SY0-701 General Security Concepts Practice Test 8 — 15 Questions

Question 1

A finance manager can view only the reports needed for monthly budgeting and cannot see payroll details. Which principle is being applied?

Accepted Answer

Need-to-know, because access is limited to information required for the job.. The principle of need-to-know restricts access to only the information necessary for an individual to perform their job duties. In this scenario, the finance manager can view only monthly budgeting reports and is explicitly blocked from payroll details, which aligns directly with need-to-know. This is typically enforced through access control lists (ACLs) or role-based access control (RBAC) policies that limit data visibility based on job function.

Answer

Zero trust, because the manager uses a password to sign in.

Answer

Separation of duties, because the manager is part of finance.

Answer

Defense in depth, because only one report system is being used.

Question 2

During routine checks, configuration management finds several branch firewalls drifted from the approved baseline because a contractor changed settings locally. An automation job now compares each device nightly and automatically reapplies the approved configuration without waiting for a human ticket. Which control type is the automation?

Accepted Answer

Corrective control. The automation job corrects a detected drift by automatically reapplying the approved configuration, which is a classic corrective control. Corrective controls are designed to remediate or reverse an unwanted change or security event after it has been detected. In this scenario, the nightly comparison is detective, but the automatic reapplication is the corrective action.

Answer

Directive control

Answer

Detective control

Answer

Deterrent control

Question 3

Based on the exhibit, which principle should the organization enforce to reduce fraud risk while keeping the business process functional?

Accepted Answer

Separation of duties, because no single user should be able to complete every high-risk finance step alone.. Separation of duties (SoD) is the correct principle because it prevents any single employee from completing all steps in a high-risk financial transaction alone. By requiring at least two people to authorize and execute critical actions—such as initiating a payment and approving it—the organization reduces the risk of internal fraud without blocking the business workflow. This directly addresses the scenario where a single user could otherwise create, approve, and release a fraudulent payment.

Answer

Least privilege, because each employee should only have the fewest permissions needed for the shared account.

Answer

Need-to-know, because only employees with confidential financial data should see the workflow details.

Answer

Defense in depth, because the organization should add more security layers around the finance process.

Question 4

Match each security principle to the best description.

Accepted Answer

Confidentiality: Restricts access to authorized users.. These pairings match the CIA triad plus additional principles: confidentiality restricts access, integrity prevents unauthorized changes, availability ensures uptime, non-repudiation provides proof of actions, authentication verifies identity, and authorization defines permissions.

Answer

Non-repudiation: Ensures data is unchanged.

Answer

Authentication: Grants permissions.

Answer

Authorization: Verifies identity.

Question 5

Match the security need to the best cryptographic solution.

Accepted Answer

Confidentiality: Encryption. Confidentiality uses encryption; integrity uses hashes; authentication uses certificates; non-repudiation uses signatures; access control uses PKI; availability uses redundancy.

Answer

Authentication: Symmetric encryption

Answer

Access control: Hashing

Question 6

A help desk analyst can reset passwords in the ticketing portal but cannot view payroll records, edit user profiles, or access other HR functions. Which security principle is the organization applying?

Accepted Answer

Least privilege. The help desk analyst is granted only the permissions necessary to perform their job function—resetting passwords—while all other HR functions are explicitly denied. This is the core definition of least privilege: each user or system component receives the minimum set of access rights needed to complete their tasks. By restricting the analyst’s account to password reset operations only, the organization reduces the attack surface and limits potential damage from compromised credentials or insider misuse.

Answer

Defense in depth

Answer

Separation of duties

Answer

Zero trust

Question 7

A legacy payroll application cannot support multifactor authentication yet, but the business still needs to reduce risk while the application is being modernized. The security team limits access to a hardened jump host, requires manager approval for access requests, and adds extra logging until the application can be upgraded. What type of control is this?

Accepted Answer

Compensating control. Compensating controls are alternative security measures implemented when primary controls (like MFA) cannot be applied due to technical limitations. In this scenario, the jump host restriction, manager approval, and enhanced logging serve as compensating controls to reduce risk until the legacy payroll application can be modernized to support MFA.

Answer

Corrective control

Answer

Deterrent control

Answer

Preventive control

Question 8

A security architect proposes adding endpoint protection, network segmentation, multifactor authentication, email filtering, and immutable backups so that one failed safeguard does not expose the entire organization. What security strategy is being described?

Accepted Answer

Defense in depth. Defense in depth is a layered security strategy where multiple, independent controls (endpoint protection, network segmentation, MFA, email filtering, immutable backups) are deployed so that if one safeguard fails, others continue to protect the organization. This approach ensures no single point of failure can compromise the entire environment, aligning directly with the scenario described.

Answer

Least privilege

Answer

Need-to-know

Answer

Zero trust

Question 9

Based on the exhibit, which security principle should the team strengthen to reduce the chance that stolen credentials alone provide access to sensitive data?

Accepted Answer

Zero trust, because every request should be re-evaluated instead of relying on the earlier VPN login.. The exhibit shows a scenario where a VPN session grants persistent access to sensitive data without re-authentication. Zero trust is correct because it mandates continuous verification of every request, not just the initial VPN login, so stolen credentials alone would not provide ongoing access to sensitive data. This principle enforces micro-segmentation and per-request authorization, directly addressing the vulnerability of credential theft.

Answer

Least privilege, because the user should only have the minimum file permissions needed.

Answer

Need-to-know, because all finance data should be hidden from anyone outside the department.

Answer

Defense in depth, because multiple layers are always better than one control.

Question 10

Based on the exhibit, what is the best conclusion about the signed document?

Accepted Answer

The invoice was not changed after signing and the signer’s certificate chain validated correctly.. A valid digital signature provides both integrity (the document was not altered after signing) and authentication (the signer's certificate chain validates to a trusted root). The exhibit shows a successful signature validation, which cryptographically proves that the invoice has not been modified since signing and that the signing certificate is trusted.

Answer

The invoice is confidential because the signature encrypts the document contents.

Answer

The invoice can be edited if the timestamp is still within business hours.

Answer

The sender’s private key is now public because the certificate verified successfully.

Question 11

Match each cryptographic primitive to its main purpose.

Accepted Answer

Symmetric encryption: Uses a single shared key for encryption and decryption.. Symmetric encryption is efficient for large data, asymmetric encryption enables key exchange and signatures, hash functions ensure integrity, MACs combine integrity and authenticity, digital signatures add non-repudiation, and KDFs strengthen passwords for key use.

Answer

Asymmetric encryption: Uses a single shared key for encryption and decryption.

Answer

Hash function: Provides non-repudiation and sender authentication.

Answer

Digital signature: Produces a fixed-size digest for data integrity.

Question 12

A branch office needs to send a confidential design document to headquarters over an untrusted network. Headquarters already has the public/private key pair available for document exchange. Which method is most appropriate to keep the file confidential during transit without first sharing a secret key?

Accepted Answer

Encrypt the file with headquarters' public key. Encrypting the file with headquarters' public key ensures that only headquarters, possessing the corresponding private key, can decrypt and read the file. This method provides confidentiality over an untrusted network without requiring a pre-shared secret key, as the public key can be freely distributed.

Answer

Publish a hash of the file for comparison

Answer

Sign the file with the branch office private key only

Answer

Compress the file before sending it

Question 13

A backup server encrypts large nightly database exports before sending them to an offsite storage system. The organization has already arranged a secure way to share the secret key between the systems, and performance is a concern because the files are very large. Which encryption approach is the best fit?

Accepted Answer

Symmetric encryption. Symmetric encryption (e.g., AES-256) is the best fit because it uses a single shared secret key for both encryption and decryption, offering significantly higher throughput than asymmetric methods. For large files like nightly database exports, symmetric ciphers are hardware-accelerated (e.g., AES-NI) and introduce minimal performance overhead, while the secure key exchange is already handled separately.

Answer

Asymmetric encryption

Answer

Hashing

Answer

Digital signatures

Question 14

To discourage unauthorized entry into a records room, facilities installs a large warning sign, a visible camera over the door, and a turnstile staffed by a guard during business hours. Which control category is the warning sign intended to support most directly?

Accepted Answer

Deterrent. The warning sign is a physical security control designed to discourage unauthorized entry by making potential intruders aware of the risks and consequences. This directly supports the deterrent control category, which aims to reduce the likelihood of a security incident by influencing behavior through fear of detection or punishment. Unlike detective controls that identify incidents after they occur, or preventive controls that physically block access, the sign's primary function is psychological deterrence.

Answer

Detective

Answer

Preventive

Answer

Corrective

Question 15

Based on the exhibit, which principle is most directly being violated by the current share permissions?

Accepted Answer

Need-to-know, because only the people working on valuation models should access them.. The exhibit shows share permissions granting 'Finance Dept' full control over a folder containing valuation models. The need-to-know principle restricts access to only those individuals who require the information to perform their job functions. Since not all Finance Dept members work on valuation models, granting the entire department access violates need-to-know, as only the specific users building those models should have access.

Answer

Least privilege, because the broad Finance Dept access exceeds what many users require.

Answer

Zero trust, because the share should refuse access until every file request is reauthenticated.

Answer

Defense in depth, because the folder should have several separate layers of encryption.