A global company is subject to GDPR, which requires that personal data be processed lawfully, fairly, and transparently. The company also operates in a country that has a law requiring the retention of certain financial records for 10 years. The company's data retention policy currently deletes all personal data after 5 years. What is the best course of action?

Retain financial records for 10 years as required by local law, but delete other personal data after 5 years

Seek legal advice to determine which law takes precedence

Delete all personal data after 5 years to comply with GDPR, ignoring the local law

Retain all personal data for 10 years to comply with the local law

A company is implementing a new security policy that requires all employees to use a password manager. The policy also mandates that the IT department must provide training on how to use the password manager. Who is responsible for ensuring that the training is delivered to all employees?

The IT department, because the policy assigns them the training task

The HR department, because they handle employee onboarding

Each employee, because they are responsible for their own learning

The CISO, because they own the policy

An e-commerce company that processes credit card payments must comply with PCI DSS. The company is also subject to GDPR because it serves customers in the EU. The security team is updating the data retention policy. What is the primary external consideration that should drive the policy?

The need to retain transaction data for as long as possible for business analytics

The requirement to minimize data retention to comply with GDPR's data minimization principle

The need to delete all customer data immediately after the transaction is complete

The requirement to retain all transaction data for at least seven years to satisfy both regulations

What is the primary purpose of security procedures?

To provide step-by-step instructions for performing security tasks

To set the overall security direction for the organization

To recommend best practices without requiring compliance

To define mandatory technical configurations

A regional bank has a security policy requiring all remote access sessions to be encrypted. The security team is developing a document that specifies the exact encryption protocols, key lengths, and configuration steps for the VPN concentrators. Which type of governance document should the team create?

A guideline that recommends best practices for remote access security

A standard that defines mandatory encryption protocols and key lengths

A policy revision that updates the remote access policy with technical details

A procedure that provides step-by-step instructions for configuring the VPN concentrators

CompTIASecurity+

Domain 5Objective 1

Security Governance SY0-701 Practice Questions (Page 6)

Part of the Security program management and oversight domain, which accounts for 20% of the SY0-701 exam. CompTIA does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

8concepts

20%of the exam

Questions 26–30

26expert · hard
A global company is subject to GDPR, which requires that personal data be processed lawfully, fairly, and transparently. The company also operates in a country that has a law requiring the retention of certain financial records for 10 years. The company's data retention policy currently deletes all personal data after 5 years. What is the best course of action?
Select an answer first
27expert · hard
A company is implementing a new security policy that requires all employees to use a password manager. The policy also mandates that the IT department must provide training on how to use the password manager. Who is responsible for ensuring that the training is delivered to all employees?
Select an answer first
28application · medium
An e-commerce company that processes credit card payments must comply with PCI DSS. The company is also subject to GDPR because it serves customers in the EU. The security team is updating the data retention policy. What is the primary external consideration that should drive the policy?
Select an answer first
29foundation · easy
What is the primary purpose of security procedures?
Select an answer first
30application · medium
A regional bank has a security policy requiring all remote access sessions to be encrypted. The security team is developing a document that specifies the exact encryption protocols, key lengths, and configuration steps for the VPN concentrators. Which type of governance document should the team create?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SY0-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “SY0-701” is a trademark of its owner, used for identification only.

Security Governance SY0-701 Practice Questions (Page 6)

Questions 26–30

A company is implementing a new security policy that requires all employees to use a password manager. The policy also mandates that the IT department must provide training on how to use the password manager. Who is responsible for ensuring that the training is delivered to all employees?

An e-commerce company that processes credit card payments must comply with PCI DSS. The company is also subject to GDPR because it serves customers in the EU. The security team is updating the data retention policy. What is the primary external consideration that should drive the policy?

What is the primary purpose of security procedures?

Keep studying — Security program management and oversight