Security Governance SY0-701 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which external factor most directly requires an organization to implement specific data protection controls?

   • ALegal and regulatory requirements
   • BIndustry best practices
   • CInternal security guidelines
   • DCompetitor marketing strategies
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A multinational corporation is restructuring its security governance. Currently, each regional office has its own security team that sets local policies, leading to inconsistent security postures. The new CISO wants to ensure global compliance with regulatory requirements while still allowing regional flexibility for local laws. Which governance structure best achieves this balance?

   • AA federated governance model with global standards and regional procedures that comply with local laws
   • BA centralized governance model where the global security team sets all policies, and regional teams only implement them
   • CA hybrid model where the global team sets policies, but regions can opt out if they disagree
   • DA decentralized model where each region maintains full autonomy over security policies
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization is updating its security governance framework. The compliance officer notes that the organization must align with HIPAA, which requires specific safeguards for electronic protected health information (ePHI). The organization also operates in a state with stricter data breach notification laws. What is the most appropriate action for the governance committee?

   • AAdopt the stricter state law as the baseline and supplement with HIPAA requirements where they are more stringent
   • BDelegate the decision to the IT department to implement technical controls as they see fit
   • CCreate a single policy that meets the minimum requirements of both HIPAA and the state law
   • DImplement only HIPAA requirements because federal law preempts state law
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A mid-sized company is establishing a security governance structure. The CEO wants to ensure that security decisions are made with input from various departments, but also wants a single point of accountability. Which structure would best meet these needs?

   • AA security committee with representatives from IT, legal, HR, and operations, chaired by the CISO
   • BA single security officer who makes all decisions without input from other departments
   • CAn outsourced security team that makes all decisions
   • DA decentralized model where each department makes its own security decisions
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A software development company wants to ensure that all applications use a consistent, secure authentication method. The security team has decided that all new applications must use OAuth 2.0 with PKCE for mobile clients. Which governance document should formally mandate this requirement?

   • AA security procedure that explains how to implement OAuth 2.0
   • BA security standard that defines the mandatory authentication framework
   • CA security policy that states 'applications must use secure authentication'
   • DA security guideline that recommends OAuth 2.0 as a best practice
   Reveal Solution Discussion Select an answer first