An engineering team requests a 30-day exception to use an unsupported browser plug-in on two workstations so a customer deliverable can be finished. Security agrees the business need is legitimate, but wants to reduce exposure. What must be included before the exception is approved?

A verbal approval from the engineering manager and no additional documentation.

Verbal approval alone is not sufficient for a security exception because it leaves no audit trail, no expiration date, and no evidence of risk acceptance. Temporary exceptions should be documented so they can be reviewed later and tied to specific compensating controls. Informal approval would make follow-up and accountability difficult.

A standing waiver that remains in place until the project finishes, with no review date.

Open-ended waivers are risky because exceptions tend to become permanent when they are not revisited. Without a review date, the organization can lose track of whether the business need still exists or whether the risk has changed. Time-bounded exceptions are a key governance control, especially for unsupported software.

A guideline reminding the team to avoid risky behavior when practical.

A guideline is only advisory and does not provide the accountability needed for a formal security exception. This scenario requires an approved deviation from policy, not a suggestion. The organization needs clear ownership, a defined end date, and risk reduction measures so the exception can be managed responsibly.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: A documented exception with an end date, compensating controls, and approval by the risk owner. — A documented exception with a defined end date, compensating controls, and risk-owner approval is the correct approach. Security exceptions should be controlled, reviewable, and temporary whenever possible. That structure shows the business need was acknowledged while ensuring someone has formally accepted the residual risk and the organization can reassess the exception before it becomes indefinite. Why others are wrong: A verbal approval is not enough for auditability or accountability. A standing waiver without a review date can quietly become permanent and increase exposure. A guideline does not authorize deviation from policy or provide the controls required for an exception process. The question is about formal exception handling, not informal advice.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.