CompTIA Security+ SY0-801: Security Program Oversight

Topic snapshot

Sample questions

These original IT Mastery practice questions are aligned to this topic area. Use them for self-assessment, scope review, and deciding what to drill next.

Question 1

Topic: Security Program Management and Oversight

A company uses a third-party SaaS provider to process employee payroll data, including tax identifiers. The contract requires encryption, annual independent assurance reporting, prompt breach notification, and storage only in approved countries. During a quarterly vendor review, which finding should most likely trigger escalation and contractual review?

Options:

• A. The vendor changed its customer support hours

• B. A low-risk vulnerability was remediated within SLA

• C. Backups were moved to an unapproved country

• D. The vendor scheduled a planned maintenance window

Best answer: C

Explanation: Third-party risk monitoring looks for signals that a vendor may no longer meet contractual, compliance, or security obligations. For sensitive payroll data, approved storage locations are a key data-protection and compliance constraint. If the provider moves backups to an unapproved country, the organization may face data sovereignty, privacy, or contractual issues. That finding should be escalated for review, additional assurance, remediation commitments, or possible exit planning if the vendor cannot meet the requirement. Routine operational changes or resolved low-risk issues may still be documented, but they do not indicate the same level of contract or compliance failure.

• Planned maintenance is normal operations when communicated and does not by itself violate the stated requirements.
• Remediated vulnerability shows the vendor met the SLA rather than creating an escalation signal.
• Support hours may affect service expectations, but the stem’s critical constraints focus on security, assurance, breach notice, and data location.

Question 2

Topic: Security Program Management and Oversight

A customer tells an online lender that the income value in their profile is inaccurate. The customer wants the lender to keep the account open but stop using that disputed value in eligibility decisions until the review is complete. Which privacy control best maps to this requirement?

Options:

• A. Apply a processing restriction

• B. Record an opt-out preference

• C. Immediately correct the profile value

• D. Process a right-to-be-forgotten request

Best answer: A

Explanation: Processing restriction is used when personal data should be retained but not used for certain processing activities, often while accuracy or legitimacy is being reviewed. In this scenario, the customer is not asking to close the account or delete all data. The key requirement is to prevent the disputed income value from being used in eligibility decisions until the review is complete. A correction may happen later if the value is verified as wrong, but the immediate control is to restrict processing of that disputed data.

• Right to be forgotten fails because deletion would conflict with keeping the account open and retaining needed records.
• Opt-out preference is usually for optional uses such as marketing, not blocking disputed data from eligibility decisions.
• Immediate correction skips the required review and may replace the value before its accuracy is validated.

Question 3

Topic: Security Program Management and Oversight

A company runs monthly phishing simulations. The finance department has a higher click rate than other departments, and the security manager must assign remediation only to affected users, track completion, and provide department managers with progress reports. Which awareness approach best meets these requirements?

Options:

• A. Self-service security awareness articles

• B. Annual companywide compliance training

• C. New-hire onboarding security training

• D. Targeted corrective training delivered through an LMS

Best answer: D

Explanation: Awareness programs should match the training method to the risk signal and reporting need. In this scenario, the phishing results identify a specific audience: affected finance users. Targeted corrective training addresses that observed behavior without requiring unnecessary training for everyone. Delivering it through a learning management system (LMS) supports assignment tracking, completion status, metrics, behavior scoring, and managerial reports. A self-service library can support ongoing awareness, but it does not reliably prove that specific users completed remediation. Broad annual or onboarding training is useful for baseline education, not for correcting a measured department-specific problem.

• Onboarding only misses the requirement to remediate existing users based on simulation results.
• Self-service content may help users learn, but it does not ensure assignment, completion tracking, or manager reporting.
• Annual training provides broad awareness, but it is not targeted to the affected finance users or the phishing behavior.

Question 4

Topic: Security Program Management and Oversight

A security team is standardizing new Linux server builds after an audit found inconsistent SSH and logging settings. The solution must provide measurable minimum configuration settings, support repeatable validation by operations, and allow documented exceptions for legacy applications. Which artifact is the BEST fit?

Options:

• A. AES encryption standard

• B. CIS Benchmark-based configuration baseline

• C. RFC for the SSH protocol

• D. Password complexity requirement

Best answer: B

Explanation: A configuration baseline is the right artifact when an organization needs a documented, measurable minimum security configuration for systems. Industry benchmarks, such as CIS Benchmarks, are commonly used to define hardening settings for operating systems and applications. In this scenario, the key needs are consistent Linux builds, validation by operations, and exception handling for legacy dependencies. An RFC can define protocol behavior, an encryption standard defines cryptographic algorithms, and password requirements govern authentication secrets, but none of those provide a full system hardening baseline.

