Security Program Management and Oversight

SY0-801 · 42 questions

A security team publishes a document that recommends, but does not require, that developers follow a published hardening benchmark when building short-lived test environments. Which type of governance artifact is this document?
An organization requires every new Linux server to meet a documented minimum set of configuration settings, including disabled unused services, enabled logging, and specific password settings, before it can enter production. What does this document represent?
Help desk staff need step-by-step instructions to safely restart a payment service after hours, including the checks to perform before and after the restart and whom to notify. Which governance artifact should be created?
After a flood destroys the primary data center, the IT team needs a document that tells them how to restore servers, networks, and data at the alternate site and in what priority order. Which plan should the team follow?
Employees want to read company email on their personally owned phones. The security team must define requirements such as device enrollment, a screen lock, and the company's right to remotely wipe corporate data from those phones. Which policy should define these requirements?
During an evening walkthrough, a security officer finds printed customer records left on several desks, visible to cleaning staff and visitors. Which policy most directly addresses this behavior?
Independent security researchers have found flaws in a company's public web application, but they are unsure how to report them and fear legal action if they do. Which policy should the company publish to address this?
A company is starting its first formal risk management program and wants to begin with risk identification. Which activity should come first?
A risk team rates each identified risk as high, medium, or low for both likelihood and impact and plots the results on a heat map. No monetary values are assigned. Which type of risk analysis is the team performing?
A server is valued at $200,000. If a specific flood scenario occurs, 25 percent of the server's value would be lost, and that flood is expected to occur once every two years. What is the annualized loss expectancy (ALE) for this risk?
A CISO wants a single living record that lists each identified risk with its owner, likelihood and impact ratings, current mitigations, planned treatment, and review date, so it can be reported to leadership regularly. What should the organization maintain?
After analyzing ransomware risk, a company decides to buy a cyber insurance policy that would cover recovery costs and business interruption losses if an attack succeeds. Which risk treatment does this purchase represent?
A company determines that a legacy customer file-sharing service carries risk it cannot reduce cost-effectively. Leadership decides to decommission the service entirely and stop offering it. Which risk treatment is this?
After deploying new controls on a customer portal, the remaining risk is still rated above the level the board has formally stated it is willing to accept. What should the organization do next?
Before choosing recovery strategies, a company wants to identify which business processes are most critical, how disruption to each would affect revenue and obligations over time, and how long each can be down. Which activity should it perform?
A new regulation requires that senior leadership demonstrate accountability for cybersecurity risk decisions. The CISO now presents the top risks to the board each quarter, and the board formally approves the risk appetite. Which business-level risk consideration does this demonstrate?
A company is exploring managed detection and response services for the first time. Before writing formal requirements, it wants to collect general information from several providers about their capabilities, service models, and experience. Which document should it issue?
Before signing a contract with a new managed security provider, a company reviews the provider's financial stability, independent audit reports, breach history, and security controls, and checks whether any executive has a financial stake in the provider. Which vendor selection activity is this?
A cloud provider's contract commits to 99.9 percent monthly availability, with service credits owed if it is missed. Internally, the provider's engineering team works to a stricter 99.95 percent goal to leave a safety margin. What is the internal 99.95 percent figure?
A company and a consulting firm sign one contract setting the general terms for all future work, such as liability, payment terms, and confidentiality. For each engagement they then sign a separate document listing deliverables, timeline, acceptance criteria, and price. What is the per-engagement document?
A company outsources card payment processing. It wants contractual assurance that it can inspect the vendor's security controls when needed, and it also wants formal annual evidence that the vendor remains compliant with the applicable standard. Which combination meets both needs?
A company discovers that its SaaS vendor stores customer data only in another country with different privacy laws, and that the vendor uses a proprietary data format that would make migrating to another provider slow and costly. Which two third-party limitations does this describe?
A company wants a penetration test of its application, which is hosted on a third-party cloud provider's platform. Before any testing begins, what must be established with the provider and the testing team?
Tellers at a regional bank must be trained to recognize structured cash deposits and unusual transfers that could be hiding the proceeds of crime or funding terrorist groups, and to escalate them appropriately. Which compliance training topic does this describe?
After updating its acceptable use policy, a company requires every employee to electronically confirm that they have received and read the new version. The confirmations are recorded and retained by HR. Which compliance monitoring element does this represent?
A regulator finds that a healthcare provider repeatedly failed to protect patient data and revokes the provider's authorization to operate a pharmacy in that jurisdiction. Which consequence of non-compliance does this represent?
A customer closes their account with an online retailer and asks the retailer to permanently delete all personal data it holds about them, where no legal obligation requires keeping it. Which privacy right is the customer exercising?
A retailer uses a cloud payroll provider to pay its employees. The retailer decides what employee data is collected and why it is processed; the provider processes that data only according to the retailer's instructions. Which roles do the two organizations hold?
Legal counsel reasonably expects a former employee to file a lawsuit about their termination. The company's retention schedule will automatically delete that employee's email and HR records next week. What should the company do?
An auditor cannot review all 40,000 access-change tickets from the past year, so the auditor selects 60 tickets at random and checks each for documented manager approval before drawing a conclusion about the whole population. Which data-gathering technique is the auditor using?
A security team wants to map behaviors observed during a recent intrusion to a publicly maintained knowledge base organized as a matrix of adversary tactics and techniques, so it can identify detection gaps. Which reference source should the team use?
A company is creating an internal audit function. The board wants a formal document that defines the function's purpose, authority, independence, scope, and reporting line to the audit committee. Which document should be created?
A company plans to adopt an industry security framework next year. It first wants to compare its current controls with the framework's requirements to find what is missing and plan remediation. No certification or external opinion is needed yet. Which engagement type fits?
A company hires a penetration testing firm and gives the testers only the company's name. They receive no network diagrams, credentials, or source code, so they must discover everything the way an outside attacker would. What type of penetration test is this?
During the first phase of an authorized penetration test, testers collect employee names, email formats, and technology details from the company's website, social media, job postings, and public records, without sending any traffic to the company's systems. Which activity is this?
An assessor sends a test message with a known malicious attachment to a mailbox to verify that the email security gateway actually quarantines it as designed. Which kind of testing is the assessor performing?
An employee has clicked the link in a phishing simulation for the second time this quarter. The security team wants to assign short, immediate training that addresses that specific mistake. Which type of training is most appropriate?
A company must deliver security awareness training to 5,000 employees who work remotely across several time zones. It needs self-paced content, automatic reminders, and completion records for auditors. Which delivery mechanism fits best?
Leadership asks whether the security awareness program is actually changing employee behavior. Which measurement provides the best evidence?
Several finance employees have received convincing emails, apparently from a long-time supplier, asking them to update the supplier's bank account details before the next invoice is paid. Which awareness topic should targeted training for this group emphasize?
Many staff now work from cafes and home offices, and several have been seen plugging in USB drives they were given at conferences. Which pair of awareness topics should the security team add to training for these staff?
Employees have been posting photos on social media that show their ID badges, the office layout, and screens in the background. Which awareness topic most directly addresses this behavior?