SY0-701 Security Program Management and Oversight Practice Question
HR needs to send a benefits contractor a file for testing, but the contractor only needs employee names and plan selections. What is the best action before sharing the file?
⚠ Common exam trap
Candidates often confuse trust with security, assuming a trusted third party eliminates the need for data minimization, when in reality least privilege applies regardless of trust level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove all fields the contractor does not need for the task
Data minimization is a core security principle: you should only share the minimum necessary data for the task. By removing all fields the contractor does not need (e.g., Social Security numbers, addresses, salary data), you reduce the attack surface and limit exposure of sensitive personally identifiable information (PII) in case of a breach or misuse.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Send the full file because the contractor is trusted
Why it's wrong here
Trust alone is not a security control; the file almost certainly contains more PII (e.g., Social Security numbers, health/benefits enrollment data, dependents) than the contractor needs. If that full file is exfiltrated or leaked from the contractor's test environment, HR is still responsible for the breach. The principle of data minimization requires sharing only the minimal dataset needed, regardless of the recipient's relationship.
- ✓
Remove all fields the contractor does not need for the task
Why this is correct
Removing fields that are irrelevant to the testing task enforces data minimization and least privilege: the contractor gets only the attributes necessary to validate the file format, calculations, or logic, with no residual PII. This directly reduces the impact of any potential breach and helps satisfy privacy regulations (e.g., HIPAA, GDPR, or state data protection laws) that mandate limiting collection and disclosure. In practice, you might also replace identifiers with synthetic values, but field removal is the minimal, targeted control.
- ✗
Post the file to a public collaboration site with a password
Why it's wrong here
Posting the file to a public collaboration site even with a password violates the intended sharing boundary: the file is still exposed to a third-party platform's infrastructure and anyone who obtains the link or password, and the full dataset remains intact. A password is an access control, not a confidentiality control — it does nothing to reduce the sensitivity of the content if the site is compromised or the password is weak, reused, or shared. This is also a common data-loss scenario where an employee bypasses sanctioned HR systems to 'quickly' share data, creating an undocumented, non-compliant copy.
- ✗
Rename the file so the contents are harder to identify
Why it's wrong here
Renaming the file only changes the filename; the underlying content still contains every field of sensitive HR data, so it remains fully exposed to anyone who opens it. Filenames are metadata, not an encryption or redaction mechanism, and an attacker or accidental recipient could easily identify the data by opening the file. This is essentially security by obscurity, which provides no real protection and does not address the contractor's actual need for only a subset of the data.
Go deeper
Related to this question
Learn chapter
Security Policies and Procedures
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Attack surface
The attack surface is the total sum of all points in a system, network, or application where an unauthorized user can try to enter or extract data.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. HR needs to share a copy of employee records with a benefits contractor for testing. The contractor only needs names and coverage selections, not Social Security numbers or bank details. Which two actions best satisfy data handling requirements? Select two.
medium- ✓ A.Redact or mask unnecessary sensitive fields before sharing the file.
- B.Send the full employee record set because the contractor is trusted.
- ✓ C.Restrict access to the file to approved HR and project staff only.
- D.Upload the file to a public collaboration site so the contractor can retrieve it easily.
- E.Keep an unrestricted copy on multiple shared drives for convenience.
Why A: Redacting or masking sensitive fields like Social Security numbers and bank details ensures that the contractor receives only the necessary data (names and coverage selections) while protecting personally identifiable information (PII). This aligns with the principle of data minimization and compliance with regulations such as GDPR or HIPAA, which require that only the minimum necessary data be shared for a specific purpose. Masking techniques, such as replacing SSNs with placeholders or applying irreversible hashing, prevent unauthorized exposure even if the file is intercepted.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.