SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Policy, because it states the organization's high-level security expectations

  Why it's wrong here

  A policy expresses the organization's strategic security objectives and mandatory high-level rules (e.g., 'all remote access must be authenticated'), but it deliberately avoids operational detail. For the service desk, a policy would state that caller verification is required before resetting credentials, yet it would not list the verification tokens, the order of checks, or the actions to take when verification fails. That lack of concrete step-by-step guidance is why a policy alone cannot tell analysts exactly how to perform the workflow.

• ✗

  Guideline, because it offers helpful suggestions that staff may choose to follow

  Why it's wrong here

  A guideline provides recommended practices and optional approaches that analysts are not strictly required to follow, such as suggesting a particular phrasing for caller verification. In a security-sensitive task like password reset, leaving the sequence optional introduces inconsistency and increases the risk that an analyst skips an identity check. Because the service desk needs a prescribed, enforceable procedure, a guideline's flexibility is insufficient.

• ✓

  Procedure, because it provides exact steps staff must follow in order

  Why this is correct

  A procedure is the correct document type because it specifies a mandatory, repeatable sequence of detailed actions—such as 'verify two identity attributes, then reset the password, then log the incident ticket.' Procedures remove ambiguity, ensure every analyst performs the task in the same secure order, and support auditability and accountability. This makes a procedure far more actionable than a policy, standard, or guideline for service desk workflows.

• ✗

  Standard, because it defines a general topic without operational detail

  Why it's wrong here

  A standard defines mandatory technical specifications, baselines, or security requirements—such as 'minimum password length is 12 characters' or 'TLS 1.2 or higher must be used'—but it does not describe the order of operational actions. While a standard would list prerequisites for the password environment, it would not walk an analyst through the call-verification and reset steps. Thus, a standard lacks the sequential workflow detail required by the service desk.

Go deeper

Related to this question