, including opportunistic scans and malware command-and-control attempts. If the appliance is compromised, the blast radius is limited to those allowed paths, making containment easier and providing an additional layer of defense in depth.

Why this answer

Restricting network paths to only required upstream and downstream systems via firewall allow-lists reduces the attack surface by limiting the appliance's exposure to unnecessary network traffic. This is a classic network segmentation compensating control that mitigates the risk of lateral movement from an unpatched, vulnerable system. By enforcing strict ingress/egress rules, the team can prevent unauthorized access and contain potential exploits during the 60-day window.

Exam trap

The trap here is that candidates may think 'accepting the risk' (Option C) is the only valid response when a patch cannot be applied, but CompTIA expects you to recognize that compensating controls must still be implemented to reduce residual risk to an acceptable level.

Practice this question →

MCQmedium

A records manager discovers 18-month-old paper onboarding forms stored in a cabinet. The retention schedule says the forms must be destroyed after 12 months unless legal hold applies, and no hold has been issued. What is the best next step?

A.Keep the forms indefinitely in case a future audit asks for them.

B.Scan the forms into a shared folder and then throw away the paper.

C.Destroy the forms using an approved secure disposal method and document the action.

D.Return the forms to HR so they can be reused for new hires.

AnswerC

Once the retention period expires and no legal hold is in force, the correct action is secure destruction using an approved method such as cross-cut shredding, burning, or pulping to prevent reconstruction of PII. Documenting the destruction with a certificate of destruction or equivalent log provides an audit trail that demonstrates compliance with the records schedule. This ensures the information is permanently unrecoverable while satisfying accountability requirements.

Why this answer

The retention schedule explicitly requires destruction after 12 months with no legal hold. An approved secure disposal method (e.g., cross-cut shredding or incineration) ensures the sensitive PII on onboarding forms is irrecoverable, and documenting the action provides an audit trail for compliance with data protection regulations like GDPR or HIPAA.

Exam trap

The trap here is that candidates may choose Option B (scanning) thinking digital preservation is safer, but the question tests the principle that retention schedules mandate destruction—not conversion—and that scanning without secure disposal still leaves the paper intact, violating policy.

How to eliminate wrong answers

Option A is wrong because indefinite retention violates the defined retention schedule and could expose the organization to non-compliance penalties for holding data longer than permitted. Option B is wrong because scanning into a shared folder without access controls or encryption creates a security risk and does not constitute destruction; the paper must still be securely disposed of, and the digital copy may itself require deletion per the schedule. Option D is wrong because reusing forms for new hires would mix old personal data with new, causing data integrity issues and violating privacy principles like data minimization.

Practice this question →

MCQmedium

The SOC is writing step-by-step instructions for responding to a suspected malware infection on a laptop. The document should tell analysts exactly what to do first, second, and third during triage and containment. Which governance artifact should they create?

A.Policy, because it states the organization's broad security intent.

B.Procedure, because it gives a repeatable sequence of actions for a specific task.

C.Guideline, because it offers optional advice that analysts may choose to follow.

D.Standard, because it defines the organization's security goals at a high level.

AnswerB

A procedure is the right artifact when the team needs exact, repeatable instructions. In incident response, analysts need a consistent sequence for triage, containment, escalation, and evidence handling so that actions are predictable and auditable. Procedures support operational consistency and reduce confusion during stressful events, which is why they fit this scenario better than policies or guidelines.

Why this answer

A procedure is the correct governance artifact because it provides a detailed, step-by-step sequence of actions for a specific task—in this case, triaging and containing a suspected malware infection on a laptop. Unlike policies or standards, which set high-level intent or goals, a procedure ensures repeatable and consistent execution by analysts during incident response.

Exam trap

The SY0-701 exam often tests the distinction between high-level governance documents (policies, standards) and operational documents (procedures, guidelines), and the trap here is that candidates confuse a procedure with a guideline because both provide instructions, but a procedure is mandatory and ordered, while a guideline is advisory and flexible.

How to eliminate wrong answers

Option A is wrong because a policy states the organization's broad security intent (e.g., 'All endpoints must be protected from malware'), not the specific step-by-step instructions needed for triage and containment. Option C is wrong because a guideline offers optional advice or best practices that analysts may choose to follow, but the question requires mandatory, ordered steps for a repeatable process. Option D is wrong because a standard defines mandatory security goals or requirements at a high level (e.g., 'All laptops must have antivirus software'), not the precise sequence of actions for a specific incident response task.

Practice this question →

MCQeasy

The service desk needs a document that tells analysts exactly how to verify a caller and reset a password for a locked account. Which document type should they use?

A.Policy, because it states the organization's high-level security expectations

B.Guideline, because it offers helpful suggestions that staff may choose to follow

C.Procedure, because it provides exact steps staff must follow in order

D.Standard, because it defines a general topic without operational detail

AnswerC

A procedure is the correct document type because it specifies a mandatory, repeatable sequence of detailed actions—such as 'verify two identity attributes, then reset the password, then log the incident ticket.' Procedures remove ambiguity, ensure every analyst performs the task in the same secure order, and support auditability and accountability. This makes a procedure far more actionable than a policy, standard, or guideline for service desk workflows.

Why this answer

A procedure is the correct document type because it provides a step-by-step sequence of actions that staff must follow to complete a specific operational task, such as verifying a caller's identity and resetting a password. Unlike policies or standards, procedures are mandatory and detail the exact commands, verification checks, and escalation paths required to ensure consistent and secure execution of the task.

Exam trap

The trap here is confusing a procedure with a policy or standard, as candidates often think a high-level policy is sufficient for operational tasks, but the exam requires recognizing that procedures are the only document type that mandates exact, ordered steps for a specific task.

How to eliminate wrong answers

Option A is wrong because a policy states high-level security expectations and principles (e.g., 'passwords must be reset securely'), but does not provide the specific steps for verifying a caller or performing the reset. Option B is wrong because a guideline offers suggestions or best practices that staff may choose to follow, not the exact mandatory steps required for a consistent and secure password reset process. Option D is wrong because a standard defines a general topic or baseline requirement (e.g., 'passwords must be at least 8 characters') without the operational detail needed to execute a specific procedure.

Practice this question →

MCQmedium

Based on the exhibit, what is the best next step before onboarding the vendor?

A.Approve the vendor because it already passed a penetration test.

B.Require a security addendum with breach-notification timing, subprocessor approval, and audit rights.

C.Ask the vendor to provide source code so developers can review it.

D.Move the workload to an internal shared drive until the vendor is ready.

AnswerB

Requiring a security addendum addresses the governance gaps highlighted in the exhibit by forcing the vendor to agree to enforceable breach-notification deadlines, prior approval for subprocessors, and independent audit rights. These contractual controls create accountability and give the organization ongoing visibility into the vendor’s security posture, including downstream subprocessor risks, before the workload is onboarded. This is the best next step because it closes the missing due-diligence and contractual gaps identified.

Why this answer

The exhibit indicates the vendor has not yet provided a security addendum, which is a critical contractual document that defines security obligations such as breach-notification timing, subprocessor approval, and audit rights. Without this addendum, the organization lacks enforceable guarantees for data protection and incident response, making onboarding premature. Option B directly addresses this gap by requiring the addendum before proceeding.

Exam trap

The trap here is that candidates may assume a penetration test is sufficient due diligence, overlooking that contractual security terms are legally binding and address ongoing compliance, not just a one-time technical check.

How to eliminate wrong answers

Option A is wrong because passing a penetration test does not replace the need for contractual security terms; a pen test is a point-in-time assessment, not a binding agreement for ongoing compliance. Option C is wrong because requesting source code is impractical and unnecessary for most vendor relationships—developers cannot realistically review proprietary code, and this does not address legal or operational security requirements. Option D is wrong because moving the workload to an internal shared drive introduces data exposure risks and does not resolve the missing vendor security addendum; it bypasses proper governance.

Practice this question →

Multi-Selecteasy

A security manager wants one document that states employees must protect company laptops and another that defines exact required settings such as disk encryption and a 10-minute screen lock. Which two document types are the best fit? Select two.

Select 2 answers

A.Policy

B.Standard

C.Guideline

D.Procedure

E.Exception

AnswersA, B

A policy is a formal, board-approved statement of management intent that establishes mandatory, high-level expectations for security behavior. It explains the "what" and "why"—for example, employees must protect laptops and company data—without dictating specific technical implementations. As the foundational governance document, it sets the legal and compliance boundary for all lower-level documentation.

Why this answer

A policy is a high-level statement of management intent, such as requiring employees to protect company laptops. A standard defines mandatory, specific technical settings, like requiring disk encryption (e.g., AES-256) and a 10-minute screen lock timeout. Together, they provide the overarching directive (policy) and the enforceable configuration baseline (standard).

Exam trap

The trap here is confusing 'policy' with 'guideline' or 'procedure'—candidates often pick 'guideline' for the technical settings because they think it's a recommendation, but standards are the only document type that mandates exact technical configurations.

Practice this question →

100

Matchinghard

Match each requirement or instruction to the correct governance document type. Use each document type once.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Policy

Standard

Procedure

Guideline

Why these pairings

These matches align with common governance document types in IT security frameworks: policy provides high-level direction, standard sets mandatory rules, procedure gives step-by-step instructions, guideline offers non-mandatory recommendations, baseline defines minimum configurations, and framework provides a structured approach.

Practice this question →

101

MCQhard

Based on the exhibit, which control option provides the greatest net annual financial benefit for the organization?

A.Option A, because it reduces loss enough to justify the control cost better than the smaller controls.

B.Option B, because its large reduction in annual loss outweighs the higher implementation cost.

C.Option C, because transferring the risk is always cheaper than engineering a technical fix.

D.Option D, because low upfront cost makes it the most economical option regardless of residual loss.

AnswerB

Reduces annual loss expectancy from $260,000 to $40,000, creating $220,000 in annual savings before cost. After subtracting the $120,000 control cost, it still delivers the highest net benefit among the choices. Quantitative risk decisions should compare expected loss reduction against implementation cost, and this option provides the strongest financial return.

Why this answer

It provides the greatest net annual financial benefit. With a loss reduction of $220,000 and an implementation cost of $120,000, the net benefit is $100,000, which is higher than any other option. This demonstrates that a larger upfront investment can be justified when the reduction in annualized loss expectancy (ALE) significantly outweighs the control cost.

Exam trap

The trap here is that candidates often choose the option with the lowest implementation cost or the highest loss reduction without calculating the net benefit, failing to recognize that the greatest net financial benefit comes from the optimal balance between cost and loss reduction. For example, Option B's loss reduction of $220,000 minus cost of $120,000 yields $100,000 net benefit, surpassing other options.

How to eliminate wrong answers

Option A is wrong because although it reduces loss, its net benefit ($50,000 reduction - $25,000 cost = $25,000) is lower than Option B's net benefit of $75,000, so it does not provide the greatest net annual financial benefit. Option C is wrong because transferring risk (e.g., cyber insurance) is not always cheaper; in this scenario, the net benefit of Option C ($100,000 reduction - $60,000 cost = $40,000) is still less than Option B's net benefit, and risk transfer often involves premiums, deductibles, and residual risk that can make it less economical than a technical control. Option D is wrong because low upfront cost does not guarantee the greatest net benefit; its net benefit ($30,000 reduction - $10,000 cost = $20,000) is the lowest among all options, and ignoring residual loss can lead to underestimating long-term financial impact.

