The final part of Security+ SY0-701’s program management domain covers working with vendors and partners, staying compliant with laws and regulations, proving controls through audits and penetration tests, and building a security-aware workforce. These questions are mostly about choosing the right agreement, assessment, or awareness activity for a situation.
This is the eighth set in our Security+ SY0-701 series (Questions 71-80), and it completes our coverage of all five exam domains. It follows SY0-701 Questions 61-70 on governance and risk management. Every question is an original practice scenario mapped to the official exam objectives, not a copy of a real exam item.
Agreement types are a favorite exam topic, so pay close attention to what each document actually commits the parties to.
Question 71: Checking a Vendor’s Controls Yourself
A bank is outsourcing its call center. Its security team wants the contract to give the bank the right to inspect the vendor’s security controls and records, either directly or through an independent assessor, during the contract term. Which clause should be included?
A) A non-compete clause
B) A right-to-audit clause
C) A force majeure clause
D) An automatic renewal clause
👁 Reveal Answer
Correct Answer: B
Explanation: A right-to-audit clause gives the customer the contractual right to assess a vendor’s controls, records, and compliance, which supports ongoing third-party risk management. Vendor assessment also includes evidence such as independent assessments, penetration test results, and supply chain analysis. A restricts competition. C excuses performance during events beyond either party’s control. D extends the contract automatically. None of them let the bank verify security.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.3 (vendor assessment: right-to-audit clause)
Question 72: An Agreement That Is Not Legally Binding
Two government agencies want to record their shared intent to cooperate on cybersecurity information sharing, without creating legally binding obligations yet. Which document fits?
A) Memorandum of understanding (MOU)
B) Service-level agreement (SLA)
C) Master service agreement (MSA)
D) Non-disclosure agreement (NDA)
👁 Reveal Answer
Correct Answer: A
Explanation: An MOU documents a shared understanding and intent between parties and is generally not legally binding. A memorandum of agreement (MOA) is more formal and usually sets out specific responsibilities. B defines measurable service levels, such as uptime and response times, with consequences if they are missed. C sets the overall legal terms for an ongoing relationship. D is a binding commitment to keep information confidential.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.3 (agreement types: SLA, MOA, MOU, MSA, WO/SOW, NDA, BPA)
Question 73: Defining One Project Under an Existing Contract
A company already has a master service agreement with a consulting firm. It now needs the firm to perform a specific cloud migration with defined deliverables, a timeline, and acceptance criteria. Which document should be created?
A) A new master service agreement
B) A business partners agreement
C) A memorandum of understanding
D) A statement of work (SOW) or work order
👁 Reveal Answer
Correct Answer: D
Explanation: An MSA establishes the general terms of a relationship, and individual pieces of work are then defined in a statement of work or work order that describes the scope, deliverables, timeline, and acceptance criteria. A duplicates terms that already exist. B governs a partnership between businesses, such as profit sharing and responsibilities. C is non-binding and too vague for a defined project.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.3 (agreement types: WO/SOW)
Question 74: Vetting a Vendor Before Signing
Before choosing a new payroll provider that will hold all employee data, a company wants to understand the provider’s security practices, past breaches, financial stability, and any conflicts of interest. What is this process called?
A) Penetration testing
B) Change management
C) Due diligence as part of vendor selection
D) Data sanitization
👁 Reveal Answer
Correct Answer: C
Explanation: Due diligence is the investigation an organization performs before entering a relationship, such as reviewing security questionnaires, independent audit reports, breach history, financial health, and conflicts of interest. After selection, vendor monitoring continues throughout the relationship. A tests systems by attacking them. B controls changes to systems. D securely removes data from media.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.3 (vendor selection: due diligence, conflict of interest; vendor monitoring)
Question 75: A Customer Asks to Be Deleted
A customer in the European Union asks an online retailer to delete all personal data it holds about her, now that she has closed her account. Which privacy concept does her request relate to?
A) Data sovereignty
B) The right to be forgotten
C) Data retention for legal hold
D) Data masking
👁 Reveal Answer
Correct Answer: B
Explanation: The right to be forgotten (the right to erasure under the GDPR) lets a data subject ask an organization to delete their personal data when there is no longer a valid reason to keep it, subject to some exceptions. The retailer, as the data controller, must handle the request and make sure its processors do too. A is about which country’s laws apply to stored data. C requires keeping data for litigation. D hides parts of values.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.4 (privacy: data subject, controller vs processor, right to be forgotten)
Question 76: A Formal Opinion From an Outside Auditor
Enterprise customers ask a software company for independent proof that its security controls are designed and operating effectively. The company hires an external audit firm that examines the controls and issues a formal written opinion. What is this?
