SY0-701 General Security Concepts Practice Test 7 — 15 Questions

Question 1

A web portal for customer refunds checks device health at sign-in, then re-checks the device and user context before each refund over a threshold. A session that started on a managed laptop is blocked when the laptop later fails posture checks, even though the password remains valid. Which principle is best illustrated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Zero trust. The scenario describes a system that continuously verifies trust—checking device health at sign-in and re-evaluating both device and user context before each high-value action—and blocks access even when the password is valid. This is the core of Zero Trust: 'never trust, always verify,' where authentication and authorization are re-assessed at every transaction, not just at session start. The policy enforces access decisions based on real-time posture (e.g., device compliance, user behavior) rather than relying solely on a static credential.

Answer

Defense in depth

Answer

Least privilege

Answer

Need-to-know

Question 2

A small company wants all employees to lock their screens after 10 minutes of inactivity, and the rule is included in the formal security policy. What type of control is this?

Accepted Answer

Directive control, because it tells users what behavior is required.. A directive control is designed to guide or mandate user behavior through policies or procedures. In this case, the security policy explicitly requires employees to lock their screens after 10 minutes of inactivity, which is a directive that tells users what they must do. This is a procedural control, not a technical enforcement mechanism, so it falls under directive controls.

Answer

Detective control, because it discovers misuse after it happens.

Answer

Corrective control, because it repairs damage after an incident.

Answer

Compensating control, because it replaces a missing technical safeguard.

Question 3

A company uses an encryption key for a database backup process. The key is being replaced because the old one is near the end of its approved use period. What is this action called?

Accepted Answer

Key rotation, because an older key is replaced with a new one on schedule.. Key rotation is the scheduled replacement of an older encryption key with a new one, typically performed before the end of the key's cryptoperiod to maintain security and compliance. In this scenario, the database backup key is being replaced because it is near the end of its approved use period, which directly matches the definition of key rotation. This practice limits the amount of data encrypted with a single key and reduces the impact of a potential key compromise.

Answer

Key compression, because the key is made smaller before use.

Answer

Key translation, because the key is converted into another language.

Answer

Key formatting, because the key is stored in a different file type.

Question 4

A user database is stolen from a SaaS portal. Investigators discover the password column contains the same value for every user who chose "Summer2026!", and an attacker could use precomputed tables to crack weak passwords quickly. Which change best addresses both the repeated-value issue and rainbow-table risk?

Accepted Answer

Store each password with a unique salt and an adaptive hash such as bcrypt or Argon2. Using a unique salt per password ensures that even if two users choose the same password (e.g., 'Summer2026!'), their stored hashes will differ, eliminating the repeated-value issue. Additionally, adaptive hash functions like bcrypt or Argon2 are computationally expensive, making precomputed rainbow tables infeasible even if the salts were known, as each guess requires re-hashing with the specific salt.

Answer

Encrypt all stored passwords with AES and keep one shared key

Answer

Use SHA-256 without a salt

Answer

Add a digital signature to each password record

Question 5

Based on the exhibit, which security principle is the proposed workflow most directly enforcing?

Accepted Answer

Separation of duties, because no single person can create, approve, and implement the same production change.. The proposed workflow enforces separation of duties by requiring three distinct roles—requester, approver, and implementer—to complete a single firewall change. No single person can both create and approve the change, nor can they implement it without prior approval. This directly prevents any one individual from having end-to-end control over a production change, which is the core of separation of duties.

Answer

Least privilege, because each person gets only the minimum access needed for the task.

Answer

Defense in depth, because multiple layers of security are added around firewall changes.

Answer

Need-to-know, because the ticket is visible only to assigned people.

Question 6

A hybrid cloud portal first checks device health at the identity provider, then requires MFA, then enforces a per-application authorization decision before each sensitive action. Network access is also limited by a gateway, and a WAF sits in front of the app. Which two principles are best demonstrated? Select two.

Accepted Answer

Zero trust, because access is continuously verified instead of assumed after one login.. The scenario describes continuous verification of device health, MFA, and per-application authorization before each sensitive action, which aligns with the Zero Trust principle of 'never trust, always verify.' Unlike traditional perimeter-based security, Zero Trust assumes no implicit trust after initial authentication and requires ongoing validation at every access attempt.

Answer

Least privilege, because users are granted no access at all until the app is offline.

Answer

Separation of duties, because administrators and users must approve each other's actions.

Answer

Need-to-know, because the system hides all information until the user requests it.

Question 7

A company uses MFA, endpoint protection, firewalls, and network segmentation together to protect a customer portal. Which security principle does this best illustrate?

Accepted Answer

Defense in depth, because multiple layers protect the same asset.. Defense in depth is the correct principle because the company is deploying multiple, overlapping security controls—MFA, endpoint protection, firewalls, and network segmentation—to protect the same customer portal. This layered approach ensures that if one control fails (e.g., a firewall rule is misconfigured), other controls (e.g., endpoint detection or segmentation) still provide protection, reducing the overall risk of a single point of compromise.

Answer

Need-to-know, because users only see the data assigned to them.

Answer

Separation of duties, because no single person performs every security task.

Answer

Zero trust, because the portal is hosted in the cloud.

Question 8

A help desk technician needs temporary access to read one shared folder to troubleshoot a printer issue. Which access choice best follows least privilege?

Accepted Answer

Give the technician read-only access to the single shared folder needed for the ticket.. It grants the technician only the minimum permissions (read-only) to the specific resource (single shared folder) required to troubleshoot the printer issue. This adheres to the principle of least privilege by limiting access scope and duration, reducing the risk of unauthorized changes or data exposure.

Answer

Grant the technician full control of the entire file server for one day.

Answer

Add the technician to the domain admins group until the issue is resolved.

Answer

Allow the technician to use any account in the department for convenience.

Question 9

Based on the exhibit, what control type is the automated reapplication of the baseline?

Accepted Answer

Corrective control, because the MDM agent restores the approved baseline after the unauthorized change is found.. The automatic reapplication of the approved firewall baseline is a corrective control because it fixes a configuration that drifted away from the secure standard. The user was able to make the change, so the control was not preventive. The MDM system then returned the device to its approved state, which is the defining behavior of correction rather than simple detection or deterrence.

Why others are wrong: The user change was already allowed to happen, so the control was not preventive. The log shows an automatic restoration, not just an alert, so it is more than detective. A deterrent would merely discourage changes through warnings or visibility. The key evidence is the platform's automatic rollback to the approved baseline after the deviation was found.

Answer

Preventive control, because the system prevented the user from changing the firewall profile at all.

Answer

Detective control, because the help desk can review the event later.

Answer

Deterrent control, because the policy baseline discourages users from making changes.

Question 10

A records application displays a mandatory notice before login that tells employees exactly which data types they may open, when to lock their screens, and that only assigned work may be processed. The notice is meant to shape behavior before misuse occurs, but it does not technically block any action. Which control type is this notice?

Accepted Answer

Directive control. A directive control is designed to guide or mandate behavior through policies, procedures, or notices without enforcing technical restrictions. This notice explicitly tells employees which data types they may open, when to lock screens, and that only assigned work may be processed, shaping behavior before misuse occurs without blocking any action. It aligns with the definition of a directive control as it provides rules and expectations rather than preventing or deterring actions through technical means.

Answer

Preventive control

Answer

Deterrent control

Answer

Detective control

Question 11

Based on the exhibit, which action is required to keep the backups restorable after the key-encryption key rotation?

Accepted Answer

Rewrap or keep access to the old KEK version until existing DEKs are migrated.. When a key-encryption key (KEK) is rotated, existing data-encryption keys (DEKs) that were wrapped with the old KEK version become unreadable unless the old KEK is retained or the DEKs are re-wrapped with the new KEK. Option B ensures that backups remain restorable by either keeping the old KEK version accessible or migrating DEKs to the new KEK, maintaining the chain of trust for decryption.

Answer

Delete vault-kek-v1 immediately so only the newest key remains active.

Answer

Re-encrypt the entire backup repository with a single shared password.

Answer

Export vault-kek-v2 into the backup files so each object stores the new key directly.

Question 12

Match each cryptographic concept to its best purpose.

Accepted Answer

Confidentiality: Protects data from unauthorized disclosure. Confidentiality protects secrecy, integrity prevents tampering, authentication confirms identity, non-repudiation ensures proof of origin, availability ensures uptime, and accountability enables audit trails.

Answer

Confidentiality: Verifies the identity of a user

Answer

Integrity: Protects data from unauthorized disclosure

Question 13

Based on the exhibit, which access change best follows least privilege while still allowing the help desk to complete the task?

Accepted Answer

Grant helpdesk_27 the Helpdesk_Admin role for the ticket and remove it after completion.. It implements Role-Based Access Control (RBAC) by granting the help desk technician a temporary, ticket-specific role (Helpdesk_Admin) that provides just enough privileges to perform the password reset without granting broader administrative rights. This follows the principle of least privilege by limiting the elevated access to the exact scope and duration needed, and the role can be automatically revoked after the ticket is closed, minimizing the attack surface.

Answer

Add helpdesk_27 to Domain_Admin for seven days, since the request is urgent and time-limited.

Answer

Use a shared administrator password so the technician can finish the ticket without changing group memberships.

Answer

Ask the user's manager to perform the reset manually so the help desk does not need additional access.

Question 14

Match each principle to the scenario that best illustrates it.

Accepted Answer

Least privilege: A user is given only the permissions needed to perform their job.. Least privilege limits access rights; separation of duties divides critical tasks; defense in depth uses multiple security layers; need to know restricts data access; accountability tracks actions; fail safe ensures security on failure.

Answer

Least privilege: Two people are required to approve a financial transaction.

Answer

Separation of duties: A user is given only the permissions needed to perform their job.

Answer

Defense in depth: An employee accesses customer data only when required for their role.

Question 15

A finance manager can view only the reports needed for monthly budgeting and cannot see payroll details. Which principle is being applied?

Accepted Answer

Need-to-know, because access is limited to information required for the job.. The principle of need-to-know restricts access to only the information necessary for an individual to perform their job duties. In this scenario, the finance manager can view only monthly budgeting reports and is explicitly blocked from payroll details, which aligns directly with need-to-know. This is typically enforced through access control lists (ACLs) or role-based access control (RBAC) policies that limit data visibility based on job function.

Answer

Zero trust, because the manager uses a password to sign in.

Answer

Separation of duties, because the manager is part of finance.

Answer

Defense in depth, because only one report system is being used.