Practice this question →

102

Multi-Selecthard

A developer requests a 45-day exception to use an unsupported browser plug-in on two engineering workstations so a legacy design tool can finish a customer deliverable. Which three conditions should be required before approving the exception? Select three.

Select 3 answers

A.Document a business justification that explains why the plug-in is required for the deliverable.

B.Convert the exception into a permanent waiver to avoid repeated review overhead.

C.Set a defined end date and require review before the exception expires.

D.Apply compensating controls, such as host isolation, restricted user access, or limiting use to named workstations.

E.Allow the requestor to self-approve the exception if the project deadline is urgent.

AnswersA, C, D

Documenting a business justification is correct because it ties the use of an unsupported plug-in directly to a concrete deliverable, proving that the accepted risk serves a legitimate operational need rather than administrative convenience. This artifact gives the risk owner clear evidence to make an informed decision and creates an audit trail explaining why the standard security baseline could not be met. The justification should name the deliverable, the plug-in's required function, and the impact of not using it, making the exception defensible during review.

Why this answer

Documenting a business justification provides a formal record of why the exception is necessary, ensuring that the risk of using an unsupported browser plug-in is understood and accepted by management. This aligns with the principle of risk acceptance, where the business need outweighs the security risk for a limited time. Without a clear justification, the exception could be granted without proper oversight, potentially leading to unchecked vulnerabilities.

Exam trap

The trap here is that candidates may mistakenly think converting an exception to a permanent waiver reduces administrative overhead, but CompTIA emphasizes that exceptions must remain temporary and reviewed, as permanent waivers bypass the risk management process and can lead to unmanaged security gaps.

Practice this question →

103

MCQeasy

The help desk needs a document that tells analysts exactly how to verify a caller, reset a password, and record the ticket when a user is locked out. What type of document is this?

A.Procedure

B.Policy

C.Standard

D.Guideline

AnswerA

A procedure is the right document when staff need exact step-by-step instructions. In this situation, the help desk needs a repeatable process for identity verification, password reset actions, and documentation requirements. Procedures reduce mistakes because they tell employees what to do in sequence rather than leaving the process open to interpretation.

Why this answer

A procedure is the correct type of document because it provides step-by-step instructions for performing a specific task, such as verifying a caller's identity, resetting a password, and recording a ticket. Unlike a policy, which states high-level rules, a procedure details the exact actions to take in a given scenario, making it ideal for help desk operations.

Exam trap

The trap here is that candidates often confuse 'procedure' with 'policy' because both are security documents, but a policy sets the 'what' and 'why' (e.g., 'passwords must be reset securely'), while a procedure defines the 'how' (e.g., 'call the user back at their verified phone number before resetting').

How to eliminate wrong answers

Option B is wrong because a policy defines high-level rules and objectives (e.g., 'passwords must be reset securely') but does not provide the step-by-step instructions needed for the help desk to execute the task. Option C is wrong because a standard specifies mandatory technical requirements or baselines (e.g., 'passwords must be at least 12 characters') but does not describe the process of verification, reset, and ticket recording. Option D is wrong because a guideline offers general advice or best practices (e.g., 'consider using multi-factor authentication') but lacks the precise, mandatory steps required for consistent execution in a help desk workflow.

Practice this question →

104

MCQmedium

A project team must share a spreadsheet containing customer names, account numbers, and purchase history with an external auditor. The auditor only needs account numbers and totals. What is the best privacy control?

A.Send the full spreadsheet through regular email to avoid delaying the audit

B.Redact unneeded personal data and transfer only the minimum necessary information through an approved encrypted channel

C.Upload the spreadsheet to a public file-sharing site and protect it with a password

D.Compress the file with a password and reuse the same password for all auditors

AnswerB

This is the best privacy control because it applies data minimization and secure transmission together. The auditor receives only what is needed to complete the review, which reduces exposure of personal information and limits the blast radius if the file is mishandled. Using an approved encrypted channel also helps protect the data in transit and supports governance requirements.

Why this answer

It applies the principle of data minimization and secure transmission. Redacting unneeded personal data (customer names) ensures only the minimum necessary information (account numbers and totals) is shared, reducing exposure. Transferring via an approved encrypted channel (e.g., SFTP, HTTPS, or encrypted email) protects data in transit from interception, which is required for compliance with regulations like GDPR or PCI DSS.

Exam trap

The trap here is that candidates may think password-protecting a file or using a public sharing site is sufficient, but the exam tests the understanding that data minimization and approved encrypted channels are required for privacy compliance, not just any form of access control.

How to eliminate wrong answers

Option A is wrong because sending the full spreadsheet through regular email exposes all customer personal data in transit and at rest, violating data minimization and encryption requirements (email is often unencrypted or uses opportunistic TLS). Option C is wrong because uploading to a public file-sharing site, even with a password, relies on the security of the third-party service and the password alone, which does not guarantee encryption at rest or proper access controls, and the file may be cached or indexed. Option D is wrong because compressing with a password and reusing the same password for all auditors violates the principle of unique credentials per user, lacks audit trails, and does not ensure encryption of the file in transit or at rest (ZIP encryption is weak and can be cracked).

Practice this question →

105

MCQmedium

A development team needs to release an urgent fix for a customer portal on Friday evening. The business wants the change to be reversible if something breaks, and security does not want the team to skip release controls. Which requirement should be part of the change process?

A.Deploy directly to production as soon as the patch compiles successfully.

B.Require a documented test in a lower environment and a rollback plan before production approval.

C.Turn off logging during deployment to avoid filling the disk with change records.

D.Allow the release only if the developer verbally confirms the code is safe.

AnswerB

Testing in a lower environment and documenting a rollback plan are core secure change-management practices. They reduce the chance of introducing an outage and make recovery faster if the fix has unexpected side effects. This approach supports controlled release, accountability, and operational resilience while still allowing urgent changes to move forward in a safe way.

Why this answer

It enforces a documented test in a lower environment and a rollback plan, which satisfies both the business requirement for reversibility and the security requirement to maintain release controls. This aligns with the change management process in the SY0-701 domain of Security Program Management and Oversight, ensuring that changes are validated before production deployment and can be undone if issues arise.

Exam trap

The trap here is that candidates may think an urgent fix justifies skipping controls (Option A) or that disabling logging is acceptable to avoid disk issues (Option C), but the exam emphasizes that security controls and reversibility must be maintained even for emergency changes.

How to eliminate wrong answers

Option A is wrong because deploying directly to production as soon as the patch compiles skips all release controls, such as testing and approval, which violates security policy and increases risk of unplanned downtime. Option C is wrong because turning off logging during deployment would disable audit trails and monitoring, making it impossible to detect or investigate security incidents or deployment failures, which contradicts security best practices and compliance requirements.

Practice this question →

106

MCQmedium

Based on the exhibit, what is the best next step before the marketing SaaS platform goes live?

A.Proceed only after the business owner formally accepts the remaining risk in writing.

B.Ignore the residual risk because the vendor has a current SOC report.

C.Require the security team to approve the launch verbally so the project does not slow down.

D.Cancel the contract immediately because any medium risk rating is unacceptable.

AnswerA

The exhibit already shows compensating controls and a measured residual risk rating. When the remaining risk is understood and the business impact of delay is significant, the proper next step is a formal acceptance by the appropriate risk owner. That creates accountability and preserves an auditable record of the decision.

Why this answer

The exhibit shows a residual risk rating of 'Medium' after the vendor's SOC report was reviewed. In the SY0-701 risk management framework, the business owner is the risk owner who must formally accept any residual risk before a system goes live, as they are accountable for the business impact. Proceeding without documented acceptance violates the principle of risk acceptance and could lead to unapproved exposure.

Exam trap

The trap here is that candidates assume a vendor SOC report fully transfers risk to the vendor, but CompTIA emphasizes that residual risk always remains and must be formally accepted by the business owner, not just the security team.

How to eliminate wrong answers

Option B is wrong because a current SOC report only provides a point-in-time assurance of the vendor's controls; it does not eliminate residual risk, which must still be formally accepted by the business owner. Option C is wrong because verbal approval bypasses the required documented risk acceptance process and audit trail, violating governance and compliance requirements. Option D is wrong because a 'Medium' risk rating is not automatically unacceptable; risk acceptance decisions are based on the organization's risk appetite, and cancellation is an extreme response without considering mitigation or acceptance.

Practice this question →

107

Multi-Selecteasy

An HR analyst must send a salary file to an external auditor. The auditor only needs names, departments, and salary totals, not Social Security numbers or bank account details. Which two actions should the analyst take first? Select two.

Select 2 answers

A.Remove unnecessary sensitive fields before sharing

B.Use an approved encrypted transfer method

C.Upload the file to a public link and send the URL by email

D.Rename the file to a less obvious name and send it normally

E.Save the file locally on a USB drive and hand-deliver it

AnswersA, B

Data minimization is a core privacy control: by stripping out personally identifiable information (PII) such as Social Security numbers, bank account numbers, or performance ratings that the auditor does not need, you reduce the potential impact of any unauthorised access. This aligns with the least-privilege principle and with regulations like GDPR or CCPA that mandate processing only the minimum necessary data. Even if encryption were to fail, the exposed data is far less sensitive, making this a critical first line of defense.

Why this answer

Removing unnecessary sensitive fields (like Social Security numbers and bank account details) before sharing the file reduces the risk of exposing personally identifiable information (PII) and aligns with the principle of data minimization. This step ensures that only the required data (names, departments, salary totals) is transmitted, which is a foundational security control before any data transfer occurs.

Exam trap

The trap here is that candidates may think renaming a file (Option D) or using a USB drive (Option E) provides sufficient security, when in fact these methods lack encryption and proper access controls, which are essential for protecting sensitive data in transit.

Practice this question →

108

Matchinghard

Match each procurement or oversight need to the best vendor due diligence artifact or clause. Use each item once.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

SOC 2 Type II report

Data processing agreement (DPA)

Software bill of materials (SBOM)

Right-to-audit clause

Disaster recovery test report

Why these pairings

These artifacts support vendor due diligence: questionnaires assess controls, SOC 2 reports provide independent assurance, audit clauses enable customer verification, DPAs govern data handling, BCPs ensure resilience, and pen tests validate security.

Practice this question →

109

MCQeasy

A legacy production scanner cannot support MFA, but it must remain available for six months until replacement hardware arrives. What is the best security response?

A.Permanently waive MFA for the scanner and leave the exception open-ended.

B.Approve a time-bound exception with compensating controls and a review date.

C.Shut down the scanner immediately until MFA can be enabled.

D.Create a shared administrator account so operators can sign in more easily.

AnswerB

A time-bound exception allows the business to keep operating while security reduces risk through other controls such as network restriction, monitoring, or limited access. Adding a review date keeps the exception temporary and accountable, which is the best governance practice.

Why this answer

It balances security with operational necessity by implementing a time-bound exception with compensating controls (e.g., network segmentation, strict access logging, or IP whitelisting) and a mandatory review date. This ensures the legacy scanner remains available for six months while mitigating the risk of unauthorized access, aligning with the principle of least privilege and security program oversight.

