Question 846 of 1,013
SY0-701 General Security Concepts Practice Question
Which two documents are typically mandatory and organization-wide rather than optional guidance? Select two.
⚠ Common exam trap
Candidates often confuse 'guidelines' with 'standards' because both provide technical details, but guidelines are optional while standards are mandatory, and the exam expects you to distinguish between enforceable documents (policy/standard) and advisory ones (guideline).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security policy
Security policies are mandatory, high-level documents that define management's intent and direction for security, establishing rules that all employees must follow. They are organization-wide and enforceable, unlike guidelines which are optional. Standards are also mandatory and specify uniform technical controls or configurations (e.g., requiring AES-256 encryption) that must be implemented across the organization to comply with the security policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Security policy
Why this is correct
A security policy is the highest-level governance document that mandates management's intent, scope, and responsibilities for protecting information assets. It is organization-wide, enforceable, and forms the basis for all subordinate controls. Under ISO/IEC 27001, the security policy must be formally approved and communicated, and non-compliance is grounds for disciplinary action.
- ✓
Standard
Why this is correct
Standards translate high-level policy into mandatory, measurable requirements, such as approved cryptographic algorithms, password complexity rules, or patch timelines. They are normative and auditable, and deviations require formal exceptions, making them binding on all applicable systems and personnel. A standard often specifies the 'what' without being an optional suggestion.
- ✗
Guideline
Why it's wrong here
Guidelines provide recommended, context-dependent practices that enhance security but are explicitly not compulsory. For example, a guideline might suggest a particular tool for log analysis, yet teams can choose alternatives without a formal exception process. Their purpose is to share best practices while allowing professional judgment, so they cannot satisfy a requirement for a mandatory document.
- ✗
Personal preference note
Why it's wrong here
A personal preference note is an unstructured, unofficial artifact that has not gone through governance review or approval, and therefore carries no authority. It reflects an individual's opinion on a topic, not a consensus or management directive, and no other employee is obligated to follow it. Governance frameworks only recognize documents with defined ownership, revision, and distribution controls.
- ✗
Architecture diagram
Why it's wrong here
An architecture diagram is a descriptive visual model that illustrates system topology, data flows, or infrastructure relationships, but it does not impose behavioral or technical mandates. While it may support policy and standard development, the diagram itself is not a normative document—for example, naming a firewall is not the same as requiring a specific security control. It is a design aid rather than a governance requirement.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.