SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Memorandum of understanding

  Why it's wrong here

  An MOU merely documents an agreed-upon framework for collaboration or data sharing between the organizations. It is a legal/business artifact that outlines intentions and responsibilities, but it contains no attestation from an independent auditor about whether any specific security controls were designed or operated effectively. Consequently, it cannot serve as evidence of the vendor's security posture or control performance over time.

• ✓

  SOC 2 Type II report

  Why this is correct

  A SOC 2 Type II report is an independent auditor's attestation of a service organization's controls related to the Trust Services Criteria (e.g., security, availability, confidentiality) over a specified period. The 'Type II' designation specifically indicates that the auditor tested and opined on the operating effectiveness of those controls throughout the review window, not just their design. This directly provides procurement or security teams with assurance that the vendor's security controls were functioning as claimed, which is exactly the evidence needed for a third-party risk assessment of a payroll SaaS provider.

• ✗

  Software license agreement

  Why it's wrong here

  A software license agreement (SLA) is a contractual document that governs usage rights, subscription terms, fees, uptime guarantees, and liability limitations for the software product. While it may include security-related clauses such as data protection commitments or breach notification obligations, these are merely promises or terms, not verified evidence of control implementation. It does not contain any independent audit results or test data demonstrating that security controls were actually effective during a defined operating period.

• ✗

  Network diagram of the vendor's data center

  Why it's wrong here

  A network diagram of the vendor's data center visually depicts the topology, segmented zones, firewalls, load balancers, and other infrastructure components. Although useful for understanding architecture and potential attack surface during a design review, it is purely a static representation—it contains no historical telemetry, audit data, or test results. It cannot demonstrate whether the controls shown on the diagram were actually configured, deployed, or operating effectively over any period, so it lacks the assurance value required for a security evaluation.