Question 632 of 1,013
SY0-701 General Security Concepts Practice Question
Exhibit
Current document excerpt: - Managers may approve external file sharing by email. - Employees should keep the approval email in their inbox. - Help desk records exceptions if time allows. Audit note: - No consistent evidence of approval or exception retention was found across departments. Management objective: - External sharing exceptions must be approved, retained, and auditable in a consistent way.
Based on the exhibit, which document type should be updated to make the approval and retention requirements mandatory across the organization?
⚠ Common exam trap
It's easy for candidates to confuse a policy (mandatory, organization-wide) with a guideline (advisory) or procedure (task-specific), leading candidates to pick a document type that lacks enforcement authority.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Policy, because it sets mandatory rules that apply organization-wide.
A policy document is the correct choice because it establishes mandatory rules that apply organization-wide, making approval and retention requirements enforceable across all departments. Unlike guidelines or procedures, policies are authoritative and require compliance, which is essential for standardizing security controls like data retention periods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Guideline, because it provides flexible advice without requiring enforcement.
Why it's wrong here
A guideline is inherently advisory and non-mandatory, offering best-practice recommendations that staff may choose to follow. The exhibit's casual language ('should', 'if time allows') aligns with guideline ambiguity, but the requirement is to enforce approval authority and retention as auditable controls. Without mandatory language, a guideline cannot establish compliance or hold personnel accountable, making it unsuitable for a governance control that must be consistently applied.
- ✗
Procedure, because it lists the exact steps the help desk follows.
Why it's wrong here
A procedure provides the detailed, step-by-step actions needed to complete a specific task, but it operates within the boundaries set by higher-level policy. Procedures typically assume the mandatory rules already exist and simply describe how to implement them, so using a procedure to set approval authority or retention requirements would be putting the cart before the horse. Moreover, procedures are often department-specific, whereas the need here is for organization-wide, standardized rules that precede procedural instructions.
- ✓
Policy, because it sets mandatory rules that apply organization-wide.
Why this is correct
A policy is the right choice because leadership wants the approval and retention expectations to be mandatory, consistent, and auditable across departments. The exhibit shows informal language such as 'should' and 'if time allows,' which is too weak for a control that must be enforced. Policy language establishes the required rule before procedures document how to follow it.
- ✗
Architecture diagram, because it shows where documents are stored.
Why it's wrong here
An architecture diagram is a technical representation of systems, data stores, and information flows, used to visualize infrastructure rather than to govern behavior. It describes where documents are stored or how they move, but it has no authoritative language to mandate approval requirements or retention periods. Since the goal is to enforce rules and ensure evidence retention, a diagram cannot impose obligations or serve as a compliance reference, so it is not a document type that would be updated.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.