How should I use these Security Program Management and Oversight practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

SY0-701 · topic practice

Security Program Management and Oversight practice questions

Q: Can I practise just Security Program Management and Oversight questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security Program Management and Oversight domain.

Security Program Management & Oversight is the domain of the SY0-701 exam that covers how organizations build, maintain, and improve their security programs. Think of it as the 'management layer' of cybersecurity—not the technical tools like firewalls or antivirus, but the policies, procedures, governance, and risk management that ensure those tools are used effectively. In plain English, this domain teaches you how to run a security department like a business: setting goals, measuring performance, managing budgets, complying with laws, and continuously improving. It’s about the 'big picture' decisions that keep an organization safe from cyber threats. Why is this important for real-world IT/security/cloud work? Because technical skills alone won't get you far. A security engineer who can configure a SIEM but doesn't understand incident response plans or compliance requirements (like GDPR or HIPAA) is a liability. In the real world, you’ll need to justify security spending to executives, write policies that balance security with usability, and ensure your cloud infrastructure meets regulatory standards. For example, if you work at a healthcare company, you must know how to implement a security program that protects patient data under HIPAA. This domain gives you the vocabulary and frameworks to communicate with managers, auditors, and legal teams. On the SY0-701 exam, this domain (worth 20% of the score) tests your knowledge of: security governance principles (e.g., policies, standards, procedures), risk management processes (identifying, assessing, and mitigating risks), compliance with laws and regulations (e.g., GDPR, PCI DSS), business continuity and disaster recovery concepts, and security awareness training. You’ll also see questions on third-party risk management, data classification, and security metrics (KPIs). The exam won’t ask you to write a policy, but you must understand the purpose of each document and when to use it. For instance, you should know the difference between a policy (high-level intent) and a procedure (step-by-step instructions). To approach studying this domain, start by memorizing the key documents and their hierarchy: policies → standards → procedures → guidelines. Then, focus on risk management: the steps of risk assessment (identification, analysis, evaluation, treatment) and common risk treatment options (avoid, transfer, mitigate, accept). Use real-world examples: imagine a company storing customer credit card data—what PCI DSS requirements apply? How would you create a business continuity plan for a ransomware attack? Practice with sample questions that ask you to identify the correct policy or control for a given scenario. Since this domain is conceptual, create flashcards for terms like 'due care' vs. 'due diligence,' 'RPO' vs. 'RTO,' and 'quantitative' vs. 'qualitative' risk assessment. Finally, connect the dots: security program management ties together all other domains—it’s the 'why' behind the technical controls you learn elsewhere.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Security Program Management and Oversight

Practice 10 questions Browse domain →

What the exam tests

What to know about Security Program Management and Oversight

Security Program Management & Oversight covers the governance, risk management, compliance, and business continuity aspects of cybersecurity—how to plan, implement, and improve an organization's security program.

Security governance principles: policies, standards, procedures, and guidelines

Risk management process: identification, assessment, analysis, and treatment of risks

Compliance with laws and regulations: GDPR, HIPAA, PCI DSS, SOX, etc.

Business continuity and disaster recovery: BCP, DRP, RTO, RPO, and testing

Security awareness and training: phishing simulations, role-based training, and metrics

Third-party risk management: vendor assessments, SLAs, and due diligence

Why learners struggle

Why Security Program Management and Oversight questions are commonly missed

RAM questions are commonly missed because learners confuse physical form factors (DIMM vs SO-DIMM) and fail to distinguish between memory speed (MHz) and latency (CL).

·DIMM vs SO-DIMM — desktop vs laptop form factor confusion
·DDR3 vs DDR4 vs DDR5 — notch position and voltage differences
·MHz vs CL — speed vs latency trade-offs in performance
·Single-channel vs dual-channel — bandwidth impact misconception
·ECC vs non-ECC — error correction support in servers vs desktops
·32-bit vs 64-bit — maximum addressable RAM limit

Watch out for

Common Security Program Management and Oversight exam traps

▸Confusing policy vs. procedure: a policy is high-level intent, a procedure is step-by-step; exam may ask which document defines 'acceptable use' (policy) vs. 'how to reset a password' (procedure)
▸Mixing up risk treatment options: avoid (eliminate activity), transfer (buy insurance), mitigate (add controls), accept (acknowledge risk); candidates often pick 'mitigate' when 'avoid' is correct for a high-risk scenario
▸Forgetting that compliance is not the same as security: a company can be compliant with a regulation but still have poor security; exam may present a scenario where a compliant organization is breached and ask what's missing (e.g., risk assessment beyond compliance)
▸Misinterpreting RTO vs. RPO: RTO is time to restore service, RPO is acceptable data loss; exam might describe a backup strategy and ask which metric it satisfies

Practice set

Security Program Management and Oversight questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Security Program Management and Oversight explanation →

A company is evaluating a new cloud-based customer relationship management (CRM) provider. The provider’s documentation includes a SOC 2 Type II report, but the company’s compliance team specifically requires evidence that data in transit is encrypted using TLS 1.2 or higher, and data at rest is encrypted with AES-256. Which of the following actions best demonstrates that the company has performed proper due diligence in vendor risk management?

Trap 1: Request the provider to sign a contractual service-level agreement…

An SLA is a legal commitment, not evidence that controls are actually in place or effective. It does not replace verifying the provider’s actual implementation. While an SLA can be part of a contract, it should not be the sole basis for due diligence when audit reports are available.

