HR publishes a mandatory password-change policy for all municipal accounts. Which control category best fits that written policy?
Select an answer to reveal the explanation.
Short Explanation
A written password policy is like the employee handbook rule — leadership set the expectation on paper. That is managerial (administrative) territory. The IdP that enforces complexity is technical; the nightly ticket grind is operational.
Full Explanation
Managerial controls are administrative and governance artifacts: policies, standards, high-level procedures, risk assessments, and similar decisions that direct security intent across the organization. An HR-published mandatory password-change policy for all municipal accounts is managerial because it states what must happen as an organizational rule. The document itself sits on the governance side of the category axis, regardless of which identity product later enforces password age.
Calling the policy technical because passwords are enforced by identity software confuses the enforcement mechanism with the control being classified. Technical controls are technologies—IdP rules, GPOs, PAM tools—that implement protections. Those may follow, but the written policy artifact remains managerial. Labeling it physical because staff "must be in the building to change passwords" invents a facility constraint that does not define the category; physical controls protect spaces and hardware, not the nature of a password standard. Framing it as operational because help-desk staff will answer reset tickets mixes day-to-day people processes with governance: ticket handling is operational, while the mandatory policy that creates the requirement is managerial.
Exam caveat: SY0-701 often presents a policy and an enforcing tool in the same vignette. Classify the object named in the question—here, the published policy—not every related system. Policies are managerial even when tools enforce them.
Operational check: publish the municipal password policy with clear scope, exceptions, and review cadence; map technical settings in Active Directory or the cloud IdP to that policy; train help desk on operational reset procedures that still honor managerial requirements such as identity proofing before reset.