SY0-701 Security Program Management and Oversight Practice Question
Exhibit
Document title: Linux Server Baseline v3.2 Approval: Infrastructure Manager Scope: All production Linux servers Requirements: - SSH enabled - Telnet disabled - Unused services removed - Central logging enabled Purpose: Define the minimum approved configuration for new builds and rebuilds.
Based on the exhibit, which governance artifact is the security team reviewing?
⚠ Common exam trap
A common mix-up: candidates confuse a baseline with a standard, but a standard is broader (e.g., 'use HTTPS') while a baseline is specific (e.g., 'TLS 1.2 with these cipher suites'), so the detailed version list in the exhibit points to a baseline, not a standard.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Baseline, because it defines the approved minimum configuration for a system type.
The exhibit shows a list of approved operating systems, software versions, and patches for a specific system type (e.g., Windows 10 22H2 with specific security updates). This is a baseline, which defines the minimum acceptable configuration for a system type. Option C is correct because a baseline establishes a known good state that systems must meet, not just intent (policy), mandatory technical requirements (standard), or step-by-step instructions (procedure).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Policy, because it describes the organization's overall intent and direction.
Why it's wrong here
A policy expresses the organization's high-level intent, governance principles, and expected behaviors, but it deliberately avoids prescribing precise technical controls or exact numeric values. The exhibit contains concrete configuration settings (e.g., specific values for services or authentication) that are meant to be applied, not just broad expectations. Therefore, while a policy may exist above it, this document is too granular to be a policy.
- ✗
Standard, because it sets mandatory technical requirements for systems.
Why it's wrong here
A standard sets mandatory technical requirements across an organization, but it typically covers a broad scope (for example, all systems or all server types) and does not necessarily define the "minimum approved configuration" for a single system class. The exhibit specifically establishes the baseline for production Linux servers, listing required settings as the approved starting point. That focus on a system type's minimum configuration is what makes it a baseline, not a generic standard.
- ✓
Baseline, because it defines the approved minimum configuration for a system type.
Why this is correct
A baseline is the correct term when a document defines the minimum approved configuration for a class of systems. The exhibit shows a named configuration for all production Linux servers, includes specific required settings, and is approved for consistent use. That matches the purpose of a baseline much better than a policy, guideline, or procedure.
- ✗
Procedure, because it gives step-by-step instructions for completing a task.
Why it's wrong here
A procedure provides a sequential, step-by-step workflow for completing a specific operational task, such as installing a patch or resetting a password. The exhibit, in contrast, describes a desired end state—a specific set of configuration values—rather than a sequence of actions. It defines what the system should look like, not how to get there, so it is not a procedure.
Go deeper
Related to this question
Learn chapter
Security Policies and Procedures
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.