A security manager is writing baseline requirements for all corporate laptops. Which three statements belong in the standard rather than in a policy or guideline? Select three.

Users should consider keeping their devices updated whenever convenient.

This is advisory language and lacks mandatory enforcement, so it fits a guideline more than a standard.

Employees must follow the company's acceptable use policy at all times.

This is high-level behavioral direction and belongs in a policy, not a technical standard.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Full-disk encryption must be enabled using approved encryption software. — A standard turns security intent into concrete, mandatory requirements that administrators can implement and auditors can verify. Full-disk encryption, a 10-minute lock timeout, and prohibition of local administrator rights are all specific baseline controls. In contrast, advice about convenience is a guideline, and broad statements about acceptable behavior belong in policy. The question separates governance layers rather than asking for a memorized definition. Why others are wrong: The guideline-style statement is intentionally nonmandatory, so it does not belong in a standard. The acceptable-use statement is too broad and behavioral to serve as a technical baseline. Standards should be specific, measurable, and enforceable, not open-ended or purely advisory.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.