SY0-701 Security Program Management and Oversight Practice Question
A company wants to state that customer data must not be emailed externally unless a manager approves the exception. Which document type should contain this rule?
⚠ Common exam trap
A common mix-up: candidates confuse 'policy' with 'standard' or 'guideline', mistakenly thinking a rule about data transmission is a technical standard or a flexible suggestion, when in fact it is a mandatory organizational directive that must be enforced.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Policy, because it establishes mandatory organizational rules
A policy is the correct document type because it establishes mandatory organizational rules that must be followed. The requirement that customer data must not be emailed externally without manager approval is a binding directive, not a suggestion or a step-by-step guide. Policies define high-level security requirements that all employees must comply with, making them the appropriate vehicle for this rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Policy, because it establishes mandatory organizational rules
Why this is correct
A policy is a mandatory, management-approved directive that establishes organization-wide rules for behavior, defining what is required and the consequences of noncompliance. In this scenario, stating that customer data must not be emailed externally unless an approved exception exists creates an enforceable rule, exactly the role of a policy. It compels employees to follow the prescribed action and allows governance over data handling.
- ✗
Guideline, because it gives staff flexible suggestions about email use
Why it's wrong here
A guideline is an advisory recommendation that employees may follow or adapt based on judgment, making it intentionally flexible. For a sensitive-data restriction like 'customer data must not be emailed externally,' a guideline is too weak because it lacks the force of an enforceable mandate and cannot require exception approval. Regulatory and security demands need a binding rule, not an optional suggestion.
- ✗
Procedure, because it lists the exact button clicks for sending email
Why it's wrong here
A procedure specifies the precise step-by-step actions—such as menu selections, button clicks, or form fields—needed to complete a particular task. The statement in the scenario is not about operating a mail client; it is a governing rule about data classification and authorization. Procedures may later be written to implement this rule, but the rule itself, with its exception requirement, belongs in a policy.
- ✗
Standard, because it provides a general recommendation for communication
Why it's wrong here
A standard is a mandatory technical or operational specification, such as an encryption algorithm, password length, or file format, that supports a policy objective. The statement here is a general governance rule requiring authorization for external data transmission, not a measurable technical baseline. Moreover, calling it a 'general recommendation' misstates a standard's binding nature; even so, standards cannot establish the exception-requiring governing rule described.
Go deeper
Related to this question
Learn chapter
Security Policies and Procedures
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.