SY0-701 Security Program Management and Oversight Practice Question
Exhibit
Endpoint governance draft -------------------------------------------------- Policy: Company-owned laptops must use approved full-disk encryption. Document B: [blank] Procedure: Steps for enabling encryption in the MDM console. Guideline: Recommended screen-lock timeout ranges by job role.
Based on the exhibit, which document type should define the exact encryption algorithm and minimum key length for all company laptops?
⚠ Common exam trap
Many exam-takers confuse Policy (the 'what') with Standard (the 'how specific'), thinking a high-level statement is sufficient to define exact technical parameters, when in fact Standards are the only document type that mandates precise, measurable technical specifications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Standard
A Standard defines mandatory, specific technical requirements such as the exact encryption algorithm (e.g., AES-256) and minimum key length (e.g., 256 bits) that must be enforced on all company laptops. Policies are high-level statements of intent, while Standards provide the measurable, enforceable criteria to implement that intent. In this context, the encryption algorithm and key length are precise technical specifications, not general guidance or step-by-step instructions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Policy
Why it's wrong here
A policy is authoritative only at the level of intent and management's overall security posture; it would state a mandate such as 'use strong encryption' but never name AES or require a specific key length. It lacks the measurable, technical baseline that security assessments need to verify compliance. An auditor cannot test a policy directly because it contains no specific algorithm or minimum bit-length values.
- ✓
Standard
Why this is correct
A standard is the formal document that mandates precise, measurable technical requirements, and for cryptography this means specifying the approved algorithms (e.g., AES for symmetric, RSA/ECDSA for asymmetric) and their minimum key lengths (e.g., 2048-bit RSA). Standards bridge high-level policy to enforceable controls and serve as the compliance benchmark. They are non-optional requirements, not suggestions, making them the appropriate type for defining encryption baselines.
- ✗
Procedure
Why it's wrong here
A procedure defines the exact sequence of actions for performing a particular task, such as generating a key pair or configuring a TLS profile in a specific operating system. It presumes the mandatory technical baseline already exists elsewhere, so it does not establish organization-wide requirements. Using a procedure to define encryption baselines would bury the rule in operational steps and fail to create an auditable, enterprise-level specification.
- ✗
Guideline
Why it's wrong here
A guideline is inherently discretionary, offering recommended approaches and best practices while explicitly allowing alternatives. When something must be mandatory, like the approved cryptography for data at rest or in transit, guidelines are the wrong instrument because they create no enforcement obligation. Only a standard creates the binding 'shall' language needed to require specific algorithms and key lengths.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Data Breach Notification Requirements
Key term
AES
AES is a fast and secure encryption standard used worldwide to protect sensitive data by scrambling it so only authorized parties can read it.
Key term
Advanced Encryption Standard
Advanced Encryption Standard (AES) is a widely used symmetric encryption algorithm that protects electronic data by converting readable information into a scrambled format that can only be unscrambled with the correct secret key.
About these practice questions
One of 1,030 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.