Security+ SY0-801 Practice Questions: Security Program Management and Oversight

Correct answer: D. Acceptable use policy

D is correct because an AUP defines the permitted and prohibited uses of the organization's systems and network. A defines sensitivity labels and handling rules for data, not acceptable behavior on company systems. B sets how access rights are requested, approved, and reviewed, not what users may do once they have access. C requires employees to secure papers and media at their workspace, not govern how systems are used.

Correct answer: A. Clean desk policy

A is correct because it requires employees to remove or secure sensitive papers and media from their work areas when unattended. B explains how the organization collects and uses personal data, not how employees secure their desks. C defines permitted use of company systems and networks, not the handling of papers at a workspace. D governs how data and media are destroyed when no longer needed, not how they are stored at a desk overnight.

Correct answer: B. Business continuity plan

B is correct because it keeps critical business functions operating during a disruption, including manual workarounds. A defines authority and requirements for handling security incidents, not how to keep shipping during an outage. C documents a routine recurring task step by step, not the organization's response to a prolonged disruption. D focuses on restoring IT systems and data after a disaster, rather than keeping business operations running.

Correct answer: C. Runbook

C is correct because a runbook gives detailed, task-specific steps for handling a particular situation and is often automated. A explains how to deploy or configure a product, not how to respond to a specific alert. B documents a broad routine business process, rather than the response steps for one specific alert type. D sets authority, scope, and reporting requirements for incidents without listing the steps for one alert.

Correct answer: A. Vulnerability disclosure policy

A is correct because it defines how outsiders report security flaws, the permitted testing, and the safe-harbor terms for good-faith reports. B tells customers how their personal data is collected and used, not how to report vulnerabilities. C governs how the organization handles security incidents internally, not how outsiders report flaws. D defines permitted use of systems by employees and users, not the reporting process for researchers.

Correct answer: B. Data disposal policy

B is correct because it defines how data and storage media must be destroyed and documented when no longer needed. A requires securing papers and media at unattended workspaces, not the destruction of retired drives. C sets how long records must be kept before review, not the method used to destroy the media. D specifies approved algorithms and key lengths for protecting data, not how drives are destroyed.

Correct answer: D. Bring your own device policy

D is correct because a BYOD policy sets the requirements personal devices must meet before they can access company resources. A governs how access rights are granted and reviewed, not the conditions for using personally owned devices. B covers permitted use of company systems in general, rather than the specific terms for personal devices. C explains how the firm handles personal data it collects, not device requirements for employees.

Correct answer: C. Reference architecture

C is correct because it is a proven design template organizations can follow and adapt when building their own environment. A warns about a specific vulnerability or threat and recommends mitigations, rather than offering a design. B lists the steps to complete a specific operational task, not an overall system design. D is the mandatory minimum configuration for a system type, not an adaptable design for a whole application.

Correct answer: B. A baseline standard

B is correct because the tailored settings are now a mandatory minimum configuration that every server must meet, which is a baseline. A warns about a specific threat or vulnerability and is not a required configuration for a class of systems. C describes the original CIS recommendations, which are advisory until the organization adopts and mandates them. D is vendor guidance on deploying or configuring a product, not an organization's mandated configuration.

Correct answer: B. An encryption standard

B is correct because it sets a specific, mandatory technical requirement that supports policy, without describing how to carry it out. A offers recommended practices that are optional, while this document uses mandatory language. C states high-level management intent and responsibilities, not specific algorithms and key storage locations. D gives the step-by-step instructions for enabling encryption, which this document leaves out.