Exam trap

The trap here is that candidates may choose Option C (immediate shutdown) thinking it is the only secure choice, but the question explicitly states the scanner must remain available, making a risk-accepted, time-bound exception with compensating controls the correct security program management response.

How to eliminate wrong answers

Option A is wrong because permanently waiving MFA for the scanner leaves an open-ended exception with no expiration or review, violating security policy and increasing long-term risk. Option C is wrong because immediately shutting down the scanner disrupts production operations unnecessarily, as a time-bound exception with compensating controls can safely bridge the six-month gap. Option D is wrong because creating a shared administrator account bypasses accountability and audit trails, directly contradicting MFA's purpose of ensuring non-repudiation and secure authentication.

Practice this question →

110

MCQhard

Based on the exhibit, which artifact is the strongest evidence that the firewall change was reviewed and approved before implementation?

A.The engineer's post-implementation email, because it confirms someone checked the change.

B.The firewall logs, because they show the rule was applied successfully on the device.

C.The change request record with CAB approval timestamp and implementation time.

D.The vendor's maintenance notice, because it explains why the rule was needed.

AnswerC

This is the best evidence because it shows formal review and approval occurred before the change was implemented. Auditors want controlled, time-stamped proof of authorization, not just technical confirmation that the firewall rule changed or an informal email afterward. The change record directly supports compliance with change management requirements.

Why this answer

The change request record with a CAB approval timestamp and implementation time provides a clear, auditable trail that the firewall change was formally reviewed and authorized by the Change Advisory Board before it was executed. This aligns with the change management process required for security program oversight, ensuring that changes are not implemented without proper governance.

Exam trap

The trap here is that candidates often confuse post-implementation verification (Option A) or technical success logs (Option B) with the governance requirement for pre-approval, which is the core of change management oversight.

How to eliminate wrong answers

Option A is wrong because a post-implementation email only confirms that someone checked the change after it was made, not that it was reviewed and approved before implementation. Option B is wrong because firewall logs show the rule was applied successfully on the device, but they do not provide any evidence of pre-approval or review by a change board. Option D is wrong because a vendor's maintenance notice explains the technical need for the rule but does not document any internal review or approval process.

Practice this question →

111

MCQmedium

A project team needs to use an unapproved file-sharing application for two weeks because the approved platform cannot support an external client collaboration feature. What is the best security action?

A.Deny the request permanently and avoid discussing the business need

B.Approve a documented temporary exception with compensating controls and a review date

C.Immediately rewrite the policy so all users may use the unapproved application

D.Ask the team to create a detailed step-by-step procedure for using the application

AnswerB

A temporary exception is the best choice when a business need exists and the risk can be managed. Document the reason, identify compensating controls such as encryption or restricted access, assign an owner, and set an expiration date. That approach preserves governance, keeps the risk visible, and avoids turning a temporary deviation into an indefinite shadow process.

Why this answer

It follows the principle of risk acceptance through a formal exception process. By documenting a temporary exception with compensating controls (e.g., data encryption, access logging, and usage monitoring) and setting a review date, the organization maintains security oversight while addressing the legitimate business need. This approach aligns with the SY0-701 domain of Security Program Management, which emphasizes balancing security with operational requirements through managed risk.

Exam trap

The trap here is that candidates may choose Option D, thinking that a detailed procedure mitigates risk, but CompTIA tests the understanding that procedures without compensating controls do not reduce the inherent risk of using an unapproved application.

How to eliminate wrong answers

Option A is wrong because it ignores the business need entirely, which can lead to shadow IT or unauthorized workarounds that bypass security controls entirely. Option C is wrong because immediately rewriting policy for a temporary, isolated need creates unnecessary risk exposure for all users and violates change management principles. Option D is wrong because a detailed procedure does not address the underlying security risk of using an unapproved application; it only documents how to use it unsafely.

Practice this question →

112

MCQmedium

Several employees reported a text message that looked like it came from the VPN support team and linked to a fake sign-in page. Management wants to reduce future success of these attacks and improve how quickly users report suspicious messages. What should the security team implement?

A.Send one annual lecture to all staff and close the ticket

B.Run role-based smishing simulations and provide a simple reporting workflow

C.Disable text messaging for every employee mobile device

D.Require managers to approve every external message before users open it

AnswerB

Role-based smishing simulations tailor realistic phishing scenarios to the user's job function, such as a fake expense report for finance or a fraudulent wire-transfer request for executives, which makes the training relevant and memorable. Combining these with a simple reporting workflow—for example, a 'Report Phish' button in the email client or a shared SMS inbox—enables users to report suspicious texts quickly and helps the security team collect threat intelligence and respond faster. This combination changes user behavior, reinforces secure habits, and produces measurable metrics like click rate and report rate.

Why this answer

Smishing simulations train users to recognize phishing SMS attacks in a controlled environment, directly reducing susceptibility. A simple reporting workflow (e.g., a dedicated email address or button in the messaging app) lowers the friction for users to report suspicious messages, enabling faster incident response. This combination addresses both the reduction of attack success and the improvement of reporting speed.

Exam trap

The trap here is that candidates may choose Option C (disable text messaging) because it seems like a definitive technical control, but the question specifically asks to reduce future success and improve reporting speed, which requires user training and a streamlined reporting process, not a blanket ban that breaks business functionality.

How to eliminate wrong answers

Option A is wrong because a single annual lecture provides no ongoing reinforcement or practical testing, and closing the ticket without further action leaves the organization vulnerable to evolving smishing tactics. Option C is wrong because disabling text messaging for all employees is impractical and would disrupt legitimate business communications, violating the principle of least privilege and operational continuity. Option D is wrong because requiring managers to approve every external message before users open it creates an unsustainable bottleneck, delays response, and does not scale; it also fails to address the root cause of user susceptibility to social engineering.

Practice this question →

113

Matchingmedium

Match each business scenario to the most appropriate risk treatment. 1. A legacy reporting server is expensive to replace, and leadership is willing to monitor the low expected loss for now. 2. A public web portal is being hit by credential stuffing, so the team adds MFA and rate limiting. 3. The organization wants protection from a costly third-party outage by purchasing cyber insurance. 4. A proposed project would collect regulated data that the business has decided not to process at all.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Mitigate

Transfer

Avoid

Why these pairings

Risk acceptance acknowledges the risk without action; mitigation reduces risk via controls; transfer shifts risk to insurance; avoidance eliminates the risk activity; reduction and sharing are related but less direct matches to the scenarios.

Practice this question →

114

MCQhard

Based on the exhibit, what is the best next step before the hotfix is released?

A.Deploy immediately because the issue is customer-facing and urgent.

B.Close the ticket after deployment and create a postmortem if users complain.

C.Ask support to warn users that sign-in may fail during the next hour.

D.Pause release until the change is formally approved, tested, and has a documented rollback path.

AnswerD

The exhibit shows multiple process gaps: skipped tests, unresolved integration test failure, no documented rollback plan, and only verbal approval. Even an emergency fix should follow an emergency change process with documented authorization and enough validation to reduce the chance of making the outage worse. The safest next step is to complete the required change controls before production deployment.

Why this answer

Releasing a hotfix without formal approval, testing, and a documented rollback path violates the change management policy required by security program management. Even for urgent customer-facing issues, skipping these steps risks introducing new vulnerabilities or breaking other systems, which could lead to a larger outage. The exhibit indicates a need for controlled change processes, so pausing until the change is properly vetted ensures stability and security.

Exam trap

The trap here is that candidates may prioritize speed over security, assuming that a customer-facing issue justifies skipping change management, but the exam emphasizes that formal approval and testing are non-negotiable even for urgent fixes.

How to eliminate wrong answers

Option A is wrong because deploying immediately without testing or approval bypasses change management controls, potentially causing unintended side effects or security gaps. Option B is wrong because closing the ticket after deployment and only creating a postmortem if users complain ignores proactive risk management and fails to document the change properly, which is a key oversight in security program management. Option C is wrong because asking support to warn users is a temporary workaround that does not address the root cause or ensure the fix is safe; it also lacks the formal approval and testing required for a hotfix.

Practice this question →

115

Drag & Dropmedium

Drag and drop the steps to perform a password reset for a user in Active Directory into the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Password reset in AD is done via ADUC; the admin must have appropriate permissions, and it's good practice to enforce change at next logon.

Practice this question →

116

MCQmedium

A legacy payroll server contains a critical vulnerability. The vendor says a patch is 45 days away, and the system must remain available for payroll processing. Which risk treatment is the best short-term choice?

A.Accept the risk until the patch arrives because the server is needed for payroll processing.

B.Mitigate the risk with compensating controls such as segmentation, restricted access, and monitoring.

C.Avoid the risk by permanently decommissioning the server this week.

D.Transfer the risk by purchasing support coverage and waiting for the patch.

AnswerB

Mitigation is the best short-term treatment because the server must remain available and the vendor cannot patch it yet. Compensating controls can reduce exposure by limiting who can reach the system, narrowing network paths, and improving detection. This lowers likelihood without shutting down payroll operations. It is the most practical choice when full remediation is delayed.

Why this answer

Compensating controls like network segmentation, strict access controls, and enhanced monitoring can reduce the risk of exploitation while keeping the legacy payroll server operational. This approach directly addresses the need for availability during the 45-day patch window, aligning with the principle of defense-in-depth for unpatched systems.

Exam trap

The trap here is that candidates may confuse 'accepting the risk' (Option A) as a valid short-term strategy, but CompTIA expects you to recognize that acceptance without active monitoring or controls is not appropriate when the vulnerability is critical and the system handles sensitive data.

How to eliminate wrong answers

Option A is wrong because accepting the risk without any active countermeasures leaves the critical vulnerability exposed, which could lead to a breach of sensitive payroll data; acceptance is only appropriate when the impact is negligible, which is not the case here. Option C is wrong because permanently decommissioning the server avoids the risk but violates the requirement that the system must remain available for payroll processing, making it an impractical short-term choice. Option D is wrong because purchasing support coverage does not transfer the technical risk of exploitation; it only provides vendor support, and waiting for the patch still leaves the vulnerability unmitigated during the 45-day period.

Practice this question →

117

MCQmedium

A business owner asks whether to proceed with a medium-risk issue on an internal reporting system. The vulnerability is unlikely to be exploited because the system is reachable only from a segmented admin network, and no sensitive data is stored there. The owner wants to postpone remediation until the next planned upgrade window. Which risk treatment is being chosen?

A.Risk avoidance, because the system will be upgraded later.

B.Risk acceptance, because the business is choosing to live with the remaining risk for now.

C.Risk transfer, because the upgrade window shifts responsibility to the vendor.

D.Risk escalation, because the issue is being sent to the help desk for tracking.

AnswerB

Risk acceptance is a formal treatment decision in which leadership acknowledges the residual risk and chooses to tolerate it without implementing additional controls at this time. When a business knowingly proceeds with a medium risk because a planned upgrade will later address the vulnerability, it is actively accepting the current level of risk. This decision should be documented in the risk register, assigned to a risk owner, and revisited when the upgrade is delivered.

Why this answer

Risk acceptance is the deliberate decision to acknowledge and tolerate a risk without immediate remediation. In this scenario, the business owner understands the vulnerability is low-likelihood (segmented admin network, no sensitive data) and chooses to postpone fixing it until the next planned upgrade, thereby accepting the residual risk for that period.

