Exam CS0-003 topic 1 question 394 discussion

After looking through this again, it looks like D is the best answer. They aren't asking for how the organization will ensure it's employees will comply with the policy, they are defining the policy.

the policy itself is an administrative control, not an education initiative. Thus, the policy of requiring users to lock their systems is an administrative control because it's a formal policy meant to regulate user actions for security purposes.

An administrative control refers to policies, procedures, and guidelines that influence the behavior of users and staff within an organization to enhance security. Instituting a policy requiring users to lock their systems when stepping away from their desks is an example of this type of control, as it involves setting a rule for user behavior to prevent unauthorized access.

This is real typical for C.

Given that it's an actual policy, and the question asks specifically what implementing this policy is, I'd go with D. ChatGPT o1 agrees with me if that means anything.

C makes more sense to me - the question clearly states the action is on the user to perform: must lock THEIR systems when stepping away from THEIR desks