Trap 2: Accept the SOC 2 Type II report as sufficient and proceed without…

Simply accepting the existence of a SOC 2 report without examining its details does not confirm that specific encryption requirements (TLS 1.2+ and AES-256) are covered. A SOC 2 report may cover many controls, but the company must verify that the exact control objectives and testing results match its own requirements.

Trap 3: Conduct an independent penetration test on the provider’s…

While a penetration test can identify vulnerabilities, it is an additional cost and may not cover all encryption implementations. More importantly, a SOC 2 Type II report already provides audited evidence of control effectiveness; a penetration test would be redundant or complementary but is not the primary method for verifying encryption compliance during due diligence.

Study all Security Program Management and Oversight common traps →

A
Request the provider to sign a contractual service-level agreement (SLA) that guarantees encryption compliance.
Why wrong: An SLA is a legal commitment, not evidence that controls are actually in place or effective. It does not replace verifying the provider’s actual implementation. While an SLA can be part of a contract, it should not be the sole basis for due diligence when audit reports are available.
B
Accept the SOC 2 Type II report as sufficient and proceed without further review.
Why wrong: Simply accepting the existence of a SOC 2 report without examining its details does not confirm that specific encryption requirements (TLS 1.2+ and AES-256) are covered. A SOC 2 report may cover many controls, but the company must verify that the exact control objectives and testing results match its own requirements.
C
Review the detailed control descriptions and auditor test results within the SOC 2 Type II report that address encryption of data in transit and at rest.
A SOC 2 Type II report includes a detailed description of controls, the control objectives, and the results of the auditor’s testing over a period of time. Reviewing these specific sections allows the company to verify that encryption controls are designed and operating effectively, which satisfies due diligence requirements for third-party risk management.
D
Conduct an independent penetration test on the provider’s infrastructure before signing the contract.
Why wrong: While a penetration test can identify vulnerabilities, it is an additional cost and may not cover all encryption implementations. More importantly, a SOC 2 Type II report already provides audited evidence of control effectiveness; a penetration test would be redundant or complementary but is not the primary method for verifying encryption compliance during due diligence.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Security Program Management and Oversight explanation →

A security manager is evaluating the effectiveness of a new security awareness training program that all employees completed last quarter. The company has been conducting monthly phishing simulation campaigns for the past year. Which of the following metrics would provide the strongest evidence that the training is achieving its intended goal of changing employee behavior?

Trap 1: 95% of employees completed the training within the deadline.

This metric measures completion, not behavioral change. An employee can complete training without retaining or applying the knowledge.

Trap 2: The number of employees reporting phishing attempts to the SOC…

Increased reporting indicates better awareness, but it does not directly measure whether employees are less likely to click on phishing emails. It is possible that more reports are coming from a small group while the overall click rate remains unchanged.

Trap 3: The number of helpdesk tickets related to password resets decreased…

Password reset requests can be influenced by many factors (e.g., password expiration, self-service tools, technical issues). This metric is not a reliable indicator of security awareness training effectiveness.

Study all Security Program Management and Oversight common traps →

A
95% of employees completed the training within the deadline.
Why wrong: This metric measures completion, not behavioral change. An employee can complete training without retaining or applying the knowledge.
B
The number of employees reporting phishing attempts to the SOC increased by 40%.
Why wrong: Increased reporting indicates better awareness, but it does not directly measure whether employees are less likely to click on phishing emails. It is possible that more reports are coming from a small group while the overall click rate remains unchanged.
C
The percentage of employees who clicked on a simulated phishing email decreased from 18% to 6%.
A significant drop in the click-through rate on simulated phishing emails directly demonstrates that employees are less susceptible to phishing attacks, which is the desired behavioral outcome of the training.
D
The number of helpdesk tickets related to password resets decreased by 10%.
Why wrong: Password reset requests can be influenced by many factors (e.g., password expiration, self-service tools, technical issues). This metric is not a reliable indicator of security awareness training effectiveness.

Full breakdown with real-world context →

Question 3mediummultiple choice

Read the full NAT/PAT explanation →

After completing a vulnerability scan, a security analyst discovers that a legacy customer-facing application running on an unsupported operating system contains a critical remote code execution vulnerability. The application is essential to daily operations and cannot be patched or upgraded in the near term. Management has approved the purchase of a hardware-based network firewall that will be placed in front of the application to restrict inbound traffic to only authorized source IP addresses and port numbers. Which risk management strategy does this action primarily represent?

Trap 1: Risk acceptance

Risk acceptance would mean acknowledging the vulnerability and choosing to take no action to reduce it. The organization is actively implementing a control, which goes beyond acceptance.

Trap 2: Risk avoidance

Risk avoidance would involve eliminating the vulnerability entirely, for example by shutting down the application or replacing it. The organization is keeping the application running and protecting it with a firewall, which is not avoidance.

Trap 3: Risk transference

Risk transference shifts the financial burden of a potential loss to a third party, such as purchasing cyber insurance. The organization is not transferring the risk; it is implementing a technical control.