A) A self-assessment questionnaire
B) An internal audit committee review
C) An attestation by an external auditor
D) A vulnerability scan
👁 Reveal Answer
Correct Answer: C
Explanation: Attestation is a formal statement by an independent party about whether controls meet defined criteria, such as the opinion in a SOC 2 report. Because it comes from an external auditor, customers can rely on it more than on the company’s own claims. A and B are internal activities that carry less independent weight. D finds technical weaknesses but does not give an opinion on the control environment.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.5 (attestation; internal and external audits and assessments)
Question 77: Testing Like a Real Outsider
A company hires a penetration testing firm and wants the test to reflect an external attacker who knows nothing about the environment. The testers will receive no network diagrams, credentials, or source code. Which type of test environment is this?
A) Unknown environment
B) Known environment
C) Partially known environment
D) Integrated environment
👁 Reveal Answer
Correct Answer: A
Explanation: In an unknown environment test (formerly called black box), testers start with no internal information, just like an outside attacker. B, a known environment test (white box), gives full details such as diagrams and source code, which allows deeper coverage in less time. C, a partially known environment (gray box), provides some information, such as a standard user account. D is not one of these environment types; integrated refers to combining offensive and defensive testing.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.5 (penetration testing: known, partially known, unknown environment); NIST SP 800-115
Question 78: Learning About the Target Without Touching It
At the start of a penetration test, the testers gather employee names from social media, review the company’s job postings to learn which technologies it uses, and look up its public DNS records, all without sending any traffic to the company’s systems. What is this phase called?
A) Active reconnaissance
B) Exploitation
C) Lateral movement
D) Passive reconnaissance
👁 Reveal Answer
Correct Answer: D
Explanation: Passive reconnaissance gathers information from public sources, often called open-source intelligence (OSINT), without interacting directly with the target’s systems, so it is hard for the target to detect. A interacts with the target, for example by port scanning or probing services. B attempts to take advantage of a vulnerability. C moves from one compromised system to others inside the network.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.5 (reconnaissance: passive and active)
Question 79: Measuring Whether Training Works
A company runs annual security training, but users still click on phishing links. The security team wants an ongoing program that shows which users and departments are most at risk, gives immediate feedback, and tracks improvement over time. What should it add?
A) A longer annual training video
B) Regular simulated phishing campaigns with immediate training for those who click, plus an easy way to report suspicious email
C) Disabling all external email
D) A policy that fines employees who click
👁 Reveal Answer
Correct Answer: B
Explanation: Security awareness programs in the objectives include phishing campaigns, where simulated phishing emails test users, those who click get immediate follow-up training, and results are tracked to measure improvement. A simple reporting process encourages people to report real phishing quickly. A adds more of what is not working. C is not practical for most organizations. D discourages reporting and does not build awareness.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.6 (security awareness practices: phishing campaigns, reporting and monitoring)
Question 80: Agreeing on What Testers May Do
Before a penetration test begins, the client and the testing firm must agree on which systems are in scope, the testing hours, which techniques are allowed (for example, no denial of service), how to handle sensitive data found, and who to call if something goes wrong. What document captures this?
A) Rules of engagement
B) An acceptable use policy
C) A risk register
D) A data retention policy
👁 Reveal Answer
Correct Answer: A
Explanation: Rules of engagement define how a test or assessment will be conducted: scope, timing, permitted and prohibited techniques, data handling, communication and escalation contacts, and authorization. They protect both the client and the testers and prevent a test from causing unexpected harm. B governs employee use of company systems. C tracks risks. D defines how long data is kept.
Reference: CompTIA Security+ SY0-701 exam objectives, 5.3 (rules of engagement)
Study Tips for Third Parties, Compliance, and Audits
- Learn the agreements. SLA for service levels, MOU for non-binding intent, MOA for defined responsibilities, MSA for overall terms, SOW for a specific project, NDA for confidentiality, and BPA for partnerships.
- Vendors need ongoing checks. Due diligence before signing, right-to-audit clauses in the contract, and monitoring afterward.
- Privacy roles. Data subjects have rights such as the right to be forgotten. Controllers decide, and processors act for them.
- Testing vocabulary. Known, partially known, and unknown environments, plus passive and active reconnaissance.
- Awareness is measured, not assumed. Phishing campaigns, reporting, and tracking show whether training works.
Keep Practicing for Security+
You have now covered all five SY0-701 domains across Questions 1-80. Review SY0-701 Questions 61-70 for risk management, or start a full review from Questions 1-10.