SY0-701 General Security Concepts Practice Question
Exhibit
Workstation baseline: - Standard users are local admins - Executables and scripts run from user-writable paths - Unauthorized persistence reappears after reimaging - Developers need to install approved tools, but not arbitrary software
A baseline review found that standard developer accounts are local administrators, unsigned tools can run from user profile folders, and reimaged systems still end up with unauthorized persistence. Which two changes best improve hardening while preserving developer work? Select two.
⚠ Common exam trap
It's easy for candidates to think removing admin rights alone is sufficient, but the question requires two changes that best improve hardening while preserving developer work, and application allowlisting (Option B) is the second critical control to block unsigned tools from running in user profile folders, which removal of admin rights alone does not address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove local administrator rights from standard user accounts.
Removing local administrator rights from standard developer accounts enforces the principle of least privilege (PoLP). This prevents developers from making unauthorized system-wide changes, such as installing unsigned tools or creating persistence mechanisms, while still allowing them to perform their work with standard user permissions. This directly addresses the baseline review finding that standard developer accounts are local administrators, which is a common security misconfiguration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Remove local administrator rights from standard user accounts.
Why this is correct
Removing local administrator rights from standard user accounts enforces least privilege by ensuring that malicious processes or accidental misconfigurations cannot write to protected system directories or modify security settings. Without local admin privileges, common persistence mechanisms like service creation, scheduled task manipulation, and registry run keys become far more difficult to implement. This control also contains the impact of a compromised session, limiting what an attacker can accomplish while still requiring them to find a separate privilege escalation vulnerability.
- ✓
Enforce application allowlisting for approved executables and scripts.
Why this is correct
Enforcing application allowlisting for approved executables and scripts restricts execution to only those binaries that are explicitly authorized, blocking unapproved tools, scripts, and loaders from running even if they are written to user-writable folders. This is particularly effective after reimaging or during normal operations because it stops malicious payloads at the point of execution rather than relying on signatures or heuristics. A properly configured allowlist will deny execution of code in temporary directories, browser caches, and other common staging locations used by attackers.
- ✗
Turn off logging to preserve disk space.
Why it's wrong here
Turning off logging to preserve disk space is fundamentally counterproductive because it eliminates the telemetry needed to detect, confirm, and investigate security incidents. Without logs, security teams lose visibility into process executions, network connections, authentication failures, and other key indicators of compromise, making post-breach forensics nearly impossible. While disk capacity may be a legitimate operational concern, the correct response is to implement log rotation, centralized collection, or storage expansion—not to disable auditing altogether.
- ✗
Allow unrestricted browser extension installs.
Why it's wrong here
Allowing unrestricted browser extension installs gives end users the ability to add third-party code that often runs with the context of the user's session and can access or exfiltrate sensitive web application data. Many extensions request broad permissions to read and modify all websites, and rogue or compromised extensions have been a vector for credential theft, browser hijacking, and cryptocurrency miners. A hardened workstation should restrict extension installation to an approved catalog and enforce corporate policies for browser configuration.
- ✗
Merge all developer and production systems into one VLAN.
Why it's wrong here
Merging all developer and production systems into one VLAN removes the network segmentation that is essential for containing a breach and limiting lateral movement. If a developer workstation is compromised, an attacker can pivot directly to production servers without crossing a security boundary, increasing the blast radius of any single foothold. Defense-in-depth requires separate zones with controlled traffic flow, such as a DMZ or dedicated management network, so that compromise in a lower trust zone does not automatically expose critical production assets.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Persistence
Persistence is the set of techniques attackers use to maintain long-term access to a compromised system even after reboots or credential changes.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.