Study all Security Program Management and Oversight common traps →

A
Risk acceptance
Why wrong: Risk acceptance would mean acknowledging the vulnerability and choosing to take no action to reduce it. The organization is actively implementing a control, which goes beyond acceptance.
B
Risk mitigation
Correct. By deploying a firewall to restrict access, the organization is reducing the likelihood that the vulnerability can be exploited. This is a risk mitigation strategy using a compensating control.
C
Risk avoidance
Why wrong: Risk avoidance would involve eliminating the vulnerability entirely, for example by shutting down the application or replacing it. The organization is keeping the application running and protecting it with a firewall, which is not avoidance.
D
Risk transference
Why wrong: Risk transference shifts the financial burden of a potential loss to a third party, such as purchasing cyber insurance. The organization is not transferring the risk; it is implementing a technical control.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full NAT/PAT explanation →

A security manager is preparing a quarterly report for the board of directors on the effectiveness of the organization's security program. The manager has access to detailed technical data, including firewall log statistics, patch compliance percentages, and number of phishing simulation clicks. Which of the following would be the most appropriate way to present this information to the board?

Trap 1: Provide a list of all firewall rule changes made during the quarter.

A list of firewall rule changes is an operational detail that is too granular for board-level oversight. The board needs summary-level information about risk, not the specifics of individual configuration changes.

Trap 2: Include raw logs of the top 10 most frequent alerts from the SIEM.

Raw SIEM logs are technical details intended for security analysts, not board members. Presenting such information would overwhelm the audience and fail to convey the strategic health of the security program.

Trap 3: Describe the technical architecture of the intrusion prevention…

Technical architecture details are more appropriate for engineering reviews or technical audits. The board does not need to understand the inner workings of security controls; they need to know the outcomes and risk posture.

Study all Security Program Management and Oversight common traps →

A
Provide a list of all firewall rule changes made during the quarter.
Why wrong: A list of firewall rule changes is an operational detail that is too granular for board-level oversight. The board needs summary-level information about risk, not the specifics of individual configuration changes.
B
Show a trend chart of the number of security incidents categorized by severity, along with average time to resolve.
This option provides a high-level, actionable summary that demonstrates the security program's effectiveness. Incident trends by severity and resolution time are key performance indicators that the board can use to assess risk reduction and operational maturity.
C
Include raw logs of the top 10 most frequent alerts from the SIEM.
Why wrong: Raw SIEM logs are technical details intended for security analysts, not board members. Presenting such information would overwhelm the audience and fail to convey the strategic health of the security program.
D
Describe the technical architecture of the intrusion prevention system.
Why wrong: Technical architecture details are more appropriate for engineering reviews or technical audits. The board does not need to understand the inner workings of security controls; they need to know the outcomes and risk posture.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full NAT/PAT explanation →

A security manager is leading a risk assessment for the organization. The team identifies a legacy application that contains a known critical vulnerability. The vendor has discontinued support and no patch is available. The manager calculates that the annualized loss expectancy (ALE) for exploiting this vulnerability is $50,000. Implementing a third-party web application firewall (WAF) as a compensating control would cost $80,000 per year. The organization's leadership decides that accepting the risk is the most cost-effective approach. Which of the following documents should the security manager update to formally record this risk acceptance decision and obtain the necessary sign-off?

Trap 1: Business impact analysis (BIA)

Incorrect. A BIA identifies critical business processes and their dependencies, as well as recovery time objectives. It does not serve as a record of risk acceptance decisions.

Trap 2: Security baseline configuration document

Incorrect. A security baseline defines the minimum security configuration settings for systems. It does not document risk decisions or approvals.

Trap 3: Incident response plan

Incorrect. The incident response plan provides step-by-step procedures for handling security incidents. It is not the appropriate place to record risk acceptance decisions.

Study all Security Program Management and Oversight common traps →

A
Business impact analysis (BIA)
Why wrong: Incorrect. A BIA identifies critical business processes and their dependencies, as well as recovery time objectives. It does not serve as a record of risk acceptance decisions.
B
Risk register
Correct. The risk register is used to track identified risks, their characteristics, and the chosen treatment. Updating it with the acceptance decision, rationale, and approval is essential for risk governance.
C
Security baseline configuration document
Why wrong: Incorrect. A security baseline defines the minimum security configuration settings for systems. It does not document risk decisions or approvals.
D
Incident response plan
Why wrong: Incorrect. The incident response plan provides step-by-step procedures for handling security incidents. It is not the appropriate place to record risk acceptance decisions.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full Security Program Management and Oversight explanation →

A security manager at a financial services company is proposing a new policy that would require annual background checks for all employees with access to sensitive customer payment data. The proposed policy, if implemented, would increase the organization's operational costs by approximately $200,000 per year. The manager needs to obtain formal approval to implement this policy. Which of the following groups is MOST likely to have the authority to approve this policy and allocate the necessary budget?

Trap 1: Chief Information Security Officer (CISO)

While the CISO is the senior security leader and may champion the policy, the CISO typically does not have the sole authority to approve a multi-departmental policy that costs $200,000 and involves HR processes. The CISO would recommend the policy to higher governance bodies such as the board or executive committee.

Trap 2: IT steering committee

An IT steering committee usually prioritizes technology projects and IT investments, but this policy is an HR/security policy that affects all employees, not just IT. The committee lacks the authority to approve enterprise-wide human resources policies and budget increases of this magnitude.

Trap 3: Security operations team

The security operations team is responsible for day-to-day monitoring and incident response. They have no authority to approve policies or allocate budget. This option is clearly incorrect for a policy-level decision.

