SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A public marketing flyer approved for external posting: Public

  Why this is correct

  The public marketing flyer is explicitly approved for external posting, which is the defining criterion for Public classification. Public data is non-sensitive and can be disclosed to anyone without restriction, requiring no access controls or protection mechanisms. Since the flyer is authorized for public distribution, any other classification would conflict with its intended purpose.

• ✓

  An internal org chart and office directory meant only for employees: Internal

  Why this is correct

  The internal org chart and office directory are intended solely for employee use, making them Internal data. Although this information is not highly sensitive, it is not approved for public disclosure, so it cannot be classified as Public. It doesn't meet the threshold for Confidential because it lacks PII or other regulated data, but it still requires access restrictions to company personnel.

• ✓

  A customer case file with contact details and order history: Confidential

  Why this is correct

  A customer case file containing contact details and order history constitutes PII, which falls under Confidential data. This classification demands strict access controls, encryption, and a need-to-know basis to protect customer privacy and comply with regulations. It is more sensitive than Internal but not as critical as Restricted, which is reserved for credentials and secrets.

• ✓

  A vault export containing API keys and encryption secrets: Restricted

  Why this is correct

  A vault export containing API keys and encryption secrets is clearly Restricted, the highest classification level. These credentials, if exposed, could directly compromise systems, data, and infrastructure, so they demand the strongest protections such as hardware security modules, strict access logging, and minimal distribution. Misclassifying them as Confidential would understate the catastrophic impact of a leak.

• ✗

  A vault export containing API keys and encryption secrets: Confidential

  Why it's wrong here

  Labeling a vault export as Confidential is incorrect because it fails to recognize the extraordinary risk posed by API keys and encryption secrets. While Confidential handles PII and other sensitive data, Restricted is reserved for the most critical assets whose exposure would cause severe damage. Vault exports are high-value targets for attackers, so they must be treated as Restricted, not merely Confidential.

• ✗

  A public marketing flyer approved for external posting: Internal

  Why it's wrong here

  Although the flyer is an official communication, its explicit approval for external posting makes it Public, not Internal. Internal classification is reserved for information meant only for company-wide use, and applying it here would improperly restrict distribution and contradict the approval. The flyer contains no sensitive data, so the broadest sharing classification is appropriate.