SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Policy, because it states the organization's general intent and high-level direction.

  Why it's wrong here

  A policy articulates the organization's security intent, risk appetite, and executive-level expectations, but it deliberately avoids concrete technical parameters such as exact password lengths or encryption algorithms. Consequently, while a policy can mandate that systems be baselined, it is not the document that specifies the precise control settings required for a homogeneous laptop build. The standard supplies those measurable, enforceable values.

• ✓

  Standard, because it defines mandatory uniform requirements for a specific control baseline.

  Why this is correct

  A standard is the correct document when the organization needs a consistent, mandatory technical baseline such as encryption strength, lock timing, or password length. Standards translate policy into measurable requirements and are suitable for system configuration because they reduce ambiguity and support enforcement across similar assets.

• ✗

  Procedure, because it gives the organization-wide security purpose statement.

  Why it's wrong here

  A procedure is a chronological, step-by-step work instruction used to perform a task, such as provisioning a laptop or applying a patch, rather than a declaration of organization-wide security purpose. It answers "how to do it" and typically cites an underlying standard or guideline for the actual configuration values. Therefore, it cannot be the document that defines the mandatory baseline itself, and its role is operational, not direction-setting.

• ✗

  Guideline, because it provides optional suggestions that every laptop must obey.

  Why it's wrong here

  A guideline offers recommended, often best-practice approaches that teams may adapt to their environment, making it inherently flexible and non-mandatory. The option's phrase "every laptop must obey" is internally inconsistent because guidelines explicitly allow discretion and alternatives, unlike a standard's required uniform control baseline. For a consistent enterprise desktop configuration, enforceable numeric thresholds must live in a standard, not a suggestion document.