Study all Security Program Management and Oversight common traps →

A
Board of directors
The board of directors has the fiduciary responsibility and ultimate authority to approve significant policy changes that require a substantial budget allocation, such as a $200,000 annual expense for background checks. This is correct because the policy crosses functional areas (security, HR, finance) and requires formal governance approval.
B
Chief Information Security Officer (CISO)
Why wrong: While the CISO is the senior security leader and may champion the policy, the CISO typically does not have the sole authority to approve a multi-departmental policy that costs $200,000 and involves HR processes. The CISO would recommend the policy to higher governance bodies such as the board or executive committee.
C
IT steering committee
Why wrong: An IT steering committee usually prioritizes technology projects and IT investments, but this policy is an HR/security policy that affects all employees, not just IT. The committee lacks the authority to approve enterprise-wide human resources policies and budget increases of this magnitude.
D
Security operations team
Why wrong: The security operations team is responsible for day-to-day monitoring and incident response. They have no authority to approve policies or allocate budget. This option is clearly incorrect for a policy-level decision.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full Security Program Management and Oversight explanation →

A security manager at a healthcare organization is reviewing the results of a third-party vendor risk assessment for a cloud-based email service that will store protected health information (PHI). The assessment reveals that the vendor encrypts data at rest using AES-256 but does not support customer-managed encryption keys. The vendor's data center is located in a country that is not subject to HIPAA jurisdiction. The vendor's previous penetration test report is over 18 months old. Which of the following is the most appropriate risk management action for the security manager to take?

Trap 1: Accept the risk because the vendor uses strong encryption.

While AES-256 encryption is strong, it does not address the full range of risks, such as the lack of customer-managed keys, the outdated penetration test, or legal/compliance exposure from storing PHI in a non-HIPAA jurisdiction. Accepting the risk based on encryption alone ignores these other critical factors.

Trap 2: Terminate the contract immediately and select a different vendor.

Terminating immediately without further investigation may be an overreaction. The risks identified are notable but do not necessarily indicate that the vendor is in violation of HIPAA or unable to provide adequate security. A more measured approach, such as requesting updated documentation, should be taken first.

Trap 3: Require the vendor to implement customer-managed keys and provide a…

While customer-managed keys and current penetration testing are desirable, the vendor may not be able to support customer-managed keys in their product architecture, and requiring implementation within 30 days is likely unrealistic. This option attempts to treat the risk through a technical control that the vendor may not offer, making it less practical than requesting an existing SOC 2 report.

Study all Security Program Management and Oversight common traps →

A
Accept the risk because the vendor uses strong encryption.
Why wrong: While AES-256 encryption is strong, it does not address the full range of risks, such as the lack of customer-managed keys, the outdated penetration test, or legal/compliance exposure from storing PHI in a non-HIPAA jurisdiction. Accepting the risk based on encryption alone ignores these other critical factors.
B
Request the vendor to obtain a current SOC 2 Type II report and review the findings before making a decision.
A SOC 2 Type II report provides an independent assessment of a service organization's controls over a period of time, including security, availability, and confidentiality. This is directly relevant for a cloud email service handling PHI. Reviewing this report gives the manager sufficient evidence to decide whether the vendor's current controls meet organizational and regulatory requirements.
C
Terminate the contract immediately and select a different vendor.
Why wrong: Terminating immediately without further investigation may be an overreaction. The risks identified are notable but do not necessarily indicate that the vendor is in violation of HIPAA or unable to provide adequate security. A more measured approach, such as requesting updated documentation, should be taken first.
D
Require the vendor to implement customer-managed keys and provide a new penetration test report within 30 days.
Why wrong: While customer-managed keys and current penetration testing are desirable, the vendor may not be able to support customer-managed keys in their product architecture, and requiring implementation within 30 days is likely unrealistic. This option attempts to treat the risk through a technical control that the vendor may not offer, making it less practical than requesting an existing SOC 2 report.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Security Program Management and Oversight explanation →

A security manager at a hospital is reviewing the annual vendor risk assessment for a cloud-based electronic health record (EHR) provider. The provider's SOC 2 Type II report, issued six months ago, identifies a significant deficiency in logical access controls: the provider failed to revoke access for former employees in a timely manner. The provider's management has asserted that this deficiency has been fully remediated, but the next SOC 2 audit is not scheduled for another eight months. The hospital's data protection policy requires that any vendor handling protected health information (PHI) must have a current SOC 2 Type II report with no unresolved significant deficiencies. Which of the following is the most appropriate next step for the security manager?

Trap 1: Accept the vendor's assertion that the deficiency has been…

Accepting an unsupported assertion without independent verification contradicts the hospital's policy requiring a current SOC 2 report with no unresolved significant deficiencies. The manager should not rely solely on the vendor's word.

Trap 2: Immediately terminate the contract with the EHR provider and begin…

Termination is a severe action that should be reserved for cases where the vendor cannot or will not demonstrate remediation. Since the vendor claims to have fixed the issue and can provide a bridge letter, termination is premature and would cause significant operational disruption.

Trap 3: Increase the frequency of manual access reviews performed by the…

Manual reviews by internal staff are not a substitute for an independent audit report. The hospital's policy specifically requires a current SOC 2 report; internal reviews do not fulfill this requirement and are not scalable or reliable for this purpose.

