Question 318 of 1,013
SY0-701 Security Program Management and Oversight Practice Question
Exhibit
Endpoint governance draft -------------------------------------------------- Policy: Company-owned laptops must use approved full-disk encryption. Document B: [blank] Procedure: Steps for enabling encryption in the MDM console. Guideline: Recommended screen-lock timeout ranges by job role.
Based on the exhibit, which document type should define the exact encryption algorithm and minimum key length for all company laptops?
⚠ Common exam trap
Many exam-takers confuse Policy (the 'what') with Standard (the 'how specific'), thinking a high-level statement is sufficient to define exact technical parameters, when in fact Standards are the only document type that mandates precise, measurable technical specifications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Standard
A Standard defines mandatory, specific technical requirements such as the exact encryption algorithm (e.g., AES-256) and minimum key length (e.g., 256 bits) that must be enforced on all company laptops. Policies are high-level statements of intent, while Standards provide the measurable, enforceable criteria to implement that intent. In this context, the encryption algorithm and key length are precise technical specifications, not general guidance or step-by-step instructions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Policy
Why it's wrong here
A policy is authoritative only at the level of intent and management's overall security posture; it would state a mandate such as 'use strong encryption' but never name AES or require a specific key length. It lacks the measurable, technical baseline that security assessments need to verify compliance. An auditor cannot test a policy directly because it contains no specific algorithm or minimum bit-length values.
- ✓
Standard
Why this is correct
A standard is the formal document that mandates precise, measurable technical requirements, and for cryptography this means specifying the approved algorithms (e.g., AES for symmetric, RSA/ECDSA for asymmetric) and their minimum key lengths (e.g., 2048-bit RSA). Standards bridge high-level policy to enforceable controls and serve as the compliance benchmark. They are non-optional requirements, not suggestions, making them the appropriate type for defining encryption baselines.
- ✗
Procedure
Why it's wrong here
A procedure defines the exact sequence of actions for performing a particular task, such as generating a key pair or configuring a TLS profile in a specific operating system. It presumes the mandatory technical baseline already exists elsewhere, so it does not establish organization-wide requirements. Using a procedure to define encryption baselines would bury the rule in operational steps and fail to create an auditable, enterprise-level specification.
- ✗
Guideline
Why it's wrong here
A guideline is inherently discretionary, offering recommended approaches and best practices while explicitly allowing alternatives. When something must be mandatory, like the approved cryptography for data at rest or in transit, guidelines are the wrong instrument because they create no enforcement obligation. Only a standard creates the binding 'shall' language needed to require specific algorithms and key lengths.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.