SY0-701 Security Program Management and Oversight Practice Question
A company is signing a contract with a SaaS expense platform. Security wants the vendor to notify the company within 24 hours of a confirmed incident, maintain customer data segregation, and allow the company to verify security commitments if required. Which control should be added to the agreement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A security addendum with SLA terms
A security addendum or contract clause set is the right place to define incident notification timing, data segregation expectations, and verification rights. These requirements need to be written into a binding agreement so both sides understand their responsibilities and so the customer has leverage if the vendor does not comply. This is stronger than informal assurances or generic privacy language. Why others are wrong: An NDA is about secrecy, not measurable security obligations. A verbal promise is not enforceable and is weak evidence for oversight or audits. Default public terms often favor the vendor and may not cover incident timing or security commitments in enough detail. The organization needs a contract mechanism that clearly states the control expectations, not just a confidentiality promise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A non-disclosure agreement only
Why it's wrong here
An NDA protects confidentiality, but it usually does not define incident timing or operational security requirements.
- ✓
A security addendum with SLA terms
Why this is correct
A security addendum can define incident notice windows, segregation requirements, and enforceable service commitments.
- ✗
A verbal assurance from the account representative
Why it's wrong here
Verbal promises are difficult to enforce and provide weak evidence during audits or disputes.
- ✗
The vendor's standard public terms without changes
Why it's wrong here
Standard terms may not include the specific protections and notification commitments the company needs.
Go deeper
Related to this question
Learn chapter
Security Policies and Procedures
Key term
Confidentiality
Confidentiality means keeping sensitive information secret and accessible only to authorized people or systems.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A supplier tells your company it wants to use a new subcontractor to process customer data. What is the BEST contract control to reduce this risk?
easy- ✓ A.Require the vendor to notify the company before adding subcontractors
- B.Allow subcontractors without review if the vendor remains responsible
- C.Only require a verbal promise that the subcontractor is secure
- D.Remove all contract language related to third parties
Why A: Requiring the vendor to notify the company before adding subcontractors is the best contract control because it ensures the company retains visibility and approval authority over any third party that will process customer data. This aligns with the principle of due diligence and third-party risk management, as the company can assess the subcontractor's security posture before data is shared. Without such a clause, the vendor could unilaterally introduce a subcontractor with inadequate security controls, increasing the risk of a data breach or compliance violation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.