SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Policy, because every tool change requires rewriting the corporate mandate.

  Why it's wrong here

  Policy is a high-level governance document that defines the organization's security objectives and the programs that support them, not the step-by-step mechanics of each tool. A change to an ITSM interface does not alter the underlying security requirement or the policy that mandates it, so rewriting policy first would be excessive and slow. Furthermore, policy revisions typically require change advisory board review and formal publication, which would unnecessarily delay the immediate operational correction that users need.

• ✗

  Standard, because the approval workflow and evidence rules are still the same.

  Why it's wrong here

  Standards specify the mandatory rules and control requirements, such as the approval workflow and evidence submission formats, and these remain valid after the interface change. The standard describes 'what' must be done, not 'how' to navigate the new tool, so it does not need to be revised for a GUI update. Updating the standard first would miss the actual problem: the procedure, which contains the concrete steps to be performed, is what has become inconsistent with the current platform.

• ✓

  Procedure, because the step-by-step instructions and screenshots are now outdated.

  Why this is correct

  Procedures contain the operational steps people follow to complete a task. Since the workflow and approval rules remain the same but the tool interface changed, the step-by-step guide should be updated first. That keeps the control intent intact while preventing user confusion and process errors.

• ✗

  Guideline, because optional content should always be revised before mandatory content.

  Why it's wrong here

  Guidelines are discretionary recommendations that describe a preferred approach, not enforceable steps, so they rarely contain the tool-specific screenshots that have gone stale. The assertion that optional content should always be revised before mandatory content is logically flawed because priority should be given to the document with the greatest impact on day-to-day execution. Since the procedure contains the mandatory instructions that users follow to complete the task, outdated guidelines are a minor concern compared to the risk of process errors from a broken procedure.