Security+ SY0-701 Domain 5: Security Program Management & Oversight — 10 practice questions with answers

Domain 5 is 20% of the CompTIA Security+ (SY0-701) exam, which works out to roughly 18of the up to 90 questions on the real test. Below are study notes for the domain's objectives, then every question from our free Security+ SY0-701 practice test that targets this domain, with the correct answer and the reasoning behind it. Try to answer each one before reading the explanation.

Objectives in this domain

• 5.1 Summarize elements of effective security governance
• 5.2 Explain elements of the risk management process
• 5.3 Explain the processes associated with third-party risk assessment and management
• 5.4 Summarize elements of effective security compliance
• 5.5 Explain types and purposes of audits and assessments
• 5.6 Given a scenario, implement security awareness practices

What to focus on

Domain 5 is the management view, and it is worth a fifth of the exam even though it involves no technology. Governance (5.1) is the document hierarchy: policies state intent, standards make it measurable, procedures say how, and guidelines advise. Roles matter too: the data owner decides classification, the custodian implements controls, and the processor acts for the controller.

Risk management (5.2) is partly arithmetic. Single loss expectancy is asset value times exposure factor; annualised loss expectancy is SLE times the annual rate of occurrence. A $200,000 asset with a 25% exposure factor has an SLE of $50,000, and if the event is expected once every four years (ARO 0.25) the ALE is $12,500, which sets a ceiling on what a control protecting that asset is worth per year. Know the four responses: avoid, transfer, mitigate and accept, plus risk appetite, tolerance and registers.

Third-party risk (5.3) covers vendor assessment, right-to-audit clauses and agreement types (SLA, MOA, MOU, MSA, SOW, NDA, BPA). Compliance (5.4) and audits (5.5) cover regulations, attestation, and internal versus external assessments including penetration tests. Awareness training (5.6) is tested as a programme: phishing simulations, recognising anomalous behaviour, and measuring whether training is working.

Practice questions and explanations

1. 1. Which risk management strategy involves purchasing insurance to cover potential financial losses from a security breach?

   1. A) Risk avoidance
   2. B) Risk transference
   3. C) Risk mitigation
   4. D) Risk acceptance

   Answer: B — Risk transference

   Risk transference shifts the financial impact of a risk to a third party, typically through insurance policies or contracts. Cyber insurance is a common example where an organization transfers the financial risk of a data breach to an insurance provider, though the organizational risk to reputation is not fully transferable.

2. 2. An organization must comply with regulations regarding the handling of credit card data. Which standard applies?

   1. A) HIPAA
   2. B) PCI DSS
   3. C) SOX
   4. D) FERPA

   Answer: B — PCI DSS

   PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. HIPAA covers healthcare data, SOX covers financial reporting, and FERPA covers educational records.

3. 3. Which of the following documents defines the rules of behavior and expectations for employees using organizational IT systems?

   1. A) Service Level Agreement (SLA)
   2. B) Acceptable Use Policy (AUP)
   3. C) Business Impact Analysis (BIA)
   4. D) Request for Proposal (RFP)

   Answer: B — Acceptable Use Policy (AUP)

   An Acceptable Use Policy (AUP) defines the permitted uses of organizational IT resources, including computers, networks, email, and internet access. It establishes rules, guidelines, and consequences for violations, helping to protect the organization from misuse and security risks.

4. 4. What is the primary purpose of a Business Impact Analysis (BIA)?

   1. A) To evaluate the financial health of the business
   2. B) To identify critical business functions and the impact of disruption
   3. C) To audit employee performance
   4. D) To design new products and services

   Answer: B — To identify critical business functions and the impact of disruption

   A Business Impact Analysis (BIA) identifies and evaluates the potential effects of disruption to critical business operations. It determines RTOs (Recovery Time Objectives), RPOs (Recovery Point Objectives), and the financial and operational impact of downtime, forming the foundation for business continuity planning.

5. 5. Which framework is commonly used by organizations to assess and improve their cybersecurity posture?

   1. A) Agile Methodology
   2. B) NIST Cybersecurity Framework (CSF)
   3. C) Waterfall Development Model
   4. D) ITIL Service Management

   Answer: B — NIST Cybersecurity Framework (CSF)

   The NIST Cybersecurity Framework (CSF) provides a structured approach for organizations to manage cybersecurity risks. Version 2.0 (February 2024) organises it into six core functions: Govern, Identify, Protect, Detect, Respond, and Recover. It is widely used across industries and is flexible enough to be applied to organizations of all sizes.

6. 6. A company requires all third-party vendors to undergo security assessments before being granted network access. What type of risk management activity is this?

   1. A) Vulnerability scanning
   2. B) Third-party risk management / vendor assessment
   3. C) Penetration testing
   4. D) Internal audit

   Answer: B — Third-party risk management / vendor assessment

   Third-party risk management involves assessing and monitoring the security posture of vendors, suppliers, and other external parties that have access to organizational systems or data. Vendor security assessments help identify and mitigate risks introduced through the supply chain.

7. 7. Which regulation requires organizations to protect the personal data of European Union residents?

   1. A) CCPA
   2. B) GDPR
   3. C) FISMA
   4. D) GLBA

   Answer: B — GDPR

   The General Data Protection Regulation (GDPR) is a comprehensive data privacy regulation that applies to organizations processing personal data of EU residents, regardless of where the organization is located. It mandates data protection measures, breach notifications, and gives individuals rights over their personal data.

8. 8. An organization conducts annual security training for all employees. What is the PRIMARY goal of this program?

   1. A) To teach employees how to code securely
   2. B) To build a security-aware culture and reduce human-factor vulnerabilities
   3. C) To certify employees as security professionals
   4. D) To satisfy the IT department's training budget requirements

   Answer: B — To build a security-aware culture and reduce human-factor vulnerabilities

   Security awareness training aims to educate employees about security threats (phishing, social engineering, etc.), organizational policies, and best practices. The primary goal is to build a security-aware culture where employees can recognize and appropriately respond to threats, reducing the human factor as an attack vector.

9. 9. What is the difference between a policy and a procedure in the context of security governance?

   1. A) Policies are technical and procedures are administrative
   2. B) A policy defines what should be done; a procedure defines how to do it
   3. C) Policies are optional while procedures are mandatory
   4. D) There is no functional difference between the two

   Answer: B — A policy defines what should be done; a procedure defines how to do it

   In security governance, a policy is a high-level statement of management's intent and direction (the 'what'), while a procedure provides detailed, step-by-step instructions for implementing the policy (the 'how'). For example, a policy may state that data must be encrypted, while a procedure details the specific encryption software and process to use.

10. 10. During a risk assessment, the team calculates the Annual Loss Expectancy (ALE). What formula is used?

    1. A) ALE = Asset Value × Exposure Factor
    2. B) ALE = Single Loss Expectancy (SLE) × Annual Rate of Occurrence (ARO)
    3. C) ALE = Total Risk / Number of Assets
    4. D) ALE = Revenue × Loss Percentage

    Answer: B — ALE = Single Loss Expectancy (SLE) × Annual Rate of Occurrence (ARO)

    Annual Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annual Rate of Occurrence (ARO). SLE represents the expected monetary loss each time an incident occurs, and ARO represents how often the incident is expected to occur per year. ALE = SLE × ARO helps prioritize risk mitigation investments.

Reading answers is not the same as recalling them. When you have worked through every domain, take the timed Security+ SY0-701 practice test: it shuffles the questions and options and scores you by domain, so you can see whether this one still needs work.