hardMultiple Select
200-201 Practice Question: Which TWO of the following are valid reasons to…
Which TWO of the following are valid reasons to create an exception to a security policy? (Choose two.)
⚠ Common exam trap
Cisco often tests the misconception that seniority or personal inconvenience can justify policy exceptions, but the correct reasoning must always tie back to business continuity or technical necessity, not status or preference.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A business-critical application cannot function with the policy control.
Option D is correct because a documented exception is justified when a business-critical application genuinely cannot operate under the policy control, since the exception balances security with the organization's operational needs. Option E is correct because a temporary exception during a migration is a legitimate, time-bound risk acceptance that prevents disruption of operations while the transition is completed. Option A is not valid because personal convenience is not a business justification for weakening security controls. Option B is not valid because lack of training is a process and awareness failure, not a reason to grant a policy exception. Option C is not valid because seniority or rank does not justify bypassing a security policy; exceptions must be based on business or technical need.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The employee finds the policy inconvenient.
Why it's wrong here
Personal inconvenience is not a risk-based justification; exceptions require documented compensating controls or business necessity. Convenience-based exemptions would be the tempting shortcut when a policy impedes workflow, but governance frameworks demand a risk assessment and formal approval instead.
- ✗
The policy is too new and employees are not yet trained.
Why it's wrong here
Training gaps are remediated through awareness programmes and grace periods, not formal policy exceptions; an exception permanently exempts a defined scope from a control. It tempts because new policies do need phased rollout, but that is a transition plan, not an exception.
- ✗
The employee is a senior executive.
Why it's wrong here
Seniority confers no technical justification for bypassing a control; exceptions require a documented risk acceptance tied to a business or technical constraint. It tempts because executives often hold privileged access, but that is handled through role-based entitlements, not policy exceptions.
- ✓
A business-critical application cannot function with the policy control.
Why this is correct
A business-critical application that cannot function under a policy control justifies an exception because operational continuity outweighs the control's risk reduction. The exception is scoped to that application's specific technical incompatibility, not a blanket policy waiver, and should carry compensating controls, documented approval and a review date to limit exposure.
- ✓
Temporary exception to avoid disrupting operations during a migration.
Why this is correct
A migration is a time-bound operational change, so a temporary exception preserves business continuity while the migration completes. This satisfies the stem's requirement for a valid justification: the risk is scoped, documented and expires once migration ends, unlike a permanent policy bypass.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.