Exam trap

The SY0-701 exam often tests the distinction between risk acceptance and risk avoidance, where candidates mistakenly think postponing remediation equals avoidance rather than a conscious decision to live with the risk temporarily.

How to eliminate wrong answers

Option A is wrong because risk avoidance would mean eliminating the risk entirely (e.g., removing the system or blocking all access), not merely postponing remediation to a later upgrade. Option C is wrong because risk transfer shifts financial liability to a third party (e.g., purchasing cyber insurance or outsourcing), not delaying an internal fix. Option D is wrong because risk escalation involves formally notifying higher management or a risk committee to decide on a response, not simply sending a ticket to the help desk for tracking.

Practice this question →

118

Matchingmedium

Match each data example to the most appropriate classification label. 1. A public marketing flyer approved for external posting. 2. An internal org chart and office directory meant only for employees. 3. A customer case file with contact details and order history. 4. A vault export containing API keys and encryption secrets.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Public

Internal

Confidential

Restricted

Why these pairings

These matches follow a typical data classification scheme: Public for non-sensitive info, Internal for company-only data, Confidential for customer PII, and Restricted for highly sensitive secrets.

Practice this question →

119

Multi-Selecteasy

After a phishing campaign, several employees entered credentials on a fake login page. Management wants a control that both improves user behavior and gives the security team a way to measure whether click rates are going down. Which two actions best meet that goal? Select two.

Select 2 answers

A.Send a reminder email once a year and stop there

B.Run role-based phishing awareness training

C.Disable all external email for every employee

D.Use simulated phishing exercises with reporting metrics

E.Tell users to ignore suspicious messages unless IT calls first

AnswersB, D

Role-based phishing awareness training maps real-world scenarios to each employee's job function—finance teams practice spotting BEC invoices, HR recognizes W-2 scams, and developers identify credential-harvesting pages—so the lessons feel relevant and memorable. This approach reduces cognitive overload by focusing on the attack types most likely to target that role and allows training teams to track competence before and after the campaign.

Why this answer

Role-based phishing awareness training (B) directly improves user behavior by tailoring content to specific job functions, making the training more relevant and effective. Simulated phishing exercises with reporting metrics (D) provide a measurable way for the security team to track click rates over time, enabling data-driven assessment of improvement. Together, they address both behavioral change and quantifiable measurement.

Exam trap

CompTIA often tests the distinction between passive awareness (like annual emails) and active, measurable training (like simulated phishing with metrics), leading candidates to mistakenly select a single control that only addresses one aspect of the goal.

Practice this question →

120

MCQmedium

The CIO wants to compare two mitigation options for a payment system outage and justify the budget request in dollars. The team already knows the likely downtime window, annual incident frequency, and estimated revenue loss per hour. Which approach would best support the decision?

A.Qualitative risk analysis

B.Quantitative risk analysis

C.Risk avoidance

D.Risk acceptance

AnswerB

Quantitative risk analysis uses measurable values like threat frequency, downtime, and financial loss to calculate metrics such as Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE). This approach enables a direct monetary comparison of mitigation alternatives, supplying the cost-benefit data the CIO needs to justify spending in budget requests.

Why this answer

Quantitative risk analysis (Option B) is correct because it uses numerical data—such as the likely downtime window, annual incident frequency, and estimated revenue loss per hour—to calculate a monetary value (e.g., Annualized Loss Expectancy). This directly supports the CIO's need to compare mitigation options in dollars and justify a budget request with hard numbers, unlike qualitative methods that rely on subjective ratings.

Exam trap

The trap here is that candidates confuse qualitative risk analysis with quantitative risk analysis, assuming that any risk assessment involving 'analysis' can produce dollar figures, but qualitative methods only yield ordinal rankings, not monetary values.

How to eliminate wrong answers

Option A is wrong because qualitative risk analysis uses subjective ratings (e.g., high/medium/low) rather than hard dollar figures, so it cannot provide the precise monetary comparison the CIO needs for budget justification. Option C is wrong because risk avoidance means eliminating the activity causing the risk (e.g., discontinuing the payment system), which is not a comparison of mitigation options but a drastic measure that would halt business operations. Option D is wrong because risk acceptance means acknowledging the risk without taking action, which does not involve comparing mitigation options or justifying a budget request—it simply accepts the potential loss.

Practice this question →

121

MCQmedium

A hospital's claims portal has two open risks. Risk A is an internet-facing login page with a low-severity software flaw, but monitoring shows a steady increase in automated login attempts. Risk B is an internal file share with a medium-severity patch gap, but only a small admin group can access it and no exploitation is observed. Leadership can fund only one remediation this month. Which risk should be prioritized first?

A.Prioritize Risk A because it is exposed to the internet and already shows active attack interest.

B.Prioritize Risk B because a medium-severity flaw is always more important than a low-severity flaw.

C.Accept Risk A because no confirmed compromise has occurred yet.

D.Transfer Risk A to an insurer because public-facing exposure cannot be reduced.

AnswerA

Risk A has the higher overall business risk because exposure and observed attack activity raise the likelihood of exploitation. Even if the flaw is rated low severity, an internet-facing system is more likely to be targeted quickly and broadly. Prioritization should consider both impact and likelihood, not severity alone. Addressing the public login page first reduces the chance of a successful compromise across a high-value service.

Why this answer

Risk A should be prioritized because the internet-facing login page is exposed to the public attack surface, and the steady increase in automated login attempts indicates active reconnaissance or credential-stuffing attacks. Even though the software flaw is low severity, the combination of internet exposure and active attacker interest significantly elevates the likelihood of exploitation, making it a higher priority than an internal file share with no observed exploitation.

Exam trap

The trap here is that candidates fixate on severity ratings (low vs. medium) without considering the risk equation, especially the critical factor of active attack interest and internet exposure, which the SY0-701 exam emphasizes in the context of threat intelligence and attack surface management.

How to eliminate wrong answers

Option B is wrong because it incorrectly assumes severity alone determines priority; in risk management, likelihood (internet exposure, active attack interest) and impact must be weighed together, and a medium-severity flaw with no exploitation and limited access is less urgent than a low-severity flaw under active attack. Option C is wrong because accepting a risk without remediation is only appropriate when the residual risk is within the organization's tolerance, but here the active attack interest and internet exposure create an unacceptable level of risk that requires immediate action.

Practice this question →

122

MCQeasy

A file contains employee Social Security numbers and bank account details. The company uses the labels Public, Internal, Confidential, and Restricted. Which label is most appropriate?

A.Public, because employees may need to share it with outside vendors

B.Internal, because only company staff should see it

C.Confidential, because the information is sensitive but not highly regulated

D.Restricted, because it contains highly sensitive personal and financial information

AnswerD

Restricted is correct because this file contains highly sensitive personal data (SSNs) and financial account numbers, which are commonly classified at the highest level of restriction. Such data requires strong access controls, encryption, audit logging, and adherence to privacy regulations, as a breach could lead to identity theft, financial fraud, and legal penalties. Restricted classification ensures only authorized personnel with a legitimate business need can access the data.

Why this answer

Social Security numbers and bank account details are classified as personally identifiable information (PII) and financial data, which are subject to strict regulatory requirements (e.g., GDPR, PCI DSS). The 'Restricted' label is designed for the most sensitive data that requires the highest level of access control and encryption, making it the correct choice for this scenario.

Exam trap

The trap here is that candidates may confuse 'Confidential' with 'Restricted', assuming any sensitive data fits the 'Confidential' label, but 'Restricted' is specifically reserved for data that is both highly sensitive and subject to regulatory compliance requirements.

How to eliminate wrong answers

Option A is wrong because labeling this data as 'Public' would allow unrestricted access, violating data privacy regulations and exposing the company to legal penalties. Option B is wrong because 'Internal' is typically used for data that is not sensitive but should not be shared externally, whereas SSNs and bank details require more stringent controls. Option C is wrong because 'Confidential' is often used for sensitive business data (e.g., trade secrets), but it does not imply the highest level of protection needed for highly regulated personal financial information; 'Restricted' is the appropriate label for such data.

Practice this question →

123

MCQhard

Based on the exhibit, what should the records manager do next?

A.Delete the records on schedule because the retention period is still the primary rule.

B.Move the records to long-term archive and continue the normal deletion schedule.

C.Print the records, delete the digital copies, and keep the paper copies instead.

D.Suspend deletion and preserve all related records until the legal hold is formally lifted.

AnswerD

A legal hold takes precedence over the routine retention schedule. Because counsel explicitly instructed the organization to preserve all related communications and prevent deletion or alteration, the records manager must stop auto-deletion and ensure the data remains intact. This supports legal defensibility and audit readiness while avoiding accidental spoliation of evidence.

Why this answer

When a legal hold is in effect, it overrides any standard retention or deletion policies. The records manager must suspend all deletion activities and preserve all related records until the legal hold is formally lifted, as failure to do so could result in spoliation of evidence and legal penalties.

Exam trap

The trap here is that candidates may assume retention schedules are absolute, but legal holds are a higher-priority legal obligation that overrides standard data lifecycle policies.

How to eliminate wrong answers

Option A is wrong because it ignores the legal hold, which supersedes the retention period as the primary rule when litigation is pending. Option B is wrong because moving records to long-term archive does not satisfy the legal hold requirement; the hold requires preservation of all records, not just a change in storage location, and continuing a normal deletion schedule could destroy relevant data. Option C is wrong because printing digital copies and deleting the originals would destroy metadata and potentially violate the legal hold, as the original digital records may be required for e-discovery in their native format.

Practice this question →

124

MCQhard

Based on the exhibit, what should the security team add before approving the vendor's requested change?

A.A broader employee awareness training requirement for the vendor's staff.

B.A contract clause requiring prior written approval for new subprocessors and flow-down security obligations.

C.A larger cyber insurance policy to cover possible losses if the vendor is breached.

D.A request for the vendor to send monthly screenshots of its backup jobs.

AnswerB

This is the strongest control because the risk comes from an unapproved change in the supply chain. Prior approval gives the customer visibility into who will process the data, and flow-down obligations ensure the subcontractor must meet the same security requirements. That directly addresses third-party risk, unlike insurance or generic training.

Why this answer

The exhibit shows the vendor requesting a change to use a new subprocessor for data storage. The security team must ensure that the vendor's contract includes a clause requiring prior written approval for new subprocessors and that security obligations flow down to them. This directly addresses the risk of unauthorized data handling by third parties, which is a key concern in vendor risk management.

Exam trap

CompTIA often tests the distinction between reactive controls (like insurance or monitoring) and proactive contractual controls (like approval clauses) in vendor change management scenarios, leading candidates to pick a monitoring or financial solution instead of the correct governance measure.

How to eliminate wrong answers

Option A is wrong because broader employee awareness training for the vendor's staff does not address the specific risk of a new subprocessor being introduced without oversight; training is a general control, not a contractual safeguard for subprocessor changes. Option C is wrong because a larger cyber insurance policy covers financial losses after a breach but does not prevent the unauthorized use of a subprocessor or enforce security obligations proactively. Option D is wrong because monthly screenshots of backup jobs provide only a point-in-time verification of backups, not a mechanism to control or approve changes to subprocessors or ensure security requirements are met.

