SY0-701 practice questions: Security Program Management and Oversight

Answer: A. Objective 5.1 lists acceptable use, information security, business continuity, disaster recovery, incident response, software development lifecycle and change management as the policies of a governance programme, and the pair most often collapsed into one is business continuity and disaster recovery. NIST SP 800-34 Rev. 1 draws the line explicitly: the business continuity plan focuses on sustaining the organisation's mission and business processes during and after a disruption, while the disaster recovery plan is an information system-focused plan designed to restore operability of the target system, application or computer facility at an alternate site, and addresses only disruptions that require relocation. Paper claim forms and a standing authorisation exception belong to the first; the servers at the other site belong to the second. Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 5: Security Program Management and Oversight

Answer: B. Objective 5.2 lists single loss expectancy, annualized loss expectancy, annualized rate of occurrence, probability, likelihood and exposure factor under quantitative risk analysis. The single loss figure combines asset value with the exposure factor, and the annualized figure scales that by how often the event is expected each year - here 0.05. Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 5: Security Program Management and Oversight

Answer: B. Objective 5.3 lists supply chain analysis under vendor assessment, and a software bill of materials is where that analysis usually starts. CISA's SBOM page states: "An SBOM is a nested inventory, a list of ingredients that make up software components." An inventory answers which components a product contains; it does not answer whether a vulnerability in one of them can be exploited in that product. CISA names the SBOM-related artefact that does: "A VEX document is an attestation, a form of a security advisory that indicates whether a product or products are affected by a known vulnerability or vulnerabilities." The hospital already knows the library is present. What it lacks is the vendor's statement about the product - affected, not affected, fixed or under investigation - and that is what a VEX document carries. The CVE record speaks about the library, and a new bill of materials would repeat the inventory. Source: https://www.cisa.gov/sbom

Answer: D. An information system with a low availability objective does not require an alternate storage or processing site (CP-6 and CP-7). Organizations may consider low-impact systems for alternate site processing, but that is an organizational decision and not required. Moderate- and high-impact systems are different. Source: NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems (2010), https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf, SP80034r1-p36 section 3.4.3, p. 35-36 Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 4: Security Operations

Answer: D. Activation criteria may be based on the extent of damage, the criticality of the system, and an expected outage lasting longer than the RTO. Only the last is met: damage is minor, the system is not critical, and the 6-hour repair exceeds the 4-hour RTO, while staying far below the 24-hour MTD. Source: NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems (2010), 4.2.1 Activation Criteria and Procedure (SP80034r1-p50), p. 50 Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 4: Security Operations