Data handling procedure: - Managers may approve external sharing exceptions verbally. - Staff record exceptions in email threads. - No retention period is defined for exception evidence. Audit note: multiple exceptions could not be traced to an approver.
Based on the exhibit, what is the best governance improvement?
Data handling procedure: - Managers may approve external sharing exceptions verbally. - Staff record exceptions in email threads. - No retention period is defined for exception evidence.
Audit note: multiple exceptions could not be traced to an approver.
Answer choices
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
Replace verbal and email exceptions with a documented approval workflow and retained exception records.
A formal workflow creates traceable approvals, preserves evidence, and makes exception handling auditable later.
Allow each team to decide its own exception format to increase flexibility.
Local flexibility would make evidence even harder to compare, retain, and audit consistently across the organization.
Remove exception handling entirely so no external sharing can ever occur.
That may be unrealistic for business operations and does not address the underlying governance deficiency directly.
Keep the procedure unchanged and rely on additional awareness training alone.
Training helps, but it does not create durable evidence or formal approval records for exceptions.
Common exam trap
Logging in proves the user can authenticate. It does not automatically mean the user is allowed to enter privileged or configuration mode. Watch for AAA authorization, privilege level and command authorization details.
Technical deep dive
This kind of question is testing the difference between identity and permission. A user may successfully log in to a router because authentication is working, but still fail to enter configuration mode because authorization is missing, misconfigured or mapped to a lower privilege level.
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SY0-701 questions linked to Security+ social engineering questions.
Practise SY0-701 questions linked to Security+ cryptography.
Practise SY0-701 questions linked to Security+ IAM questions.
Practise SY0-701 questions linked to Security+ risk management questions.
Practise SY0-701 questions linked to Security+ incident response questions.
Practise SY0-701 questions linked to Security+ malware questions.
Practise SY0-701 questions linked to Security+ vulnerability management questions.
Practise SY0-701 questions linked to Security+ security operations questions.
Practise SY0-701 questions linked to Security+ zero trust questions.
Practise SY0-701 questions linked to Security+ authentication factors questions.
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
Question 2
Question 3
Question 4
Question 5
Question 6
FAQ
Authentication checks who the user is.
The correct answer is: Replace verbal and email exceptions with a documented approval workflow and retained exception records. — The audit finding shows weak governance: approvals are informal, inconsistent, and poorly evidenced. The best improvement is a documented exception workflow with retained records, which clearly defines who can approve, what evidence must be kept, and how long it must be retained. That creates traceability and supports later audit review. Training alone cannot prove authorization, and informal email or verbal approvals are too fragile for governance and compliance needs. Why others are wrong: Allowing each team to invent its own format would worsen inconsistency and make audit evidence harder to verify. Removing exception handling entirely may not be practical for real business operations and does not solve the need for authorized exceptions. Training by itself can improve behavior, but it does not create the formal approval trail or retention that auditors need. The answer must strengthen the process, not just tell people to do better.
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Sign in to join the discussion.