Practice this question →

125

MCQhard

Based on the exhibit, which risk treatment should the security manager recommend first?

A.Accept the risk and document it for the next quarterly review.

B.Avoid the risk by permanently shutting down the file transfer service.

C.Mitigate the risk by replacing or isolating the appliance and removing direct internet exposure.

D.Transfer the risk by purchasing cyber insurance and keeping the current configuration.

AnswerC

Mitigation is best because the asset is unsupported, internet-facing, and processes sensitive tax data. The cost to replace is manageable compared with the exposure. A WAF alone does not adequately protect an unsupported service, so the manager should reduce the vulnerability and exposure directly.

Why this answer

The exhibit shows a legacy file transfer appliance with direct internet exposure and known unpatched vulnerabilities. The most immediate and effective risk treatment is to mitigate the risk by replacing or isolating the appliance and removing its direct internet exposure. This directly reduces the likelihood of exploitation by eliminating the attack surface, which aligns with the principle of defense-in-depth and is the first step before considering acceptance, avoidance, or transfer.

Exam trap

The trap here is that candidates may confuse 'transfer the risk' (Option D) with a proactive security measure, when in fact cyber insurance is a financial risk transfer that does not address the technical vulnerability, whereas mitigation (Option C) directly reduces the likelihood of exploitation.

How to eliminate wrong answers

Option A is wrong because accepting the risk without any compensating controls would leave a vulnerable, internet-facing appliance actively exploitable, which is irresponsible and violates the principle of due care. Option B is wrong because permanently shutting down the file transfer service would disrupt business operations and likely violate service-level agreements, making it an overly drastic and unnecessary first step when isolation and patching are feasible. Option D is wrong because transferring the risk via cyber insurance does not reduce the likelihood or impact of a breach; it only provides financial compensation after an incident, leaving the vulnerable appliance exposed and operational.

Practice this question →

126

MCQhard

Based on the exhibit, what is the best data-handling action before sharing the file with the third party?

A.Send the full spreadsheet encrypted and let the vendor filter out the extra columns.

B.Redact the unnecessary sensitive fields and provide only the minimum necessary extract after approval.

C.Mark the spreadsheet as internal and share it through the benefits contractor's cloud portal.

D.Send the file unchanged because the contractor signed a nondisclosure agreement.

AnswerB

This follows data minimization and handling requirements. The third party only needs names, email addresses, and benefits selections, so bank and government-ID fields should be removed before sharing. Encryption alone is not enough because the recipient would still receive more data than needed. This approach reduces privacy exposure and aligns with the policy note in the exhibit.

Why this answer

Data minimization and the principle of least privilege require that only the minimum necessary sensitive data be shared with a third party. Redacting unnecessary sensitive fields and obtaining approval ensures compliance with data protection policies and reduces the risk of unauthorized exposure, even if the recipient has signed an NDA.

Exam trap

CompTIA often tests the misconception that a signed NDA or encryption alone is sufficient to share all data, when in fact data minimization and formal approval are required to meet security and compliance standards.

How to eliminate wrong answers

Option A is wrong because sending the full spreadsheet with extra columns still exposes sensitive data that the vendor does not need, violating data minimization and increasing breach risk. Option C is wrong because marking the spreadsheet as 'internal' and sharing via the contractor's cloud portal does not remove sensitive fields and may bypass proper access controls, as the portal may not enforce data redaction. Option D is wrong because a nondisclosure agreement does not justify sharing all data unchanged; it does not eliminate the need to limit data to the minimum necessary for the task.

Practice this question →

127

MCQhard

Based on the exhibit, which metric best shows that employees are recognizing and escalating phishing attempts more quickly?

A.Click rate, because a lower click rate is the only useful awareness metric.

B.Training completion rate, because it proves every employee attended the awareness session.

C.Median report time, because it shows how quickly users notify security after spotting a phish.

D.Number of simulation emails sent, because a larger campaign is always a better metric.

AnswerC

Median report time best demonstrates faster recognition and escalation, which reduces attacker dwell time and improves response. In the exhibit, the median time dropped from 8 minutes to 3 minutes, showing better behavior under pressure. Click rate is still useful, but quick reporting is the stronger indicator of resilience and response readiness.

Why this answer

The median report time directly measures the speed at which employees notify the security team after identifying a phishing simulation email. A decreasing median report time indicates that users are recognizing phishing attempts more quickly and escalating them, which is the key behavioral change this metric captures. Unlike click rate, which only measures failure, report time measures the positive action of reporting.

Exam trap

The SY0-701 exam often tests the distinction between metrics that measure awareness (e.g., training completion) versus metrics that measure behavioral change (e.g., median report time), and candidates mistakenly choose click rate because it is a common phishing metric, but it does not capture the speed of escalation.

How to eliminate wrong answers

Option A is wrong because click rate measures the percentage of users who clicked a phishing link, which indicates failure to recognize a phish, not the speed of recognition or escalation; a lower click rate is useful but does not show how quickly users report. Option B is wrong because training completion rate only proves attendance, not whether employees learned to recognize or escalate phishing attempts; it is a proxy for exposure, not effectiveness. Option D is wrong because the number of simulation emails sent is a measure of campaign scale, not user behavior; a larger campaign does not inherently indicate faster recognition or reporting.

Practice this question →

128

MCQeasy

A policy states that sensitive data must be encrypted, but it does not say which encryption strength to use. The security architect wants a document that lists the exact approved encryption settings for systems to follow. What document is needed?

A.A procedure, because it explains the step-by-step order for handling every file.

B.A standard, because it specifies the required technical values and configurations.

C.A guideline, because it gives suggestions that teams may choose to adopt.

D.A memo, because it is the fastest way to tell teams about a new requirement.

AnswerB

A standard is the right document when the organization needs exact, mandatory technical settings such as approved encryption strength or configuration values. The policy provides the high-level requirement, while the standard translates that requirement into measurable controls that systems and auditors can follow consistently.

Why this answer

A standard is the correct document because it mandates specific, measurable technical requirements—such as exact encryption algorithms (e.g., AES-256), key lengths, and cipher modes (e.g., GCM)—that systems must follow to comply with the policy. Unlike a policy, which states a goal (e.g., 'encrypt sensitive data'), a standard provides the enforceable configuration baseline that the security architect needs.

Exam trap

The trap here is confusing a standard with a guideline: candidates often pick 'guideline' because both documents provide technical details, but a standard is mandatory and prescriptive, while a guideline is advisory and flexible.

How to eliminate wrong answers

Option A is wrong because a procedure details the step-by-step order for performing a task (e.g., how to encrypt a file using a specific tool), not the approved encryption settings themselves. Option C is wrong because a guideline offers recommendations or best practices that teams may choose to adopt, but the security architect requires mandatory, exact values, not optional suggestions. Option D is wrong because a memo is an informal communication method, not a formal document that defines technical requirements; it lacks the authority and precision needed for enforcing encryption configurations.

Practice this question →

129

MCQhard

Based on the exhibit, which governance artifact is being described?

A.Policy, because it states broad organizational intent without requiring specific settings.

B.Standard, because it defines mandatory requirements but does not describe a step-by-step process.

C.Procedure, because it explains the exact sequence an administrator should follow to secure the device.

D.Baseline, because it defines the approved minimum configuration that systems must meet.

AnswerD

The exhibit is labeled as a minimum configuration and lists required settings that establish the approved security floor for all laptops. That is the classic purpose of a baseline. It provides a reference point for configuration consistency and drift detection, and it is often approved by security and technical owners together. The annual review cycle also fits a controlled baseline update process.

Why this answer

The exhibit describes a baseline because it specifies the approved minimum configuration settings that systems must meet, such as requiring AES-256 encryption, disabling weak protocols like SSL and TLS 1.0, and enforcing a minimum password length of 14 characters. These are mandatory security thresholds, not broad intent, step-by-step instructions, or optional standards.

Exam trap

The trap here is that candidates confuse a standard with a baseline, but a standard is a broader mandatory requirement (e.g., 'use encryption') while a baseline specifies the exact minimum acceptable configuration (e.g., 'use AES-256 with a key length of 256 bits').

How to eliminate wrong answers

Option A is wrong because a policy states broad organizational intent and high-level goals, not specific configuration settings like 'AES-256 encryption' or 'disable SSL/TLS 1.0'. Option B is wrong because a standard defines mandatory requirements but does not include the specific numeric thresholds or approved minimum values that a baseline does; the exhibit lists exact minimums (e.g., 14-character passwords), which is characteristic of a baseline. Option C is wrong because a procedure provides a step-by-step sequence of actions, whereas the exhibit only lists required configuration states without any ordered instructions.

Practice this question →

130

MCQmedium

Based on the exhibit, which metric best indicates improved phishing resistance?

A.Training completion rate.

B.Number of phishing emails sent by attackers.

C.Phish report rate.

D.Total number of help desk tickets.

AnswerC

Phish report rate measures the proportion of simulated or real phishing deliveries that users report through the designated reporting mechanism. It directly reflects whether employees are not only recognizing suspicious messages but also taking the correct security action, making it a leading indicator of phishing resistance. Higher report rates typically correlate with lower engagement with malicious emails and better SOC visibility.

Why this answer

The phish report rate measures how many users report a simulated phishing email to the security team, which directly indicates their ability to recognize and respond to phishing attempts. A higher report rate demonstrates improved security awareness and resistance because users are actively identifying threats rather than ignoring or falling for them. This metric is a key performance indicator in security awareness programs because it reflects behavioral change, not just training completion.

Exam trap

CompTIA often tests the misconception that training completion rate (Option A) is the best indicator of security awareness, but the exam emphasizes that behavioral metrics like phish report rate are more meaningful because they measure actual user response to threats.

How to eliminate wrong answers

Option A is wrong because training completion rate only measures whether users finished the training module, not whether they retained or applied the knowledge to resist phishing attacks. Option B is wrong because the number of phishing emails sent by attackers is an external threat metric that the organization cannot control and does not reflect user resistance or program effectiveness. Option D is wrong because the total number of help desk tickets is a broad metric that includes many unrelated issues (e.g., password resets, software problems) and does not specifically measure phishing resistance or user reporting behavior.

Practice this question →

131

Multi-Selectmedium

A manufacturing company must keep a legacy scheduling application running for 60 days while replacement testing finishes. The application supports production orders, and the business cannot tolerate a shutdown. Which three conditions should be required before approving the temporary exception? Select three.

Select 3 answers

A.Assign a named risk owner who is authorized to accept the residual risk.

B.Set a clear expiration date and mandatory review point before renewal.

C.Implement a compensating control such as network restriction or added monitoring.

D.Rely on the vendor's promise that a better version will be available eventually.

E.Approve an unlimited waiver so operations do not need to revisit the issue.

AnswersA, B, C

Assigning a named risk owner who is authorized to accept the residual risk is essential because it formalizes accountability. Only a business owner with the proper authority can consciously accept the remaining exposure after implementing mitigations, ensuring the decision is documented, understood, and aligned with the organization's risk appetite. Without this explicit acceptance, the residual risk is left unowned, potentially leading to oversight or unintended assumptions of liability.