Study all Security Program Management and Oversight common traps →

A
Accept the vendor's assertion that the deficiency has been remediated and continue the relationship as is.
Why wrong: Accepting an unsupported assertion without independent verification contradicts the hospital's policy requiring a current SOC 2 report with no unresolved significant deficiencies. The manager should not rely solely on the vendor's word.
B
Require the vendor to provide a bridge letter from their external auditor confirming that the remediation has been implemented and is operating effectively.
A bridge letter provides independent assurance that the deficiency has been corrected, bridging the gap until the next full audit. This satisfies policy requirements and is a standard practice in vendor risk management.
C
Immediately terminate the contract with the EHR provider and begin the process of selecting a new vendor.
Why wrong: Termination is a severe action that should be reserved for cases where the vendor cannot or will not demonstrate remediation. Since the vendor claims to have fixed the issue and can provide a bridge letter, termination is premature and would cause significant operational disruption.
D
Increase the frequency of manual access reviews performed by the hospital's internal IT staff on the vendor's systems.
Why wrong: Manual reviews by internal staff are not a substitute for an independent audit report. The hospital's policy specifically requires a current SOC 2 report; internal reviews do not fulfill this requirement and are not scalable or reliable for this purpose.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Security Program Management and Oversight explanation →

A security manager at a financial services company is evaluating the effectiveness of a newly deployed security awareness training program. The program included modules on recognizing phishing emails, password security, and tailgating. One month after the training, the manager wants to assess whether employees are applying the learned behaviors to reduce the risk of phishing attacks. Which of the following metrics would provide the most valid indication of the training's behavioral impact?

Trap 1: The percentage of employees who completed the training modules.

Completion rate measures only that employees took the training, not whether they retained or applied the knowledge. It does not assess behavioral change.

Trap 2: The average score on the post-training knowledge quiz.

Quiz scores measure theoretical knowledge immediately after training, but they do not indicate whether employees will apply that knowledge in real-world scenarios.

Trap 3: The number of reported phishing incidents to the security team.

The number of reported incidents can be influenced by many factors, such as the volume of actual phishing attacks, reporting culture, and employee vigilance. It does not directly measure behavior change related to the training.

Study all Security Program Management and Oversight common traps →

A
The percentage of employees who completed the training modules.
Why wrong: Completion rate measures only that employees took the training, not whether they retained or applied the knowledge. It does not assess behavioral change.
B
The average score on the post-training knowledge quiz.
Why wrong: Quiz scores measure theoretical knowledge immediately after training, but they do not indicate whether employees will apply that knowledge in real-world scenarios.
C
The number of reported phishing incidents to the security team.
Why wrong: The number of reported incidents can be influenced by many factors, such as the volume of actual phishing attacks, reporting culture, and employee vigilance. It does not directly measure behavior change related to the training.
D
The reduction in the employee click-through rate on simulated phishing campaigns.
Simulated phishing campaigns provide a controlled test of employee behavior. Comparing pre-training and post-training click-through rates directly measures whether employees are applying the training to avoid clicking malicious links.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full NAT/PAT explanation →

A security manager at a healthcare organization is responsible for maintaining the information security policy. A project manager requests a policy exception to use a cloud-based analytics platform that stores patient data. The platform currently encrypts data at rest with AES-128 instead of the required AES-256. The security manager assesses the risk and determines that the likelihood of data exposure is low due to other compensating controls already in place, but the impact would be high. The residual risk is within the organization's risk appetite. Which of the following is the most appropriate action for the security manager to take?

Trap 1: Deny the exception and require the project to use an approved…

This is incorrect because if the risk is within the organization's risk appetite and compensating controls are effective, a blanket denial may be overly restrictive and could hinder legitimate business operations. Policy exceptions exist to allow flexibility when risk is acceptable.

Trap 2: Accept the risk and allow the project to proceed without a formal…

This is incorrect because bypassing the formal exception process undermines governance and auditability. Even if risk is accepted, it should be documented through the exception process to maintain accountability and support future reviews.

Trap 3: Escalate the request to the chief information officer for a final…

This is incorrect because the security manager typically has the authority to approve policy exceptions within the defined risk appetite. Escalation without a clear reason adds unnecessary delay and does not leverage the manager's risk assessment.

Study all Security Program Management and Oversight common traps →

A
Deny the exception and require the project to use an approved platform that meets the AES-256 requirement.
Why wrong: This is incorrect because if the risk is within the organization's risk appetite and compensating controls are effective, a blanket denial may be overly restrictive and could hinder legitimate business operations. Policy exceptions exist to allow flexibility when risk is acceptable.
B
Approve the exception and document the compensating controls and a review date.
This is correct because a formal exception process with documented compensating controls and a scheduled review ensures that the risk is managed, tracked, and reassessed over time. This aligns with security program management best practices.
C
Accept the risk and allow the project to proceed without a formal exception.
Why wrong: This is incorrect because bypassing the formal exception process undermines governance and auditability. Even if risk is accepted, it should be documented through the exception process to maintain accountability and support future reviews.
D
Escalate the request to the chief information officer for a final decision.
Why wrong: This is incorrect because the security manager typically has the authority to approve policy exceptions within the defined risk appetite. Escalation without a clear reason adds unnecessary delay and does not leverage the manager's risk assessment.

Full breakdown with real-world context →

Question 11mediummultiple choice

Read the full Security Program Management and Oversight explanation →

An IT manager wants a document that defines the mandatory minimum requirements for all company laptops, including full-disk encryption, password length, and screen-lock timing. The help desk also needs a separate document that shows exactly how to enroll a laptop in management software. Which document type should contain the mandatory laptop requirements?

