Security Program Management and Oversight is worth 20% of CompTIA Security+ SY0-701, and it is the domain that many technical candidates underestimate. It covers the governance documents that guide an organization, the roles people play with data, and how risk is identified, measured, and handled, including the formulas for single and annualized loss expectancy.
This is the seventh set in our Security+ SY0-701 series (Questions 61-70). It follows SY0-701 Questions 51-60 on data protection and resilience. Every question is an original practice scenario mapped to the official exam objectives, not a copy of a real exam item.
Keep a pen ready for Question 63; the exam expects you to calculate risk values, not just recognize terms.
Question 61: Step-by-Step Instructions
A new help desk analyst needs exact, numbered steps for resetting a user’s multifactor authentication device, including which screens to use and what to verify. Which type of governance document should provide this?
A) Policy
B) Guideline
C) Standard
D) Procedure
👁 Reveal Answer
Correct Answer: D
Explanation: A procedure gives detailed, step-by-step instructions for carrying out a task, such as a playbook or an onboarding checklist. A, a policy, states high-level intent and rules (“MFA is required for all users”). C, a standard, sets specific mandatory requirements that support a policy (“MFA must use FIDO2 or an authenticator app”). B, a guideline, offers recommendations and best practices that are not mandatory.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.1 (guidelines, policies, standards, procedures)
Question 62: Who Decides How Sensitive the Data Is?
The HR director is accountable for the employee records system. She decides how the data is classified and who should have access, while the IT team runs the servers, applies backups, and implements the access controls she approves. What is the HR director’s role?
A) Data custodian
B) Data owner
C) Data processor
D) Data subject
👁 Reveal Answer
Correct Answer: B
Explanation: The data owner is the senior person accountable for a set of data, who decides its classification and who may access it. A, the data custodian (or steward), handles day-to-day protection, such as storage, backups, and applying the owner’s access rules, which is the IT team’s role here. C, a processor, handles data on behalf of a controller, often a third party. D, a data subject, is the person the data is about, such as an employee.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.1 (roles and responsibilities for systems and data)
Question 63: Calculating Annualized Loss
A warehouse worth $200,000 sits in an area where a damaging flood is expected about once every five years. A flood would destroy about 25% of the warehouse’s value. What is the annualized loss expectancy (ALE)?
A) $50,000
B) $40,000
C) $10,000
D) $1,000,000
👁 Reveal Answer
Correct Answer: C
Explanation: First calculate the single loss expectancy: SLE = asset value × exposure factor = $200,000 × 0.25 = $50,000. The annualized rate of occurrence for once every five years is ARO = 1/5 = 0.2. Then ALE = SLE × ARO = $50,000 × 0.2 = $10,000 per year. A is the SLE, not the ALE. B multiplies the asset value by the ARO and ignores the exposure factor. D multiplies instead of dividing by five years. The ALE helps decide whether a control, such as flood barriers costing $8,000 a year, is worth it.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.2 (risk analysis: SLE, ALE, ARO, exposure factor)
Question 64: Paying Someone Else to Carry the Risk
A small online retailer cannot afford to absorb the full cost of a major data breach. It buys a cyber insurance policy that covers breach notification, legal fees, and recovery costs. Which risk management strategy is this?
A) Transfer
B) Accept
C) Avoid
D) Mitigate
👁 Reveal Answer
Correct Answer: A
Explanation: Risk transfer shifts the financial impact of a risk to another party, most commonly through insurance or contracts. The retailer still owns the responsibility to protect data, but the insurer absorbs much of the cost. B means acknowledging the risk and doing nothing further. C means stopping the activity that creates the risk. D means reducing likelihood or impact with controls such as encryption or monitoring.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.2 (risk management strategies)
Question 65: One Place to Track Every Risk
A company’s leadership wants a single document that lists each identified risk with its owner, likelihood, impact, planned response, and current status, and that is reviewed regularly. What should the security team maintain?
A) An asset inventory
B) A change log
C) A risk register
D) A network diagram
👁 Reveal Answer
Correct Answer: C
Explanation: A risk register records identified risks with their owners, assessed likelihood and impact, key risk indicators, thresholds, and the chosen responses and their status. It gives leadership a single view of risk and supports regular review. A lists assets, which feeds risk identification but does not track risks. B records changes to systems. D shows network design.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.2 (risk register, key risk indicators, risk owners, risk threshold)
Question 66: How Much Risk the Board Will Accept
A hospital’s board states that, because patient safety comes first, the organization will take a conservative approach and accept only low levels of risk across its operations, even if this slows new projects. What is the board defining?