Why this answer

Assigning a named risk owner who is authorized to accept residual risk is a fundamental requirement for any risk exception. This ensures accountability and that a specific individual with the authority to accept the potential consequences of running an unsupported system is identified. Without a designated owner, the exception lacks governance and could lead to unmanaged exposure.

Exam trap

The trap here is that candidates might think only one or two of these conditions are needed, but the SY0-701 exam expects all three—risk owner, expiration/review, and compensating controls—to be present for a valid risk exception.

Practice this question →

132

MCQeasy

After several rounds of phishing simulations, management wants a metric that best shows employees are improving at recognizing suspicious messages. Which metric should security track?

A.The number of training emails sent to employees each month.

B.The percentage of users who report simulated phishing emails to security.

C.The number of spam emails blocked by the mail gateway.

D.The number of help desk tickets closed within the month.

AnswerB

Reporting suspicious messages is a strong behavioral indicator that users recognize phishing and know what to do with it. An increasing report rate is a practical metric for awareness improvement because it measures real user action, not just training attendance.

Why this answer

The percentage of users who report simulated phishing emails to security directly measures behavioral change, showing that employees are actively recognizing and acting on suspicious messages. This metric reflects the effectiveness of security awareness training by tracking the desired response—reporting—rather than passive metrics like email volume or ticket counts.

Exam trap

CompTIA often tests the distinction between input metrics (e.g., training sent) and outcome metrics (e.g., user reporting), leading candidates to choose a metric that sounds related but does not measure actual behavioral improvement.

How to eliminate wrong answers

Option A is wrong because the number of training emails sent measures only the volume of communication, not whether employees learned or applied the training; it is an input metric, not an outcome. Option C is wrong because spam emails blocked by the mail gateway is a technical control metric, unrelated to employee behavior or phishing recognition skills. Option D is wrong because help desk tickets closed within the month measures operational efficiency, not employee ability to identify phishing attempts.

Practice this question →

133

MCQmedium

Based on the exhibit, what is the best risk response for the security team to recommend before the customer portal goes live?

A.Accept the risk now, because the WAF rule lowers exposure enough for launch.

B.Mitigate the risk by remediating the vulnerability before production release.

C.Transfer the risk to the hosting provider through a service-level agreement.

D.Avoid the risk by permanently canceling the customer portal project.

AnswerB

This is the best choice because the exhibit shows a high-likelihood, high-impact issue with a fix available in time for launch. The policy also says critical internet-facing vulnerabilities should not be accepted when remediation is available. A real fix reduces the underlying exposure more effectively than a temporary control.

Why this answer

The exhibit shows a critical SQL injection vulnerability in the customer portal that has been partially mitigated by a WAF rule. However, WAF rules can be bypassed (e.g., through encoding tricks or HTTP parameter pollution), so the residual risk remains high. The best response is to remediate the vulnerability in the application code before launch, which directly removes the root cause and aligns with the principle of defense in depth.

Exam trap

The trap here is that candidates assume a WAF provides complete protection and thus choose 'accept the risk,' but the SY0-701 exam emphasizes that compensating controls like WAFs are not a substitute for fixing the underlying vulnerability.

How to eliminate wrong answers

Option A is wrong because accepting risk with only a WAF rule in place is insufficient—WAFs are not foolproof and can be evaded by sophisticated SQLi payloads, leaving the database exposed. Option C is wrong because transferring risk to a hosting provider via SLA does not absolve the organization of liability for application-layer vulnerabilities; the provider typically only covers infrastructure uptime, not code-level flaws. Option D is wrong because permanently canceling the project is an extreme avoidance response that ignores the business need and the feasibility of fixing the vulnerability before launch.

Practice this question →

134

MCQmedium

A company is signing a contract with a SaaS expense platform. Security wants the vendor to notify the company within 24 hours of a confirmed incident, maintain customer data segregation, and allow the company to verify security commitments if required. Which control should be added to the agreement?

A.A non-disclosure agreement only

B.A security addendum with SLA terms

C.A verbal assurance from the account representative

D.The vendor's standard public terms without changes

AnswerB

A security addendum with SLA terms contractually binds the vendor to the 24-hour breach notification window, enforces logical customer data segregation, and grants audit rights to verify commitments. Embedding these as enforceable service-level obligations satisfies all three stem constraints, unlike generic policy statements or technical controls the company cannot impose on a SaaS provider.

Why this answer

A security addendum with SLA terms is the correct control because it contractually binds the vendor to specific security obligations — 24-hour incident notification, data segregation, and the right to audit or verify security commitments. An addendum supplements the master agreement with enforceable security requirements, and SLA terms define measurable performance and response expectations. This gives the company legal recourse if the vendor fails to meet those commitments.

Exam trap

SY0-701 often tests the difference between an NDA (confidentiality only) and a security addendum/SLA (enforceable security and performance obligations) — candidates who pick the NDA overlook the need for incident notification and audit rights.

How to eliminate wrong answers

Option A is wrong because an NDA only protects confidential information disclosure; it does not impose incident notification timelines, data segregation requirements, or audit rights. Option C is wrong because a verbal assurance is unenforceable and provides no contractual accountability. Option D is wrong because accepting the vendor's standard public terms without modification leaves the company without the specific security guarantees it requires.

Practice this question →

135

MCQmedium

A development manager wants to copy a production customer database into a test environment so testers can reproduce a bug. The database contains names, addresses, and payment tokens. What is the best security practice before the copy is made?

A.Copy the production database unchanged and limit access to the QA team.

B.Mask, tokenize, or replace sensitive fields with approved test data before moving it.

C.Compress the database export to reduce storage and transfer time.

D.Encrypt the database backup and give developers the decryption key.

AnswerB

Masking or tokenizing sensitive fields is the best practice because it preserves the data structure needed for testing while reducing privacy risk. The test environment should not contain raw customer information unless there is a strong approved need. Using approved test data limits exposure if the environment is compromised or shared more broadly than intended.

Why this answer

Copying production data containing sensitive information (names, addresses, payment tokens) into a test environment without sanitization violates data minimization and privacy principles (e.g., GDPR, PCI DSS). The best practice is to apply data masking, tokenization, or substitution with realistic but non-sensitive test data before the copy, ensuring that the test environment does not expose real customer data. This prevents accidental data leakage and reduces compliance risk while still allowing testers to reproduce the bug with functionally equivalent data.

Exam trap

The trap here is that candidates may think limiting access (Option A) is sufficient, but the exam emphasizes that data protection must be applied to the data itself, not just to access controls, especially when moving data to a less secure environment.

How to eliminate wrong answers

Option A is wrong because copying the production database unchanged and limiting access to the QA team does not eliminate the sensitive data from the test environment; any access control misconfiguration or insider threat could expose real customer data, and it violates the principle of least privilege and data minimization. Option C is wrong because compressing the database export only reduces storage and transfer time but does nothing to protect sensitive fields; it is a performance optimization, not a security control.

Practice this question →

136

MCQmedium

A payroll SaaS provider has passed initial review, but before contract signing it announces that customer data will be processed by a new subcontractor in another country. The business wants to keep the onboarding timeline short, but security still needs assurance that the change does not increase exposure. What is the BEST next step?

A.Approve the vendor because the primary provider already passed the initial review.

B.Update the third-party risk assessment and require evidence of the subcontractor's controls before approval.

C.Wait until the first quarterly audit to review the subcontractor change.

D.Accept the change if the vendor provides a marketing brochure describing its security program.

AnswerB

This is the best next step because the change in subcontracting materially alters the risk profile. Security should reassess the provider, review the downstream party's controls, and confirm contractual obligations such as incident notification, data handling, and location requirements. This balances speed with due diligence and ensures the organization has current evidence before customer data is exposed to a new party.

Why this answer

The introduction of a new subcontractor in a different country represents a material change to the data processing environment, which invalidates the initial risk assessment. Security must update the third-party risk assessment to evaluate the subcontractor's controls, such as data protection, encryption standards, and compliance with local regulations, before approval. This ensures that the change does not increase exposure, even if the primary provider passed initial review.

Exam trap

The trap here is that candidates assume passing initial review means all future changes are automatically acceptable, overlooking the need for reassessment when the data processing environment changes, especially with a new subcontractor in a different country.

How to eliminate wrong answers

Option A is wrong because approving the vendor solely based on the primary provider's initial review ignores the material change introduced by the subcontractor, which could have weaker security controls or different legal obligations. Option C is wrong because waiting until the first quarterly audit leaves a gap where the subcontractor could be processing data without any assurance of security, increasing exposure during that period. Option D is wrong because a marketing brochure is not a reliable source of evidence; it lacks verifiable details about the subcontractor's actual security controls, such as encryption protocols, access controls, or audit reports.

Practice this question →

137

MCQmedium

An external auditor asks for proof that quarterly privileged access reviews were completed and that any exceptions were tracked to closure during the last year. Which evidence is MOST appropriate to provide?

A.A screenshot of one administrator's account showing current privileges.

B.Signed access review records and remediation tickets from the access management process.

C.The security policy that says access reviews must happen every quarter.

D.An email from the system administrator stating that reviews were completed on time.

AnswerB

This is the best evidence because it directly shows the process was performed and that findings were handled. Signed review records demonstrate that quarterly reviews occurred, and remediation or exception tickets show that identified issues were tracked and resolved. Auditors look for traceable, repeatable evidence rather than isolated screenshots or verbal confirmation, so process records are the strongest support.

Why this answer

Signed access review records provide verifiable proof that quarterly reviews were conducted, and remediation tickets demonstrate that any exceptions (e.g., excessive privileges) were tracked and resolved. This aligns with the principle of audit evidence: it must be objective, verifiable, and show a complete chain of actions from review to closure. A screenshot or policy alone lacks the audit trail of actual completion and exception handling.

Exam trap

The trap here is that candidates confuse policy documentation (Option C) or informal communication (Option D) with actual audit evidence, failing to recognize that only signed records and remediation tickets provide the verifiable, objective proof required by an external auditor.

How to eliminate wrong answers

Option A is wrong because a screenshot of one administrator's current privileges only shows a point-in-time snapshot, not evidence that quarterly reviews were completed or that exceptions were tracked to closure over the last year. Option C is wrong because a security policy stating that reviews must happen every quarter is a directive, not proof that the reviews actually occurred or that exceptions were resolved. Option D is wrong because an email from the system administrator is hearsay evidence; it is not an objective, auditable record and does not provide the signed review records or remediation tickets required for compliance.

Practice this question →

138

MCQmedium

A security manager at a hospital is reviewing the annual vendor risk assessment for a cloud-based electronic health record (EHR) provider. The provider's SOC 2 Type II report, issued six months ago, identifies a significant deficiency in logical access controls: the provider failed to revoke access for former employees in a timely manner. The provider's management has asserted that this deficiency has been fully remediated, but the next SOC 2 audit is not scheduled for another eight months. The hospital's data protection policy requires that any vendor handling protected health information (PHI) must have a current SOC 2 Type II report with no unresolved significant deficiencies. Which of the following is the most appropriate next step for the security manager?

A.Accept the vendor's assertion that the deficiency has been remediated and continue the relationship as is.

B.Require the vendor to provide a bridge letter from their external auditor confirming that the remediation has been implemented and is operating effectively.

C.Immediately terminate the contract with the EHR provider and begin the process of selecting a new vendor.