Trap 1: Policy, because it gives broad direction without technical detail.

A policy is broader and sets intent, but it usually does not specify exact configuration values like encryption settings or password lengths.

Trap 2: Procedure, because it gives step-by-step instructions for…

Procedures describe how to perform a task, such as enrolling a laptop, but they are not the right place to define enterprise-wide mandatory settings.

Trap 3: Guideline, because it offers flexible recommendations for…

Guidelines are optional recommendations. They are useful for flexibility, but they do not enforce the minimum security requirements described in the question.

Study all Security Program Management and Oversight common traps →

A
Policy, because it gives broad direction without technical detail.
Why wrong: A policy is broader and sets intent, but it usually does not specify exact configuration values like encryption settings or password lengths.
B
Standard, because it defines the required technical settings that must be followed.
A standard is the correct document type for mandatory, measurable technical requirements. In this case, the organization needs exact minimum settings for encryption, password length, and screen-lock timing, which are all enforceable specifications. The procedure for enrolling devices would be a separate document that explains how to carry out the requirement, but the baseline technical requirements belong in the standard.
C
Procedure, because it gives step-by-step instructions for completing a task.
Why wrong: Procedures describe how to perform a task, such as enrolling a laptop, but they are not the right place to define enterprise-wide mandatory settings.
D
Guideline, because it offers flexible recommendations for administrators.
Why wrong: Guidelines are optional recommendations. They are useful for flexibility, but they do not enforce the minimum security requirements described in the question.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full Security Program Management and Oversight explanation →

During onboarding, a manager wants a document that explains how to request access to a shared drive, who approves it, and what the help desk must do after approval. Which document type is MOST appropriate?

Trap 1: Guideline, because it describes optional best practices for access…

Guidelines may help users, but they are not the best choice when the organization needs a repeatable approval and execution process.

Trap 2: Policy, because it names the general security principle without…

Policy sets high-level direction, but it does not usually include detailed task steps or role-by-role workflow instructions.

Trap 3: Standard, because it should define every case-specific approval…

Standards define mandatory requirements, but they are not usually the detailed playbook for executing a specific workflow.

Study all Security Program Management and Oversight common traps →

A
Guideline, because it describes optional best practices for access requests.
Why wrong: Guidelines may help users, but they are not the best choice when the organization needs a repeatable approval and execution process.
B
Procedure, because it provides the ordered steps for requesting and fulfilling access.
A procedure is the best document for describing the sequence of actions, approvals, and responsibilities involved in a recurring task. In this case, it would tell users how to submit the request, who reviews it, and what the help desk does after approval. Procedures improve consistency and reduce errors in operational workflows.
C
Policy, because it names the general security principle without implementation detail.
Why wrong: Policy sets high-level direction, but it does not usually include detailed task steps or role-by-role workflow instructions.
D
Standard, because it should define every case-specific approval path in the organization.
Why wrong: Standards define mandatory requirements, but they are not usually the detailed playbook for executing a specific workflow.

Full breakdown with real-world context →

Question 13easymulti select

Read the full Security Program Management and Oversight explanation →

A manager asks how the security team decides which issue should be fixed first. Which two factors are MOST important to evaluate for each risk?

Trap 1: Vendor popularity and implementation speed

Popular products can still be risky, and implementation speed alone does not measure security priority.

Trap 2: Encryption algorithm and screen resolution

These are technical details, but they do not directly determine overall risk priority for the business.

Study all Security Program Management and Oversight common traps →

A
Asset age and user satisfaction
These can matter operationally, but they are not the primary inputs to risk priority decisions.
B
Likelihood and impact
Likelihood and impact are the core factors used to prioritize risks. Likelihood describes how probable the event is, and impact describes the expected business damage if it occurs. Together, they help the organization decide what needs immediate attention, what can be monitored, and what may be accepted or transferred.
C
Vendor popularity and implementation speed
Why wrong: Popular products can still be risky, and implementation speed alone does not measure security priority.
D
Encryption algorithm and screen resolution
Why wrong: These are technical details, but they do not directly determine overall risk priority for the business.

Full breakdown with real-world context →

Question 14mediummatching

Read the full Security Program Management and Oversight explanation →

Match each awareness-program metric to the interpretation the security team should use. 1. 8% of users clicked the simulated phishing link. 2. 34% of users reported the simulation using the report-phish button. 3. The median time from message delivery to first user report was 12 minutes. 4. 96% of staff completed the annual awareness module.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Click rate

Report rate

Time to report

Training completion rate

Question 15hardmultiple choice

Read the full Security Program Management and Oversight explanation →

Based on the exhibit, which risk should be prioritized first under the company's likelihood-impact scoring model?

Exhibit

Risk register:
- Scoring model: Likelihood and impact are each rated from 1 to 5; higher total score means higher priority
- R-101: Medium likelihood (3), High impact (4), current control: manual review
- R-102: High likelihood (5), Medium impact (3), current control: none
- R-103: Low likelihood (1), Critical impact (5), current control: compensating detective control
- R-104: High likelihood (4), High impact (4), current control: backup power only
- Business note: Only one risk can be funded this quarter.

Trap 1: R-101, because manual review means the risk is already partially…

Manual review may help, but the scoring model prioritizes the highest likelihood-impact total, not the most familiar control.

