CISSP Security and Risk Management Practice Question
A security administrator is reviewing the organization's security policy framework. The administrator needs to identify the document that provides detailed, step-by-step instructions for configuring a new server securely. Which type of document should the administrator reference?
⚠ Common exam trap
Many candidates confuse a standard with a procedure, assuming that any document specifying security requirements provides step-by-step instructions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Procedure
The correct answer is a procedure because it provides detailed, step-by-step instructions for performing a specific task like securely configuring a server. Policies, standards, and guidelines do not offer the operational granularity required for this technical task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Standard
Why it's wrong here
A standard specifies mandatory requirements or rules to support a policy, such as minimum password length or approved encryption algorithms. While it may specify what must be done, it does not provide step-by-step instructions for how to configure a server. Standards are more prescriptive than policies but still not procedural.
- ✓
Procedure
Why this is correct
A procedure is a detailed, step-by-step document that outlines how to perform a specific task, such as securely configuring a server. It translates standards and policies into actionable steps. This matches the administrator's need for precise instructions, making it the correct choice.
- ✗
Guideline
Why it's wrong here
A guideline provides recommendations or best practices that are not mandatory. It offers advice but does not give step-by-step instructions. Since the administrator needs detailed, mandatory steps for server configuration, a guideline is not the appropriate document type.
- ✗
Policy
Why it's wrong here
A policy is a high-level statement of management intent that defines the organization's security objectives and assigns responsibilities. It does not provide detailed, step-by-step instructions for technical tasks like server configuration. Policies are strategic and broad, so they are not the correct document type for this scenario.
Go deeper
Related to this question
Key term
Security policy
A security policy is a formal set of rules and guidelines that an organization establishes to protect its information assets and technology resources.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.