Confirming an Application Is Out of External Reporting Scope

SY0-701 By islever Editorial Last updated

Explain types and purposes of audits and assessments. Explain compliance and privacy considerations for security.

Short answer

D Acknowledgement and attestation formally records responsible parties' sign-off that the application is out of scope for external reporting requirements.

Question

The internal audit team determines a software application is no longer in scope for external reporting requirements. Which of the following will confirm that the application is no longer applicable?
  1. Data inventory and retention
  2. Right to be forgotten
  3. Due care and due diligence
  4. Acknowledgement and attestation Correct Answer

Key Takeaways

The item tests the difference between supporting audit evidence and a formal scope confirmation; the main trap is choosing a data inventory and retention review because it can show what data the application handles, even though it does not attest that the application is out of scope.

This SY0-701 scenario asks how to confirm that an application is no longer in scope for external reporting requirements. The correct choice is acknowledgement and attestation (D), which provides formal responsible-party sign-off rather than relying only on a data inventory and retention review (A).

Common mistake: Selecting A (data inventory and retention) because it seems to prove the application no longer processes reportable data; however, an inventory is supporting evidence, and only acknowledgement and attestation supplies the formal sign-off that confirms the scope exclusion.

Expert Analysis

Why A is tempting Option A, data inventory and retention, sounds credible because an inventory shows what data an application processes and a retention schedule shows how long it is kept. If the app no longer handles reportable data, the inventory can support the conclusion that the app should be removed from scope. Several comments take exactly this line, arguing that updating the inventory verifies the app no longer handles the data types that triggered external reporting. That is useful evidence, but the question is not asking how to discover or document data holdings.

The decisive word is “confirm” The stem says internal audit has already made the determination. What remains is formal confirmation that the application is no longer applicable. That is acknowledgement and attestation (D): the responsible owner or management formally states in writing that the application is out of scope and accepts accountability for that assertion. Attestation is the audit artifact that records the scope decision; the data inventory is an input to that decision, not the sign-off itself.

Why the other options fail B, right to be forgotten, is a privacy request mechanism for data subjects, not an audit-scope confirmation. C, due care and due diligence, describes general governance duties: it explains why an organization should act responsibly, but it does not produce a specific, verifiable confirmation for this application. A remains the strongest distractor because it is a valid data-governance activity, but it does not close the loop with a formal assertion.

Exam takeaway When a Security+ stem asks what will confirm, attest, or formally record a scope change, choose the option that provides documented responsible-party sign-off. Choose inventory, retention, or classification only when the question asks how to identify, locate, or manage the data itself. Therefore the correct answer is D, acknowledgement and attestation.

Official Reference

https://www.comptia.org/certifications/security

This link opens the official vendor documentation in a new tab.

Exam Strategy

For audit-scope questions, first identify the verb in the stem: determine, verify, confirm, or attest. A determination is analysis; confirmation is a formal record. Eliminate options that are data-governance inputs, such as inventory, retention, or classification, unless the stem asks how to locate or manage data. For SY0-701, pair attestation with formal sign-off by an owner, management, or auditor, and pair right to be forgotten with data-subject privacy requests, not application scope changes.

Frequently Asked Questions

Why is data inventory and retention not the answer?

A data inventory catalogues where data lives, and retention defines how long it is kept. Both are supporting evidence for a scope decision, but neither is the formal acknowledgement and attestation that confirms the application is out of external reporting scope.

What does acknowledgement and attestation mean in this audit context?

It is documented confirmation by the application owner, management, or auditor that a scope statement is accurate. Here it records that the application is no longer applicable to external reporting requirements.

When should right to be forgotten be selected instead?

Choose right to be forgotten when a data subject asks the organization to delete personal data under a privacy regulation, not when an internal audit changes an application's reporting scope.

More SY0-701 FAQ →

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. PjoterK 👍 7 Answered D
    Acknowledgement and attestation is the most appropriate method to formally confirm that a software application is no longer applicable for external reporting requirements. This ensures that there is a documented and verifiable statement from the relevant parties affirming the change in status
  2. test_arrow 👍 7 Answered A
    Explanation: A data inventory and retention review helps confirm whether a software application still processes, stores, or transmits data relevant to external reporting requirements. If an application no longer holds relevant data, it can be formally removed from scope.
  3. 78834d6 👍 2 Answered D
    The correct answer is D. Acknowledgement and attestation. To formally confirm that a software application is definitively out of scope for regulatory or external reporting, an organization requires a final, documented sign-off from all relevant parties.
  4. prabh1251 👍 2 Answered D
    In the context of CompTIA Security+ certification, the correct option is: D. Acknowledgement and attestation – This involves formal documentation or sign-off to confirm that the application is no longer required for external reporting
  5. Philco 👍 1 Answered A
    A Data Inventory (or data asset inventory) is a formal registry that tracks exactly what data the organization collects, where it is processed, which applications touch it, and how it is categorized (e.g., PII, financial data, healthcare data). If an application is no longer in scope for external reporting, the data inventory will officially verify that the application no longer handles, processes, or retains the specific regulated data types that triggered the compliance requirement in the first place. Furthermore, retention policies will confirm if any historical data has been legally purged or archived out of the live system.
Show 5 more comments
  1. BigCGeekn 👍 1 Answered A
    This option is correct. A data inventory serves as the official registry tracking exactly where regulated or sensitive data is processed and stored across applications. If an application falls out of scope for compliance or external reporting, updating the data inventory verifies that it no longer handles or retains the data types that triggered those legal frameworks. Concurrently, retention policies confirm if the historical data has been properly purged or moved to ensure long-term compliance.
  2. oreinn 👍 1 Answered A
    A. Data inventory and retention Explanation: A data inventory and retention process involves cataloging and assessing the data within the application to determine its relevance to external reporting requirements. This process confirms whether the application contains data subject to those requirements and verifies if it can be removed from scope based on retention policies or lack of applicable data.
  3. Philco 👍 1
    D. Acknowledgement and attestation: An attestation (such as a SOC 2 Attestation) is a formal signing-off by an executive or external auditor stating that the company's security controls are accurate. While you might attest to your compliance status at the end of an audit, it is the underlying Data Inventory that provides the actual, verifiable proof that the specific application is out of scope.
  4. 5a11b63 👍 1 Answered D
    Acknowledgement and attestation is a formal process where responsible parties confirm in writing that a system, process, or control is no longer subject to certain requirements (in this case, external reporting). This provides an official record for auditors and regulators.
  5. Commando9800 👍 1 Answered D
    D. Acknowledgement and attestation

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide