SY0-701 General Security Concepts Practice Test 7 — 15 Questions

Question 1

A records application displays a mandatory notice before login that tells employees exactly which data types they may open, when to lock their screens, and that only assigned work may be processed. The notice is meant to shape behavior before misuse occurs, but it does not technically block any action. Which control type is this notice?

Accepted Answer

Directive control. A directive control is designed to guide or mandate behavior through policies, procedures, or notices without enforcing technical restrictions. This notice explicitly tells employees which data types they may open, when to lock screens, and that only assigned work may be processed, shaping behavior before misuse occurs without blocking any action. It aligns with the definition of a directive control as it provides rules and expectations rather than preventing or deterring actions through technical means.

Answer

Preventive control

Answer

Deterrent control

Answer

Detective control

Question 2

Based on the exhibit, which action is required to keep the backups restorable after the key-encryption key rotation?

Accepted Answer

Rewrap or keep access to the old KEK version until existing DEKs are migrated.. When a key-encryption key (KEK) is rotated, existing data-encryption keys (DEKs) that were wrapped with the old KEK version become unreadable unless the old KEK is retained or the DEKs are re-wrapped with the new KEK. Option B ensures that backups remain restorable by either keeping the old KEK version accessible or migrating DEKs to the new KEK, maintaining the chain of trust for decryption.

Answer

Delete vault-kek-v1 immediately so only the newest key remains active.

Answer

Re-encrypt the entire backup repository with a single shared password.

Answer

Export vault-kek-v2 into the backup files so each object stores the new key directly.

Question 3

Match each cryptographic concept to its best purpose.

Question 4

Based on the exhibit, which access change best follows least privilege while still allowing the help desk to complete the task?

Accepted Answer

Grant helpdesk_27 the Helpdesk_Admin role for the ticket and remove it after completion.. Option C is correct because it implements Role-Based Access Control (RBAC) by granting the help desk technician a temporary, ticket-specific role (Helpdesk_Admin) that provides just enough privileges to perform the password reset without granting broader administrative rights. This follows the principle of least privilege by limiting the elevated access to the exact scope and duration needed, and the role can be automatically revoked after the ticket is closed, minimizing the attack surface.

Answer

Add helpdesk_27 to Domain_Admin for seven days, since the request is urgent and time-limited.

Answer

Use a shared administrator password so the technician can finish the ticket without changing group memberships.

Answer

Ask the user's manager to perform the reset manually so the help desk does not need additional access.

Question 5

Before installing a vendor patch package on hundreds of endpoints, the security team wants to confirm the file was published by the vendor and was not altered during download. Which two verification steps should the team perform? Select two.

Accepted Answer

Verify the package signature with the vendor's public key.. Option A is correct because verifying the package signature with the vendor's public key confirms the package was cryptographically signed by the vendor, proving its authenticity and integrity. This process uses asymmetric cryptography where the vendor signs the package with their private key, and the security team uses the corresponding public key to validate that signature. It ensures the file was not tampered with after signing and that it originated from the claimed vendor.

Answer

Decrypt the package with the vendor's private key before installation.

Answer

Rotate the organization's internal encryption key before downloading.

Answer

Check only the file timestamp and size on disk.

Question 6

Match each principle to the scenario that best illustrates it.

Question 7

A finance manager can view only the reports needed for monthly budgeting and cannot see payroll details. Which principle is being applied?

Accepted Answer

Need-to-know, because access is limited to information required for the job.. The principle of need-to-know restricts access to only the information necessary for an individual to perform their job duties. In this scenario, the finance manager can view only monthly budgeting reports and is explicitly blocked from payroll details, which aligns directly with need-to-know. This is typically enforced through access control lists (ACLs) or role-based access control (RBAC) policies that limit data visibility based on job function.

Answer

Zero trust, because the manager uses a password to sign in.

Answer

Separation of duties, because the manager is part of finance.

Answer

Defense in depth, because only one report system is being used.

Question 8

During routine checks, configuration management finds several branch firewalls drifted from the approved baseline because a contractor changed settings locally. An automation job now compares each device nightly and automatically reapplies the approved configuration without waiting for a human ticket. Which control type is the automation?

Accepted Answer

Corrective control. The automation job corrects a detected drift by automatically reapplying the approved configuration, which is a classic corrective control. Corrective controls are designed to remediate or reverse an unwanted change or security event after it has been detected. In this scenario, the nightly comparison is detective, but the automatic reapplication is the corrective action.

Answer

Directive control

Answer

Detective control

Answer

Deterrent control

Question 9

Based on the exhibit, which principle should the organization enforce to reduce fraud risk while keeping the business process functional?

Accepted Answer

Separation of duties, because no single user should be able to complete every high-risk finance step alone.. Separation of duties (SoD) is the correct principle because it prevents any single employee from completing all steps in a high-risk financial transaction alone. By requiring at least two people to authorize and execute critical actions—such as initiating a payment and approving it—the organization reduces the risk of internal fraud without blocking the business workflow. This directly addresses the scenario where a single user could otherwise create, approve, and release a fraudulent payment.

Answer

Least privilege, because each employee should only have the fewest permissions needed for the shared account.

Answer

Need-to-know, because only employees with confidential financial data should see the workflow details.

Answer

Defense in depth, because the organization should add more security layers around the finance process.

Question 10

Match each scenario from a security design review to the principle it best demonstrates.

Question 11

Match each security principle to the best description.

Question 12

Match the security need to the best cryptographic solution.

Question 13

A help desk analyst can reset passwords in the ticketing portal but cannot view payroll records, edit user profiles, or access other HR functions. Which security principle is the organization applying?

Accepted Answer

Least privilege. The help desk analyst is granted only the permissions necessary to perform their job function—resetting passwords—while all other HR functions are explicitly denied. This is the core definition of least privilege: each user or system component receives the minimum set of access rights needed to complete their tasks. By restricting the analyst’s account to password reset operations only, the organization reduces the attack surface and limits potential damage from compromised credentials or insider misuse.

Answer

Defense in depth

Answer

Separation of duties

Answer

Zero trust

Question 14

A legacy payroll application cannot support multifactor authentication yet, but the business still needs to reduce risk while the application is being modernized. The security team limits access to a hardened jump host, requires manager approval for access requests, and adds extra logging until the application can be upgraded. What type of control is this?

Accepted Answer

Compensating control. Compensating controls are alternative security measures implemented when primary controls (like MFA) cannot be applied due to technical limitations. In this scenario, the jump host restriction, manager approval, and enhanced logging serve as compensating controls to reduce risk until the legacy payroll application can be modernized to support MFA.

Answer

Corrective control

Answer

Deterrent control

Answer

Preventive control

Question 15

A security architect proposes adding endpoint protection, network segmentation, multifactor authentication, email filtering, and immutable backups so that one failed safeguard does not expose the entire organization. What security strategy is being described?

Accepted Answer

Defense in depth. Defense in depth is a layered security strategy where multiple, independent controls (endpoint protection, network segmentation, MFA, email filtering, immutable backups) are deployed so that if one safeguard fails, others continue to protect the organization. This approach ensures no single point of failure can compromise the entire environment, aligning directly with the scenario described.

Answer

Least privilege

Answer

Need-to-know

Answer

Zero trust