• Protocol reference fails because an SSH RFC explains protocol standards, not a complete Linux server build configuration.
• Encryption standard fails because AES addresses data encryption, not system hardening settings.
• Password requirement fails because it covers credential rules only, not SSH, logging, and other server controls.

Question 5

Topic: Security Program Management and Oversight

A company is reviewing the risk treatment plan for its primary order-processing system. Which risk treatment choice is best supported by the exhibit?

Exhibit: Risk register excerpt

Options:

• A. Mitigate the risk with the warm standby site

• B. Transfer the risk by relying on insurance

• C. Accept the risk as documented

• D. Avoid the risk by retiring order processing

Best answer: A

Explanation: Risk treatment should match the business need and the nature of the risk. Here, the company cannot tolerate outages over 4 hours and has a 15-minute data-loss requirement. Insurance may reduce financial exposure later, but it does not restore service or meet operational recovery targets. A warm standby site with replication and failover testing directly lowers the likelihood or impact of an extended outage, so it is a mitigation treatment. Acceptance would only fit if the residual risk were within appetite, and avoidance would mean stopping the activity that creates the risk. The key is to choose the treatment that satisfies the recovery requirement, not just the one that offsets cost.

• Insurance transfer fails because reimbursement after 30 days does not meet the RTO or RPO.
• Risk acceptance fails because outages over 4 hours are explicitly outside risk appetite.
• Risk avoidance fails because retiring order processing is not supported by the business context.

Question 6

Topic: Security Program Management and Oversight

A security administrator reviews a records-management queue after the company receives a valid court order for a former employee’s lawsuit. Legal counsel confirms the request is limited to the named systems below. What is the best next action?

Options:

• A. Produce unrelated HR newsletters and endpoint logs

• B. Preserve the mailbox and project chat channel only

• C. Preserve all company data indefinitely

• D. Allow all scheduled deletions to continue

Best answer: B

Explanation: A legal hold suspends normal deletion or modification for data that may be relevant to litigation or an investigation. A valid legal order can also require preserving and producing specific records. In this exhibit, the former employee mailbox is already under legal hold, and the project chat channel is named in the order, so deletion must be stopped for both. The HR newsletters and daily endpoint logs are explicitly outside the confirmed scope, so they can continue to follow normal retention rules. The key is to preserve responsive data without over-collecting or ignoring established retention schedules for unrelated information.

• Normal deletion fails because the project chat channel is named in the order and scheduled for deletion soon.
• Preserve everything is overbroad because the confirmed scope is limited and unrelated data remains subject to retention policy.
• Produce unrelated data fails because legal orders should be handled according to validated scope, relevance, and counsel direction.

Question 7

Topic: Security Program Management and Oversight

A security manager is preparing for a future compliance program. The company is not yet ready for a formal audit and wants to compare its current controls against a required framework, identify missing controls, and create a remediation roadmap before engaging reviewers. Which assessment activity best maps to these requirements?

Options:

• A. Regulatory review

• B. Audit committee work

• C. Gap analysis

• D. Third-party audit

Best answer: C

Explanation: A gap analysis is used when an organization needs to compare its current control environment against a desired framework, standard, or requirement set. It is especially useful before a formal audit because it identifies missing, weak, or incomplete controls and helps prioritize remediation work. The key clues are “not ready for a formal audit,” “compare current controls,” and “create a remediation roadmap.”

A formal audit or regulatory review evaluates compliance and may produce findings, but those activities are typically more official and evidence-driven. Audit committee work is governance oversight, not the hands-on control comparison activity.

• Regulatory review is usually performed by or for a regulator to evaluate compliance, not to prepare an internal remediation roadmap.
• Audit committee work provides oversight and governance but does not directly compare each control to a framework.
• Third-party audit involves an independent external reviewer and is more formal than the preparatory activity described.

Question 8

Topic: Security Program Management and Oversight

A regional retailer’s primary order-processing data center is offline after a fire. Executives need store staff to keep accepting orders today using approved manual procedures, while the infrastructure team separately works to restore applications from backups at the alternate site. Which plan should the security practitioner recommend for the store-operations decision?

