CISSP Security and Risk Management Practice Question
Which of the following is an example of a security policy?
⚠ Common exam trap
The trap is confusing a standard with a policy — candidates pick D because it sounds security-related, but specific password rules are a standard, while a policy is a mandatory high-level directive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
All employees must use multi-factor authentication
A security policy is a high-level statement of management intent that mandates required behavior. 'All employees must use multi-factor authentication' is a directive, organization-wide requirement, which is the defining characteristic of a policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Step 1: Log in, Step 2: Enter code, Step 3: Access system
Why it's wrong here
A procedure provides detailed, step-by-step instructions for performing a specific task or process. This example clearly outlines the sequential actions required to gain system access, making it an operational guide rather than a high-level organizational mandate. Policies state *what* must be done, while procedures explain *how* to do it.
- ✗
It is recommended to change passwords every 90 days
Why it's wrong here
A guideline offers advice or best practices that are strongly suggested but not strictly mandatory. The use of "recommended" indicates a flexible suggestion rather than a compulsory rule, allowing for discretion based on specific circumstances. Policies, in contrast, establish binding requirements that must be followed without exception.
- ✓
All employees must use multi-factor authentication
Why this is correct
A security policy is a high-level, mandatory statement issued by management that defines the organization's overall security objectives and requirements. This statement clearly dictates a non-negotiable requirement for all employees, establishing a foundational security control to protect organizational assets. It addresses *what* is required for security, without specifying the technical implementation details.
- ✗
Use passwords of at least 12 characters with mixed case and numbers
Why it's wrong here
A standard specifies mandatory requirements for hardware, software, or configurations to ensure consistency and interoperability within an organization. This example details specific technical parameters for password construction, providing a precise, enforceable rule for password complexity. While derived from policy, it outlines the *specific technical criteria* that must be met, rather than the overarching security objective.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Security policy
A security policy is a formal set of rules and guidelines that an organization establishes to protect its information assets and technology resources.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.