hardMultiple SelectObjective-mapped
200-201 Practice Question: Which TWO of the following are valid reasons to…
Which TWO of the following are valid reasons to create an exception to a security policy? (Choose two.)
⚠ Common exam trap
Cisco often tests the misconception that seniority or personal inconvenience can justify policy exceptions, but the correct reasoning must always tie back to business continuity or technical necessity, not status or preference.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A business-critical application cannot function with the policy control.
A business-critical application that cannot function with a security policy control represents a legitimate operational need that may require a temporary exception. Security policies should support business objectives, and if a control (e.g., a firewall rule, an antivirus exclusion, or an application whitelisting policy) prevents a critical application from running, an exception can be granted after a risk assessment and compensating controls are implemented. This aligns with the principle of balancing security with business continuity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The employee finds the policy inconvenient.
Why it's wrong here
Inconvenience is not a valid business reason.
- ✗
The policy is too new and employees are not yet trained.
Why it's wrong here
Lack of training is not a valid exception; the policy should be followed after training.
- ✗
The employee is a senior executive.
Why it's wrong here
Seniority does not justify bypassing security controls.
- ✓
A business-critical application cannot function with the policy control.
Why this is correct
If the control breaks a critical app, a temporary exception with compensatory controls may be needed.
- ✓
Temporary exception to avoid disrupting operations during a migration.
Why this is correct
Short-term exceptions with risk acceptance can be allowed during transitions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.