CompTIA Security+ Security Program Management and Oversight Practice Questions

1. Which data role handles data day to day, such as applying access permissions and performing backups, as directed by the data owner?

Objective 5.1

Show answer

Answer: B. Data custodian

The data custodian (or steward) carries out the daily protection and handling of data. The data owner is accountable for the data and decides how it is classified and protected, but does not usually do the hands-on work.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

2. A document gives numbered, step-by-step instructions that the help desk must follow when disabling a departing employee's accounts. What type of governance document is this?

Objective 5.1

Show answer

Answer: D. Procedure

A procedure gives the specific steps for carrying out a task. A policy states high-level intent and requirements, such as "accounts must be disabled when employment ends", without the step-by-step detail.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

3. A warehouse worth $200,000 sits in a flood zone. A flood would destroy 25% of its value, and one is expected every two years. What is the annualized loss expectancy (ALE)?

Objective 5.2

Show answer

Answer: B. $25,000

SLE = $200,000 x 0.25 = $50,000, and an event every two years gives an ARO of 0.5, so ALE = $50,000 x 0.5 = $25,000. $50,000 is the single loss expectancy, which is the loss from one flood, not the yearly figure.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

4. After assessing the risk of a ransomware attack, a company buys a cybersecurity insurance policy to cover recovery costs. Which risk management strategy is this?

Objective 5.2

Show answer

Answer: C. Transfer

Buying insurance transfers the financial impact of the risk to another party. It is not mitigation, because the policy does not make a ransomware attack any less likely or less damaging to operations.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

5. Which metric defines the maximum acceptable amount of data loss after a disaster, measured as an amount of time?

Objective 5.2

Show answer

Answer: B. Recovery point objective (RPO)

The RPO sets how far back in time restored data may be, for example no more than 15 minutes of lost transactions. The RTO is how quickly a system must be running again, not how much data may be lost.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

6. A company is negotiating with a cloud payroll provider and wants the contract to let it, or an independent firm it hires, examine the provider's security controls. What should the contract include?

Objective 5.3

Show answer

Answer: A. Right-to-audit clause

A right-to-audit clause gives the customer contractual permission to assess the vendor's controls. An NDA only protects confidential information shared between the parties and grants no audit rights.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

7. Which type of agreement records a mutual intent to cooperate between two organizations but is generally not legally binding?

Objective 5.3

Show answer

Answer: D. Memorandum of understanding (MOU)

An MOU is an informal statement of shared intent and usually is not legally enforceable. An SLA is a binding contract that sets measurable service levels such as uptime and response times.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

8. A customer in the EU asks an online retailer to delete all the personal data it holds about her. Under GDPR, which right is she exercising?

Objective 5.4

Show answer

Answer: D. Right to be forgotten

The right to be forgotten (right to erasure) lets individuals ask for their personal data to be deleted. Data portability is about receiving a copy of the data to move to another provider, not about deleting it.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

9. In which type of penetration test is the tester given full details, such as network diagrams, source code and credentials, before starting?

Objective 5.5

Show answer

Answer: C. Known environment

A known environment (white box) test gives the tester complete information about the target. A partially known environment provides only some details, such as IP ranges, and leaves the rest to discover.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

10. Before the test window opens, a penetration tester gathers employee names from search engine results, social media and domain registration (WHOIS) records without sending any traffic to the company's systems. What is this activity?

Objective 5.5

Show answer

Answer: A. Passive reconnaissance

Passive reconnaissance collects information from public sources without touching the target. Active reconnaissance, such as ping sweeps or port scans, sends traffic to the target and can be detected.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

11. A company sends realistic but harmless fake phishing emails to its staff, tracks who clicks the links, and assigns extra training to those users. What is this program called?

Objective 5.6

Show answer

Answer: A. Phishing campaign

Phishing campaigns (simulations) test and train employees' ability to spot phishing. A tabletop exercise is a discussion-based walk-through of an incident plan with responders, not a test of all staff.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

12. An employee's phone shows an MFA push prompt for a sign-in she did not attempt, and several more prompts arrive within a minute. What should she do?

Objective 5.6

Show answer

Answer: C. Deny the prompts and report them to the security team immediately

Unexpected prompts mean someone likely has her password and is attempting MFA fatigue, so she should deny them and report it so the password can be reset. Ignoring them leaves the attacker holding a valid password and the security team unaware.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

CompTIA Security+ · Domain 5 · 20% of the examSecurity Program Management and Oversight

1. Which data role handles data day to day, such as applying access permissions and performing backups, as directed by the data owner?

2. A document gives numbered, step-by-step instructions that the help desk must follow when disabling a departing employee's accounts. What type of governance document is this?

3. A warehouse worth $200,000 sits in a flood zone. A flood would destroy 25% of its value, and one is expected every two years. What is the annualized loss expectancy (ALE)?

4. After assessing the risk of a ransomware attack, a company buys a cybersecurity insurance policy to cover recovery costs. Which risk management strategy is this?

5. Which metric defines the maximum acceptable amount of data loss after a disaster, measured as an amount of time?

6. A company is negotiating with a cloud payroll provider and wants the contract to let it, or an independent firm it hires, examine the provider's security controls. What should the contract include?

7. Which type of agreement records a mutual intent to cooperate between two organizations but is generally not legally binding?

8. A customer in the EU asks an online retailer to delete all the personal data it holds about her. Under GDPR, which right is she exercising?

9. In which type of penetration test is the tester given full details, such as network diagrams, source code and credentials, before starting?

10. Before the test window opens, a penetration tester gathers employee names from search engine results, social media and domain registration (WHOIS) records without sending any traffic to the company's systems. What is this activity?

11. A company sends realistic but harmless fake phishing emails to its staff, tracks who clicks the links, and assigns extra training to those users. What is this program called?

12. An employee's phone shows an MFA push prompt for a sign-in she did not attempt, and several more prompts arrive within a minute. What should she do?