Options:

• A. Incident response plan

• B. Data retention plan

• C. Business continuity plan

• D. Disaster recovery plan

Best answer: C

Explanation: Business continuity planning focuses on keeping essential business processes operating when normal systems, facilities, or staffing are disrupted. In this scenario, the immediate store-operations problem is how to continue accepting orders today using approved manual procedures. Disaster recovery is related, but it is the technical restoration effort: rebuilding systems, restoring data, and resuming IT services at the alternate site. Both plans may be active during the same event, but they solve different problems.

The key distinction is business operations continuity versus IT service restoration.

• Disaster recovery is tempting because backups and an alternate site are involved, but that plan addresses restoring technology, not manual store operations.
• Incident response would coordinate detection, containment, and eradication for a security incident; the stem focuses on operational continuity after a fire.
• Data retention defines how long records are kept and disposed of, not how business functions continue during an outage.

Question 9

Topic: Security Program Management and Oversight

An internal audit team is assessing whether SOC monitoring covers adversary behaviors, not just tool names. The assessor reviews this exercise evidence:

1. VPN login succeeded using a disabled user's reused password.
2. The account enumerated shared drives and opened payroll folders.
3. Several payroll files were compressed into one archive.
4. The archive was uploaded to an external file-sharing site.

Which assessment conclusion is best supported by the exhibit?

Options:

• A. Classify the firewall as the Diamond Model adversary element.

• B. Score each step with CVSS and rank by base score.

• C. Map the activity to MITRE ATT&CK tactics and identify detection gaps.

• D. Treat the sequence only as Cyber Kill Chain reconnaissance.

Best answer: C

Explanation: MITRE ATT&CK is the best fit when an audit or assessment needs to evaluate whether controls detect specific adversary behaviors. The exhibit shows behavior patterns: use of valid credentials, discovery of file shares, collection/compression of data, and exfiltration to an external service. Mapping those behaviors to ATT&CK tactics and techniques helps the assessor identify where monitoring, alerting, or preventive controls are missing. The Cyber Kill Chain can describe attack progression at a high level, but labeling the entire sequence as reconnaissance would miss later actions. The Diamond Model helps relate adversary, victim, infrastructure, and capability, but it is not the best structure for detection coverage by technique.

• CVSS scoring applies to vulnerability severity, not a sequence of observed adversary behaviors.
• Diamond Model misuse fails because a firewall is not the adversary element.
• Reconnaissance only fails because the evidence includes credential use, collection, and exfiltration, not just early discovery.

Question 10

Topic: Security Program Management and Oversight

During a quarterly compliance review, a security analyst checks access to a CRM that stores customer PII. Company policy requires each user to complete annual privacy training and acknowledge the acceptable use policy before CRM access is enabled. The evidence shows a contractor has active CRM access, a current vendor attestation is on file, but the contractor has no training completion record and no policy acknowledgment. The project manager asks to keep access active to avoid delaying a release. Which action is the BEST professional decision?

Options:

• A. Keep access active and note the gap for the next audit

• B. Terminate the vendor relationship for non-compliance

• C. Accept the vendor attestation as sufficient evidence

• D. Disable CRM access and open a remediation ticket

Best answer: D

Explanation: Compliance monitoring evidence must be matched to the specific control requirement. In this case, the policy requires individual training completion and an acceptable use acknowledgment before access to a PII system. A vendor attestation may support third-party oversight, but it does not prove that this contractor completed the required user-level obligations. Because access is already active, the professional response is to remove or suspend access, document the gap, and track remediation through the normal ticket or exception process. This protects sensitive data without ignoring evidence or taking an excessive business action.

• Vendor attestation is related evidence, but it does not replace the missing individual training and acknowledgment records.
• Deferring to audit leaves a known policy violation active on a system containing customer PII.
• Terminating the vendor overreacts because the immediate issue is a remediable access compliance gap.

Continue with full practice

Use the CompTIA Security+ SY0-801 Practice Test page for the full IT Mastery practice bank, mixed-topic practice, timed mock exams, explanations, and web/mobile app access.

Try CompTIA Security+ SY0-801 on Web View CompTIA Security+ SY0-801 Practice Test

Related focused pages

• Free CompTIA Security+ SY0-801 Full-Length Practice Exam
• General Security Concepts
• Threats, Vulnerabilities, and Attacks
• Security Architecture
• Security Operations

Free review resource

Use the full IT Mastery practice page above for the latest review links and practice page.