A) A key risk indicator
B) An exposure factor
C) A single loss expectancy
D) The organization’s risk appetite
👁 Reveal Answer
Correct Answer: D
Explanation: Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its goals. The Security+ objectives describe appetite as expansionary, conservative, or neutral, and a conservative appetite accepts little risk. Risk tolerance is the related idea of how much variation from that appetite is acceptable. A is a metric that warns when risk is rising. B is the percentage of an asset’s value lost in one incident. C is the cost of a single incident.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.2 (risk appetite and risk tolerance)
Question 67: How Often Does It Break?
During a business impact analysis, a data center manager reports that a particular storage controller model runs on average 40,000 hours before it fails. Which metric is this?
A) Mean time to repair (MTTR)
B) Mean time between failures (MTBF)
C) Recovery time objective (RTO)
D) Recovery point objective (RPO)
👁 Reveal Answer
Correct Answer: B
Explanation: Mean time between failures measures the average operating time between failures of a component, which describes its reliability. A is the average time to repair a component once it fails. C is the maximum acceptable time to restore a service. D is the maximum acceptable amount of data loss, measured as time. All four are part of business impact analysis.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.2 (business impact analysis: RTO, RPO, MTTR, MTBF)
Question 68: No More Than 15 Minutes of Lost Orders
The business impact analysis for an order system states that the company can tolerate losing at most 15 minutes of orders in a disaster. What does this define, and what does it require of the backup design?
A) A recovery point objective of 15 minutes, so data must be backed up or replicated at least every 15 minutes
B) A recovery time objective of 15 minutes, so the system must be running again within 15 minutes
C) A mean time to repair of 15 minutes for each server
D) A requirement to keep backups for 15 days
👁 Reveal Answer
Correct Answer: A
Explanation: The recovery point objective is the maximum acceptable data loss, expressed as the time between the last recoverable copy and the failure. An RPO of 15 minutes means backups, journaling, or replication must capture changes at least that often. B confuses RPO with RTO, which is about how quickly the service must be restored. C is a component repair metric. D describes retention, which is a separate decision.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.2 (recovery point objective)
Question 69: Rules for Company Laptops and Email
A company wants every employee to read and sign a document that explains what they may and may not do with company laptops, email, and internet access, such as no personal cryptocurrency mining and no sharing of credentials. What is this document?
A) An incident response plan
B) A service-level agreement
C) A business continuity plan
D) An acceptable use policy (AUP)
👁 Reveal Answer
Correct Answer: D
Explanation: An acceptable use policy defines how employees may use the organization’s systems, networks, and data, and what is prohibited. Employees typically acknowledge it in writing, which supports enforcement. A describes how to handle security incidents. B defines service levels between a provider and a customer. C covers keeping the business running during disruptions.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.1 (policies: acceptable use policy)
Question 70: Simply Not Doing It
A marketing team proposes collecting customers’ passport scans to verify ages for a promotion. Risk analysis shows the data would be highly sensitive and costly to protect, and age can be verified another way. The company decides not to collect passport scans at all. Which strategy is this?
A) Transfer
B) Mitigate
C) Avoid
D) Accept
👁 Reveal Answer
Correct Answer: C
Explanation: Risk avoidance eliminates a risk by not performing the activity that creates it. By not collecting passport scans, the company removes the risk of losing them. A would move the financial impact to someone else, for example through insurance. B would keep collecting the scans but add controls to protect them. D would collect them and accept whatever happens.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.2 (risk management strategies)
Study Tips for Governance and Risk
- Policy, standard, procedure, guideline. Intent, mandatory specifics, step-by-step instructions, and optional advice.
- Owners decide, custodians operate. Controllers decide why data is processed; processors act on their behalf.
- Memorize the formulas. SLE = asset value × exposure factor. ALE = SLE × ARO.
- Four responses to risk. Transfer, accept, avoid, and mitigate, and know an example of each.
- BIA metrics. RTO is time to restore, RPO is acceptable data loss, MTTR is repair time, and MTBF is reliability.
Keep Practicing for Security+
Go back to SY0-701 Questions 51-60 for resilience, then finish the series with Questions 71-80 on third-party risk, compliance, audits, and awareness.