Which statement best describes the primary purpose of a security policy?

• A. To outline the guidelines and procedures for maintaining information security
• B. To specify daily operational tasks
• C. To monitor employee performance
• D. To encrypt all communications by default

Answer: (A)

The main idea being tested is that a security policy sets the high-level rules and governance framework for protecting information. It defines who is responsible for security, what behavior is allowed or prohibited, which controls must be in place, and how compliance will be enforced. The statement that best describes the primary purpose is that it outlines the guidelines and procedures for maintaining information security, because this gives the organization a consistent baseline for security across people, processes, and technology, linking security goals to governance and compliance.

Operations-focused tasks belong to procedures or day-to-day workflows, which describe how to carry out work rather than the overarching rules. Monitoring employee performance relates to management practices, not the security policy’s core aim. Encrypting all communications by default is a concrete technical control, a measure that might be driven by policy, but not the policy’s fundamental purpose itself.