200-201 Security Policies and Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Password Policy

  Why it's wrong here

  Password Policy governs credential composition, rotation and lockout thresholds, not internet or email usage. It is tempting because it is a mandatory security policy every organisation maintains, but it addresses authentication strength only, leaving acceptable-use behaviour undefined.

• ✗

  Information Security Policy

  Why it's wrong here

  An Information Security Policy is the umbrella document covering classification, access control and risk management across all assets, not the specific rules for browsing and email. It is tempting as the broadest policy, but the stem requires the narrower Acceptable Use Policy addressing day-to-day resource conduct.

• ✗

  Remote Access Policy

  Why it's wrong here

  Remote Access Policy governs how external connections to the network are established and secured, such as VPN and authentication requirements, not browsing or email conduct. It is tempting because remote work scenarios involve usage rules, but its scope is connection methods rather than acceptable resource use.

• ✓

  Acceptable Use Policy (AUP)

  Why this is correct

  An Acceptable Use Policy specifies permitted and prohibited behaviour for staff using organisational IT resources, covering internet browsing, email and hardware. It satisfies the stated scope directly, unlike policies addressing data classification, incident response or password construction.

Go deeper

Related to this question