Trap 2: R-102, because a cheaper remediation always has priority over a…

Cost matters, but the exhibit explicitly says the organization uses the likelihood-impact score to set priority.

Trap 3: R-103, because critical impact always outweighs likelihood in the…

The exhibit uses a combined score, so low likelihood with critical impact does not automatically outrank every other risk.

Study all Security Program Management and Oversight common traps →

A
R-101, because manual review means the risk is already partially controlled.
Why wrong: Manual review may help, but the scoring model prioritizes the highest likelihood-impact total, not the most familiar control.
B
R-102, because a cheaper remediation always has priority over a higher total score.
Why wrong: Cost matters, but the exhibit explicitly says the organization uses the likelihood-impact score to set priority.
C
R-103, because critical impact always outweighs likelihood in the matrix.
Why wrong: The exhibit uses a combined score, so low likelihood with critical impact does not automatically outrank every other risk.
D
R-104, because it has the highest likelihood-impact score in the register.
R-104 scores 16, which is higher than the other listed risks under the stated 1-to-5 model. Since the organization can fund only one risk this quarter, the highest scored item should be prioritized first. The current backup power helps resilience, but it does not reduce the fact that this is the largest remaining risk in the matrix.

Full breakdown with real-world context →

Question 16hardmultiple choice

Read the full Security Program Management and Oversight explanation →

Based on the exhibit, which document type should the organization update if it wants the listed endpoint settings to be mandatory baseline requirements?

Exhibit

Security document hierarchy:
- Corporate policy: "Endpoints must be protected against unauthorized access."
- Standard excerpt: "All managed laptops shall use full-disk encryption, auto-lock after 10 minutes of inactivity, and a 14-character password minimum."
- Procedure excerpt: "Step 1: Open Settings. Step 2: Enable BitLocker. Step 3: Confirm policy sync."
- Guideline excerpt: "Users should avoid storing sensitive files locally when possible."

Trap 1: Policy, because it defines the organization's broad security intent…

Policy is intentionally broad and high level, so it does not usually contain exact technical settings.

Trap 2: Procedure, because it provides the exact steps administrators…

Procedures explain how to perform a task, but they are not the document that sets baseline requirements themselves.

Trap 3: Guideline, because it is the least restrictive document for…

Guidelines are optional recommendations, so they cannot enforce mandatory baseline controls.

Study all Security Program Management and Oversight common traps →

A
Policy, because it defines the organization's broad security intent and direction.
Why wrong: Policy is intentionally broad and high level, so it does not usually contain exact technical settings.
B
Standard, because it defines mandatory minimum settings that all systems must meet.
Standards are the right place for mandatory, measurable requirements like encryption, lock timers, and password length. The exhibit already shows those exact settings in the standard excerpt. Policy states the broad intent, procedures describe how to implement it, and guidelines remain advisory rather than compulsory.
C
Procedure, because it provides the exact steps administrators follow to configure the setting.
Why wrong: Procedures explain how to perform a task, but they are not the document that sets baseline requirements themselves.
D
Guideline, because it is the least restrictive document for endpoint protection.
Why wrong: Guidelines are optional recommendations, so they cannot enforce mandatory baseline controls.

Full breakdown with real-world context →

Question 17easymultiple choice

Read the full Security Program Management and Oversight explanation →

A security manager wants evidence that annual security awareness training was completed by employees. Which artifact is the best proof?

Trap 1: A copy of the company logo used on the training slides

A logo does not show participation or completion, so it is not useful audit evidence.

Trap 2: A list of office supplies purchased last quarter

Office supply purchases are unrelated to security awareness training and provide no completion proof.

Trap 3: A screenshot of the company's public homepage

A public homepage screenshot does not demonstrate that employees finished required training.

Study all Security Program Management and Oversight common traps →

A
A training completion report exported from the learning system
A completion report directly shows who finished the training, when they completed it, and whether any users are still outstanding.
B
A copy of the company logo used on the training slides
Why wrong: A logo does not show participation or completion, so it is not useful audit evidence.
C
A list of office supplies purchased last quarter
Why wrong: Office supply purchases are unrelated to security awareness training and provide no completion proof.
D
A screenshot of the company's public homepage
Why wrong: A public homepage screenshot does not demonstrate that employees finished required training.

Full breakdown with real-world context →

Question 18mediummatching

Read the full Security Program Management and Oversight explanation →

Match each audit request to the best evidence artifact. 1. Auditors want proof that managers reviewed privileged access last quarter. 2. Auditors want evidence that an emergency firewall change was approved before implementation. 3. Auditors want to verify that annual security training was completed by staff. 4. Auditors want to confirm that records were deleted after the retention period expired.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Access review attestation report

Approved change ticket

LMS completion export

Retention deletion log

Question 19mediummultiple choice

Read the full Security Program Management and Oversight explanation →

A marketing analyst asks for a spreadsheet containing customer names, email addresses, purchase history, and government ID numbers so the team can build a campaign list. What is the BEST security response?

Trap 1: Approve the request because the data is needed for any marketing…

Need alone is not enough when highly sensitive personal data is requested; the organization must limit collection and sharing to what is necessary.

Trap 2: Send the full file, but ask the analyst not to store it permanently.

A verbal instruction does not control the exposure created by sharing unnecessary sensitive data in the first place.

Trap 3: Classify the file as public so it can be shared more easily with…

Reclassifying sensitive personal data as public would violate handling requirements and create unnecessary privacy risk.