D.Increase the frequency of manual access reviews performed by the hospital's internal IT staff on the vendor's systems.

AnswerB

A bridge letter is a formal letter issued by the vendor's external service auditor that addresses the period between the original SOC 2 report's end date and the current date. It provides independent, auditor-attested confirmation that the previously identified significant deficiency has been remediated and that the controls were operating effectively during the interim period. This is the standard industry practice for accepting client remediation when a full new SOC 2 report is not yet available, because it gives the hospital third-party assurance rather than relying solely on the vendor's own claim. Requiring this letter satisfies the policy's demand for independent verification while avoiding unnecessary contract termination.

Why this answer

The hospital's policy requires a current SOC 2 Type II report with no unresolved significant deficiencies. Since the deficiency was reported but is claimed to be fixed, a bridge letter from the external auditor provides independent assurance that the remediation is effective and operating as intended, bridging the gap until the next formal audit. This is the most appropriate step because it maintains compliance without prematurely terminating a critical vendor relationship.

Exam trap

The trap here is that candidates may think a vendor's self-attestation (Option A) is sufficient, but the SY0-701 exam emphasizes that independent third-party verification (like a bridge letter) is required when a significant deficiency exists and the next audit is months away.

Why the other options are wrong

The hospital's policy requires a current SOC 2 Type II report with no unresolved significant deficiencies. Accepting the vendor's assertion without independent verification violates this policy and exposes the hospital to compliance risk.

Immediate termination is too drastic; the vendor has asserted remediation and a bridge letter can provide interim assurance without disrupting healthcare operations.

Practice this question →

139

MCQmedium

A cloud-hosted invoicing app has a critical vulnerability, but the vendor says a patch will not be available for six weeks. The team adds a web application firewall rule, restricts access to the app subnet, and increases monitoring until the patch arrives. What is this best described as?

A.Risk avoidance, because the system is being shut down permanently.

B.Risk transfer, because the vendor is responsible for the vulnerability.

C.Compensating control, because temporary safeguards reduce exposure until the patch is available.

D.Residual risk acceptance, because the vulnerability is being ignored until next quarter.

AnswerC

A compensating control is an alternative safeguard deployed when the primary control—here, the vendor's patch—cannot be implemented immediately. Examples include a web application firewall rule to block exploit attempts, network segmentation to isolate the app, or enforced multi-factor authentication to reduce compromise likelihood. These temporary measures reduce residual exposure, which is exactly the correct risk treatment until the official fix is applied.

Why this answer

The team deployed temporary security measures—a web application firewall (WAF) rule, subnet access restrictions, and enhanced monitoring—to reduce the risk exposure while waiting for the vendor's patch. These are compensating controls, which are alternative safeguards that mitigate a vulnerability when the primary control (the patch) cannot be implemented immediately. The scenario explicitly states the patch is six weeks away, making these interim measures a textbook compensating control.

Exam trap

The trap here is that candidates confuse 'compensating control' with 'risk acceptance' because both involve living with a vulnerability, but compensating controls actively reduce risk through temporary safeguards, whereas risk acceptance means no additional controls are applied.

How to eliminate wrong answers

Option A is wrong because risk avoidance would mean permanently shutting down or removing the invoicing app, but the team kept it running with additional safeguards. Option B is wrong because risk transfer involves shifting the financial impact of a risk to a third party (e.g., cyber insurance), not assigning responsibility for a vulnerability to the vendor. Option D is wrong because residual risk acceptance implies knowingly tolerating the remaining risk after controls are applied, but here the team actively implemented controls to reduce exposure, not ignored the vulnerability until next quarter.

Practice this question →

140

MCQeasy

An employee receives an email that appears to be from the CEO and asks for gift cards before a meeting. What should the employee do first?

A.Report the message through the approved security channel and verify the request by a separate method.

B.Buy the gift cards immediately so the CEO is not delayed.

C.Forward the email to coworkers so they can watch for the same request.

D.Reply to the sender and ask for more details in the same email thread.

AnswerA

This is correct because urgent gift card requests are a common social engineering tactic. The safest first step is to report the message and verify the request using a known, separate contact method. That prevents accidental compliance and helps the security team evaluate whether the email is fraudulent.

Why this answer

The first action in response to a suspected phishing or social engineering attack is to report it through the approved security channel, which ensures the incident is logged and can be investigated. Separately verifying the request—such as by calling the CEO or using a known, trusted contact method—confirms the legitimacy of the request without relying on the potentially compromised email thread. This aligns with security policy best practices for incident response and prevents unauthorized disclosure of funds or credentials.

Exam trap

The trap here is that candidates may think immediate action (buying gift cards) shows responsiveness, but the exam emphasizes that verification and reporting are the mandatory first steps in any social engineering incident response.

How to eliminate wrong answers

Option B is wrong because immediately purchasing gift cards based on an unsolicited email bypasses all verification and security controls, directly enabling a common social engineering scam. Option C is wrong because forwarding the email to coworkers could spread the phishing attempt, potentially compromising additional accounts or systems, and violates the principle of containment. Option D is wrong because replying in the same email thread keeps the attacker in the communication loop and does not verify the sender's identity; the attacker may simply provide more convincing details to manipulate the employee.

Practice this question →

141

MCQmedium

After a phishing campaign, 18 employees entered credentials on a fake login page. Management wants a program that both reduces future click rates and provides measurable improvement over time. What should security implement?

A.A one-time company email reminding employees to be careful

B.Simulated phishing with targeted follow-up training and metrics

C.An updated password complexity rule for all users

D.A banner that all external email is untrusted

AnswerB

A simulated phishing program uses realistic, safe phishing tests that measure employees' real-world click and reporting behavior. Failing users are automatically enrolled in targeted, just-in-time follow-up training that explains the specific cues they missed, turning an error into a learning moment. Over time, the program produces quantitative metrics—click rates, reporting rates, and repeat offenders—that allow the security team to track improvement and adjust training. This aligns with security awareness best practices and specifically addresses the human factor that allowed 18 employees to enter credentials.

Why this answer

Simulated phishing campaigns directly address the human factor by providing a controlled, repeatable test that measures click rates over time. When an employee falls for the simulation, targeted follow-up training (e.g., micro-learning modules) reinforces secure behavior, and the metrics (e.g., click-through rate, reporting rate) allow management to track improvement. This aligns with the security program management goal of continuous improvement through measurable security awareness.

Exam trap

The trap here is that candidates often choose a technical control (like password complexity or email banners) thinking it addresses phishing, but the question specifically asks for a program that reduces click rates and provides measurable improvement—which requires a behavioral, training-based approach with metrics, not a static technical fix.

How to eliminate wrong answers

Option A is wrong because a one-time email reminder provides no mechanism to measure improvement over time and does not actively test or reinforce behavior; it is a static, non-iterative control. Option C is wrong because password complexity rules do not address phishing click rates—they mitigate credential strength but do not prevent users from entering credentials on a fake page. Option D is wrong because an external email banner is a passive indicator that relies on user attention and does not provide training or metrics to reduce click rates or measure improvement.

Practice this question →

142

MCQmedium

Based on the exhibit, what is the best risk treatment recommendation for the security manager?

A.Accept the risk because backups are already enabled.

B.Mitigate the risk with compensating controls until the migration is complete.

C.Avoid the risk by immediately retiring the portal.

D.Transfer the risk by purchasing cyber insurance only.

AnswerB

Mitigation via compensating controls is the best treatment because the service must remain operational and a permanent fix (migration) is already scheduled. Deploying a web application firewall, enforcing multifactor authentication, segmenting the network, and enabling enhanced monitoring reduce the immediate exposure to a level the organization can tolerate. This approach uses the approved budget effectively and preserves business continuity until the migration removes the underlying vulnerability.

Why this answer

The exhibit shows a legacy portal with known vulnerabilities that is scheduled for migration to a modern platform. Since backups alone do not address the active security weaknesses, the best recommendation is to mitigate the risk with compensating controls (e.g., web application firewall rules, network segmentation, or strict access controls) to reduce the likelihood or impact of exploitation until the migration is complete. This aligns with the risk treatment strategy of mitigation, as it actively reduces the risk without prematurely retiring the service or relying solely on insurance.

Exam trap

The trap here is that candidates often confuse risk acceptance (A) with simply having a backup, failing to recognize that backups address only one aspect of risk (availability) and do not mitigate the active vulnerabilities that could lead to data exposure or system compromise.

How to eliminate wrong answers

Option A is wrong because enabling backups only protects data availability, not the confidentiality or integrity of the portal; it does not address the underlying vulnerabilities that could be exploited. Option C is wrong because immediately retiring the portal would cause significant business disruption and is an extreme measure not justified when a scheduled migration is already planned; risk avoidance is appropriate only when the risk outweighs any benefit. Option D is wrong because purchasing cyber insurance transfers only the financial risk, not the operational or reputational risk, and does not reduce the likelihood of a breach; it should be used in conjunction with other controls, not as a standalone treatment.

Practice this question →

143

MCQmedium

A records manager finds a folder of payroll reports on a shared drive. The business says the reports are no longer active, but legal retention rules require keeping them for another two years. What is the best action?

A.Delete the reports immediately because the business no longer uses them

B.Move the reports to an approved archive and retain them for the required period

C.Email the reports to each manager so they can keep their own copy

D.Rename the folder so users do not notice it on the shared drive

AnswerB

Moving the reports to an approved archive—implemented with immutable storage, access logging, and role-based permissions—satisfies the governing retention schedule while also preserving the records' authenticity and metadata for any future audit or e-discovery request. This action removes the sensitive payroll data from the unrestricted shared workspace and places it under formal records management controls, ensuring it remains retrievable for the required period. The archive should also recognize any active legal hold and tag the records for automatic, auditable disposition once that period expires without risk of inadvertent loss.

Why this answer

The reports are subject to a legal retention policy requiring two more years of storage. Moving them to an approved archive ensures they remain accessible for compliance purposes while removing them from the active shared drive, which reduces the risk of accidental modification or deletion. This aligns with data lifecycle management and legal hold procedures.

Exam trap

The trap here is that candidates may assume 'no longer active' means the data can be deleted, ignoring the overriding legal retention requirement, or they may think renaming or distributing files is a valid workaround instead of using a proper archive solution.

How to eliminate wrong answers

Option A is wrong because deleting the reports immediately violates the legal retention requirement, exposing the organization to non-compliance penalties. Option C is wrong because emailing reports to managers creates uncontrolled copies, increases the risk of data leakage, and does not ensure centralized retention or auditability. Option D is wrong because renaming the folder does not address the retention requirement and may lead to data loss or unauthorized access if the folder is still on the shared drive.

Practice this question →

144

MCQeasy

A company wants every corporate laptop to use the same required screen-lock timeout, disk encryption setting, and local administrator restriction. Which document should define these mandatory settings?

A.A guideline, because it offers flexible suggestions for users

B.A standard, because it specifies required configuration values

C.A procedure, because it explains the business reason for security rules

D.A memo, because it is the fastest way to communicate changes

AnswerB

A standard is a formal, mandatory document that defines the exact configuration values (e.g., password policy, OS patch level, encryption settings) that every corporate laptop must adhere to. This creates an enforceable baseline for consistency, compliance, and security audits. Unlike optional recommendations or announcements, a standard is binding and ensures all devices are configured identically.

