SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Policy

  Why it's wrong here

  A policy is a high-level directive that states management's intent or objectives, such as 'all laptops must be secured,' but it deliberately avoids specifying exact technical settings. Since it focuses on the 'what' and 'why' rather than the 'how,' it cannot define the precise minimum baseline every laptop must meet. Without exact parameters like password length or timeout values, a policy is not enforceable as a technical configuration standard, making it the wrong document for this need.

• ✓

  Standard

  Why this is correct

  A standard defines mandatory, specific requirements such as exact password length, timeout values, or encryption settings. In this case, the team needs a document that tells them the minimum baseline every laptop must meet. Standards are enforceable and precise, which makes them the right fit for organization-wide technical requirements.

• ✗

  Guideline

  Why it's wrong here

  A guideline provides recommended best practices and suggested configurations, but it is explicitly non-mandatory and flexible to accommodate varying environments or user needs. Because the team requires a baseline that every laptop must meet, a guideline's permissive nature means it cannot impose a compulsory minimum setting. Even if it contains relevant technical advice, it lacks the enforcement authority needed to serve as an organization-wide mandatory baseline.

• ✗

  Procedure

  Why it's wrong here

  A procedure is an ordered sequence of steps that describes how to perform a specific task, such as how to change a security setting or deploy a patch. It documents the process or workflow, not the required configuration state that must be present on each laptop. The team needs a document defining the minimum baseline configuration, not instructions on how to achieve it, so a procedure is the wrong document type for specifying mandatory technical requirements.