200-201 Security Policies and Procedures Practice Question
A security manager is drafting an incident response policy and wants to ensure that the organization can legally monitor employee communications during an investigation. The manager asks the legal team what element must be included in the employee handbook and policy documents to support this capability. Which element is most critical?
⚠ Common exam trap
Test-takers frequently confuse incident reporting requirements or device seizure clauses with the notice-and-consent language that actually legitimizes monitoring of corporate communications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A statement that employees have no expectation of privacy when using corporate systems
The legal basis for monitoring employee communications is established by clearly informing employees that corporate systems are monitored and that privacy should not be expected. This notice, typically embedded in an Acceptable Use Policy or handbook, demonstrates consent and supports investigations. Reporting deadlines and device surrender clauses address different concerns and do not provide the same legal foundation for monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A provision that all incident response activities are exempt from regulatory oversight
Why it's wrong here
This is incorrect because no organization can exempt itself from regulatory oversight through an internal policy. Laws such as GDPR, HIPAA, or SOX still apply during investigations. The scenario asks what supports legal monitoring of employee communications, and claiming exemption from regulators does not provide that legal basis; it may even signal non-compliance.
- ✗
A requirement that employees report all security incidents within one hour of discovery
Why it's wrong here
This is incorrect because reporting timelines, while useful for incident response, do not establish the legal right to monitor communications. The scenario is about the legal foundation for monitoring during an investigation, which depends on notice and consent, not on reporting deadlines. A reporting requirement addresses a different policy objective and would not protect the organization's monitoring activities.
- ✓
A statement that employees have no expectation of privacy when using corporate systems
Why this is correct
This is correct because monitoring is legally defensible when employees are clearly informed that corporate systems are subject to monitoring and that they should not expect privacy. This notice, often included in an Acceptable Use Policy or employee handbook, establishes consent and reduces legal risk. Without it, monitoring during an investigation could violate privacy laws or employment agreements.
- ✗
A clause requiring employees to surrender personal devices for forensic imaging at any time
Why it's wrong here
This is incorrect because requiring surrender of personal devices raises significant legal and privacy issues and is generally not enforceable without specific consent or a legal warrant. The scenario concerns monitoring corporate communications during an investigation, not seizing personal property. Including such a clause could create legal exposure rather than support lawful monitoring.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.