Why this answer

A standard is the correct document type because it mandates specific, measurable configuration values (e.g., screen-lock timeout of 300 seconds, AES-256 disk encryption, removal of local admin rights) that all corporate laptops must enforce. Standards are binding and establish a baseline for security compliance, unlike guidelines which are advisory. This aligns with the company's requirement for mandatory, uniform settings across all devices.

Exam trap

The trap here is confusing a 'standard' (which sets mandatory, measurable requirements) with a 'guideline' (which is optional and advisory), leading candidates to pick A because they think 'required' implies flexibility, when in fact standards are the only document type that enforces specific configuration values.

How to eliminate wrong answers

Option A is wrong because a guideline offers flexible suggestions or recommendations, not mandatory requirements, so it cannot enforce the required screen-lock timeout, disk encryption, or local administrator restriction. Option C is wrong because a procedure describes step-by-step instructions for performing a task (e.g., how to configure the screen-lock timeout), not the mandatory configuration values themselves; it explains the 'how,' not the 'what must be set.'

Practice this question →

145

MCQeasy

A company wants to state that customer data must not be emailed externally unless a manager approves the exception. Which document type should contain this rule?

A.Policy, because it establishes mandatory organizational rules

B.Guideline, because it gives staff flexible suggestions about email use

C.Procedure, because it lists the exact button clicks for sending email

D.Standard, because it provides a general recommendation for communication

AnswerA

A policy is a mandatory, management-approved directive that establishes organization-wide rules for behavior, defining what is required and the consequences of noncompliance. In this scenario, stating that customer data must not be emailed externally unless an approved exception exists creates an enforceable rule, exactly the role of a policy. It compels employees to follow the prescribed action and allows governance over data handling.

Why this answer

A policy is the correct document type because it establishes mandatory organizational rules that must be followed. The requirement that customer data must not be emailed externally without manager approval is a binding directive, not a suggestion or a step-by-step guide. Policies define high-level security requirements that all employees must comply with, making them the appropriate vehicle for this rule.

Exam trap

The trap here is that candidates often confuse 'policy' with 'standard' or 'guideline', mistakenly thinking a rule about data transmission is a technical standard or a flexible suggestion, when in fact it is a mandatory organizational directive that must be enforced.

How to eliminate wrong answers

Option B is wrong because a guideline provides flexible suggestions or best practices, not mandatory rules; this requirement is a strict prohibition, not a recommendation. Option C is wrong because a procedure lists detailed step-by-step instructions (e.g., exact button clicks in an email client), not a high-level rule about data handling. Option D is wrong because a standard specifies technical specifications or configurations (e.g., encryption protocols like TLS 1.2), not a general rule about data transmission approval.

Practice this question →

146

MCQeasy

A vendor-supported application cannot be patched for 30 days, but the business must keep it online. What is the best short-term risk treatment?

A.Accept the risk without any additional controls

B.Apply a compensating control, such as restricting access and monitoring traffic

C.Delete the application so the vulnerability no longer exists

D.Transfer the risk by telling users to work faster

AnswerB

Applying a compensating control is the correct approach because it provides interim mitigation while the permanent patch is unavailable. Restricting access, such as through network segmentation, IP allowlisting, or disabling internet-facing exposure, directly reduces the attack surface and makes it harder for an attacker to reach the vulnerable service. Concurrently, monitoring traffic with intrusion detection or continuous log review enables early detection of suspicious activity, giving the security team time to respond. This aligns with risk management best practices and is a recognized alternative when patches cannot be immediately deployed.

Why this answer

When a known vulnerability cannot be patched immediately, applying a compensating control—such as restricting network access via firewall rules (e.g., allowing only specific source IPs) and enabling deep packet inspection (DPI) or an intrusion prevention system (IPS) to monitor for exploit attempts—reduces the risk to an acceptable level without taking the application offline. This approach aligns with the principle of defense in depth, buying time until the vendor patch is available.

Exam trap

The trap here is that candidates often confuse 'risk acceptance' (Option A) as a valid short-term treatment, but the question explicitly requires the best treatment when the business must keep the application online, making compensating controls the correct choice over passive acceptance.

How to eliminate wrong answers

Option A is wrong because accepting the risk without any additional controls ignores the active threat and leaves the organization exposed to exploitation of the unpatched vulnerability, which is not a prudent short-term treatment. Option C is wrong because deleting the application is an extreme measure that eliminates the vulnerability but also removes the business functionality entirely, failing the requirement to keep the application online. Option D is wrong because transferring risk by telling users to work faster is not a valid risk treatment; risk transfer involves insurance or outsourcing, not a behavioral directive, and does nothing to mitigate the technical vulnerability.

Practice this question →

147

MCQeasy

After a phishing simulation, many users still nearly entered credentials on the fake page. Security wants the fastest improvement without scheduling long training sessions. What is the best response?

A.Require a full-day classroom course for every employee immediately.

B.Ignore the results because no actual breach occurred.

C.Send a short targeted awareness message with examples, warning signs, and reporting steps.

D.Reset every employee password as the main way to prevent future clicks.

AnswerC

This is the best option because it provides immediate reinforcement with minimal disruption. Targeted communication can quickly remind users what phishing looks like, what clues to watch for, and how to report suspicious messages. It is practical, timely, and easier to absorb than a long training event when the goal is rapid behavior improvement.

Why this answer

A short targeted awareness message directly addresses the observed risky behavior with minimal time investment, providing immediate reinforcement of warning signs and reporting procedures. This approach leverages just-in-time training, which is proven to improve retention and behavior change more effectively than lengthy sessions, aligning with the goal of fastest improvement without disrupting operations.

Exam trap

CompTIA often tests the misconception that immediate technical controls (like password resets) are the fastest fix, when in reality, behavioral reinforcement through targeted communication yields quicker and more sustainable improvement in user vigilance.

How to eliminate wrong answers

Option A is wrong because requiring a full-day classroom course is time-intensive and contradicts the requirement for fastest improvement; it also risks overwhelming employees with information that may not be retained. Option B is wrong because ignoring the results ignores a clear security gap—users nearly entered credentials, indicating a need for awareness improvement to prevent future real attacks. Option D is wrong because resetting every employee password does not address the root cause (user behavior) and is an administrative burden that does not prevent future clicks on phishing pages.

Practice this question →

148

MCQmedium

A security manager at a healthcare organization is reviewing the results of a third-party vendor risk assessment for a cloud-based email service that will store protected health information (PHI). The assessment reveals that the vendor encrypts data at rest using AES-256 but does not support customer-managed encryption keys. The vendor's data center is located in a country that is not subject to HIPAA jurisdiction. The vendor's previous penetration test report is over 18 months old. Which of the following is the most appropriate risk management action for the security manager to take?

A.Accept the risk because the vendor uses strong encryption.

B.Request the vendor to obtain a current SOC 2 Type II report and review the findings before making a decision.

C.Terminate the contract immediately and select a different vendor.

D.Require the vendor to implement customer-managed keys and provide a new penetration test report within 30 days.

AnswerB

A SOC 2 Type II report provides an independent assessment of a service organization's controls over a period of time, including security, availability, and confidentiality. This is directly relevant for a cloud email service handling PHI. Reviewing this report gives the manager sufficient evidence to decide whether the vendor's current controls meet organizational and regulatory requirements.

Why this answer

A SOC 2 Type II report provides an independent assessment of a vendor's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time. Given the vendor's lack of customer-managed keys and outdated penetration test, the security manager needs a current, comprehensive audit report to evaluate whether compensating controls adequately mitigate the risks of storing PHI outside HIPAA jurisdiction. This action allows an informed risk acceptance or mitigation decision without prematurely terminating a potentially compliant service.

Exam trap

The trap here is that candidates may assume strong encryption (AES-256) alone is sufficient for HIPAA compliance, ignoring the broader context of jurisdictional risk, key management, and the need for current third-party audit evidence.

Why the other options are wrong

Accepting risk solely because AES-256 encryption is used ignores other critical risks: the vendor lacks customer-managed keys, is outside HIPAA jurisdiction, and has an outdated penetration test. Strong encryption alone does not ensure HIPAA compliance or adequate security posture.

Terminating the contract immediately is premature because the vendor's lack of customer-managed keys and outdated penetration test are issues that can be addressed through further assessment, such as reviewing a current SOC 2 Type II report, before deciding to terminate.

Requiring the vendor to implement customer-managed keys and provide a new penetration test report within 30 days is not feasible because the vendor does not support customer-managed keys, and 30 days is likely insufficient for a new penetration test. The security manager should first gather more information (e.g., SOC 2 Type II report) before imposing requirements.

Practice this question →

149

Multi-Selectmedium

A security analyst is reviewing the organization’s security awareness program. Which three of the following are key metrics that demonstrate the effectiveness of the program? (Choose three.)

Select 3 answers

.Percentage of employees who complete annual security training

.Number of phishing simulation clicks before and after training

.Total count of security incidents reported by employees

.Average time to patch critical vulnerabilities in production systems

.Number of firewall rule changes approved per quarter

.Percentage of servers with full disk encryption enabled

Why this answer

The percentage of employees who complete annual security training is a key metric because it measures participation in the foundational awareness activity. The number of phishing simulation clicks before and after training directly quantifies behavioral change, showing whether training reduces susceptibility to social engineering. The total count of security incidents reported by employees indicates whether the program has successfully fostered a culture of reporting, which is critical for early threat detection.

Exam trap

The trap here is that candidates confuse operational security metrics (like patch time or encryption coverage) with human-centric awareness metrics, leading them to select technical controls that do not measure employee behavior or program effectiveness.

Practice this question →

150

MCQmedium

A security manager wants every corporate laptop to use the same mandatory settings, including disk encryption, a 10-minute screen lock, and removal of local administrator rights. Which document should define these specific requirements?

A.Policy

B.Standard

C.Guideline

D.Procedure

AnswerB

A standard is the correct document for exact, mandatory configuration requirements. It provides specific, consistent rules such as encryption requirements, lock timers, and privilege restrictions so administrators can implement the same baseline across all laptops. Standards translate policy intent into enforceable technical expectations and make compliance measurable.

Why this answer

A standard defines mandatory, specific technical requirements that must be uniformly applied across all systems, such as enforcing AES-256 disk encryption, a 600-second screen lock timeout, and removal of local administrator rights. Unlike a policy, which is high-level and goal-oriented, a standard provides the precise configuration settings that implement the policy's intent. This aligns with the CompTIA SY0-701 domain of Security Program Management and Oversight, where standards bridge the gap between policy and technical implementation.

Exam trap

The trap here is confusing the broad, principle-based nature of a policy with the specific, mandatory technical requirements of a standard, leading candidates to choose 'Policy' when the question explicitly asks for a document that defines 'specific requirements'.

How to eliminate wrong answers

Option A is wrong because a policy is a high-level statement of management intent and security goals (e.g., 'all laptops must be secured'), not a document that specifies mandatory technical settings like disk encryption algorithms or exact timeout values. Option C is wrong because a guideline is a set of recommended practices or suggestions that are not mandatory, whereas the question explicitly requires 'mandatory settings' that must be enforced on every corporate laptop.

Practice this question →