SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Guideline, because it describes optional best practices for access requests.

  Why it's wrong here

  Guidelines provide recommended practices and are intentionally flexible, allowing staff to adapt them to different situations. However, the scenario demands a prescriptive, ordered procedure for how access requests are submitted, reviewed, and fulfilled. A guideline does not enforce a mandatory sequence of actions or specify roles and approvals, so it would not guarantee the consistency and auditability the manager needs.

• ✓

  Procedure, because it provides the ordered steps for requesting and fulfilling access.

  Why this is correct

  A procedure is the best document for describing the sequence of actions, approvals, and responsibilities involved in a recurring task. In this case, it would tell users how to submit the request, who reviews it, and what the help desk does after approval. Procedures improve consistency and reduce errors in operational workflows.

• ✗

  Policy, because it names the general security principle without implementation detail.

  Why it's wrong here

  A policy articulates the organization's overall security stance, such as 'access must be granted based on least privilege,' but intentionally omits implementation details. It does not explain the practical workflow of who fills out a form, who approves it, or how the help desk processes the request. Since the user is onboarding and wants to know the exact steps, a policy is too abstract to serve as an instructional guide.

• ✗

  Standard, because it should define every case-specific approval path in the organization.

  Why it's wrong here

  A standard defines mandatory requirements or configuration baselines, but it does not describe the sequential workflow for a specific operational task. Even if a standard dictates that all access requests require manager approval, it would not lay out the step-by-step process from submission to fulfillment. The claim that a standard should enumerate every case-specific approval path confuses standards with procedures, which are designed to codify repeatable actions and responsibilities.