Study all Security Program Management and Oversight common traps →

A
Approve the request because the data is needed for any marketing activity.
Why wrong: Need alone is not enough when highly sensitive personal data is requested; the organization must limit collection and sharing to what is necessary.
B
Provide only the minimum fields required and remove the government ID numbers.
This follows data minimization and handling requirements by sharing only what is necessary for the business purpose. Government ID numbers are highly sensitive and are not needed for a typical marketing campaign. Limiting the dataset reduces privacy exposure, lowers compliance risk, and helps ensure the data is used appropriately.
C
Send the full file, but ask the analyst not to store it permanently.
Why wrong: A verbal instruction does not control the exposure created by sharing unnecessary sensitive data in the first place.
D
Classify the file as public so it can be shared more easily with the marketing team.
Why wrong: Reclassifying sensitive personal data as public would violate handling requirements and create unnecessary privacy risk.

Full breakdown with real-world context →

Question 20easymultiple choice

Read the full Security Program Management and Oversight explanation →

A department identifies a low-likelihood software risk that would be expensive to fix right now. Leadership decides the business can live with the exposure for now, but wants it documented and reviewed later. What risk treatment is this?

Trap 1: Mitigate the risk by applying a technical control immediately

Mitigation reduces the likelihood or impact, but the scenario says the business is not fixing it now.

Trap 2: Transfer the risk to an insurer or third party

Transfer shifts some financial exposure, but the scenario describes keeping the risk internally and reviewing it later.

Trap 3: Avoid the risk by stopping the business activity entirely

Avoidance would mean eliminating the activity or system causing the risk, which is more drastic than the scenario describes.

Study all Security Program Management and Oversight common traps →

A
Mitigate the risk by applying a technical control immediately
Why wrong: Mitigation reduces the likelihood or impact, but the scenario says the business is not fixing it now.
B
Accept the risk with documented approval and periodic review
Acceptance is appropriate when leadership decides the current risk level is tolerable and the cost or disruption of fixing it is not justified right away.
C
Transfer the risk to an insurer or third party
Why wrong: Transfer shifts some financial exposure, but the scenario describes keeping the risk internally and reviewing it later.
D
Avoid the risk by stopping the business activity entirely
Why wrong: Avoidance would mean eliminating the activity or system causing the risk, which is more drastic than the scenario describes.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Security Program Management and Oversight sessions

Start a Security Program Management and Oversight only practice session

Every question in these sessions is drawn from the Security Program Management and Oversight domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Security Program Management and Oversight questions →Mixed SY0-701 session

Frequently asked questions

What does the SY0-701 exam test about Security Program Management and Oversight?: Security Program Management & Oversight covers the governance, risk management, compliance, and business continuity aspects of cybersecurity—how to plan, implement, and improve an organization's security program.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Security Program Management and Oversight questions in a focused session?: Yes — the session launcher on this page draws every question from the Security Program Management and Oversight domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other SY0-701 topics?: Use the topic links above to move to related areas, or go back to the SY0-701 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the SY0-701 exam covers. They are not copied from any real exam or dump site.

Security Program Management and Oversight only

10 questions 20 questions 30 questions 50 questions

Mixed SY0-701 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All SY0-701 questions Security Program Management and Oversight domain overview SY0-701 exam guide

Exam traps to avoid

▸Confusing policy vs. procedure: a policy is high-level intent, a procedure is step-by-step; exam may ask which document defines 'acceptable use' (policy) vs. 'how to reset a password' (procedure)
▸Mixing up risk treatment options: avoid (eliminate activity), transfer (buy insurance), mitigate (add controls), accept (acknowledge risk); candidates often pick 'mitigate' when 'avoid' is correct for a high-risk scenario
▸Forgetting that compliance is not the same as security: a company can be compliant with a regulation but still have poor security; exam may present a scenario where a compliant organization is breached and ask what's missing (e.g., risk assessment beyond compliance)
▸Misinterpreting RTO vs. RPO: RTO is time to restore service, RPO is acceptable data loss; exam might describe a backup strategy and ask which metric it satisfies

Security Program Management and Oversight practice questions

What to know about Security Program Management and Oversight

Why Security Program Management and Oversight questions are commonly missed

Common Security Program Management and Oversight exam traps

Security Program Management and Oversight questions

During onboarding, a manager wants a document that explains how to request access to a shared drive, who approves it, and what the help desk must do after approval. Which document type is MOST appropriate?

A manager asks how the security team decides which issue should be fixed first. Which two factors are MOST important to evaluate for each risk?

Based on the exhibit, which risk should be prioritized first under the company's likelihood-impact scoring model?

Exhibit

Based on the exhibit, which document type should the organization update if it wants the listed endpoint settings to be mandatory baseline requirements?

Exhibit

A security manager wants evidence that annual security awareness training was completed by employees. Which artifact is the best proof?

A marketing analyst asks for a spreadsheet containing customer names, email addresses, purchase history, and government ID numbers so the team can build a campaign list. What is the BEST security response?

A department identifies a low-likelihood software risk that would be expensive to fix right now. Leadership decides the business can live with the exposure for now, but wants it documented and reviewed later. What risk treatment is this?

Track your progress over time

Start a Security Program Management and Oversight only practice session

Related SY0-701 topic practice pages

General Security Concepts practice questions

Threats, Vulnerabilities, and Mitigations practice questions

Security Architecture practice questions

Security Operations practice questions