Question 84 of 1,013
SY0-701 Security Program Management and Oversight Practice Question
A Linux operations team is building a new production gold image for database servers. Security requires every build to disable password-based SSH, enable audit logging, use the company NTP servers, and remove the desktop package set. The admins need a document that defines these exact required settings and allows exceptions only through formal approval. Which artifact should be used?
⚠ Common exam trap
A common mix-up: candidates confuse a policy (high-level intent) with a baseline (specific mandatory settings), leading candidates to choose 'Policy' because they think it governs all security, but baselines are the actual technical enforcement documents that require formal exceptions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Baseline
A baseline defines the minimum security configuration that must be applied to all systems, such as disabling password-based SSH, enabling audit logging, using specific NTP servers, and removing unnecessary packages. It is the correct artifact because it specifies required settings and allows exceptions only through formal approval, which aligns with the scenario's need for a mandatory configuration standard. Policies are high-level statements of intent, guidelines are recommendations, and procedures are step-by-step instructions, none of which enforce mandatory settings with exception control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Policy
Why it's wrong here
A policy is a high-level document that communicates an organization's security goals, priorities, and expectations (e.g., 'all production servers must be secured in accordance with industry best practices'). It intentionally avoids prescribing exact technical values, leaving room for interpretation and implementation decisions. Because it lacks specific configuration parameters, a policy alone cannot serve as a definitive reference for establishing a production gold image with precise settings.
- ✓
Baseline
Why this is correct
A baseline is a documented, approved set of configuration settings and hardening rules that represent the minimum acceptable security posture for a system or environment. It is exactly what is needed for a production gold image, as it specifies exact values for file permissions, user account settings, service configurations, and other system parameters. Baselines are often derived from industry standards such as CIS Benchmarks or STIGs, making them concrete and verifiable.
- ✗
Guideline
Why it's wrong here
A guideline is a collection of recommended practices that offer flexibility and allow for situational judgment, rather than mandatory requirements. For example, a guideline might suggest 'consider disabling unused services' without dictating which services to disable or providing exact configuration values. Since the question demands exact required server settings for a new production gold image, guidelines are too permissive and inconsistent to enforce a uniform and secure build.
- ✗
Procedure
Why it's wrong here
A procedure is a step-by-step instruction set that describes how to perform a specific task or process, such as applying patches or deploying a service. It focuses on the sequence of actions to complete a task, not on defining the expected end-state configuration of the system. As a result, procedures cannot establish what exact settings must be present on a server; they assume the target configuration has already been defined elsewhere.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.