SY0-701 General Security Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Defense in depth

  Why it's wrong here

  Defense in depth is a security architecture that layers multiple independent controls—such as network firewalls, IDS/IPS, antivirus, and endpoint protection—so that if one fails, another compensates. While a zero-trust model may include layered defenses, the fundamental premise here is not simply adding more barriers; it is rejecting implicit trust in the network path and continuously evaluating each access request based on identity, device health, and policy. This scenario is about changing the trust model to require verification for every sensitive action, not about layering preventive and detective controls to create redundant lines of defense.

• ✓

  Zero trust

  Why this is correct

  Zero trust assumes that no user, device, or network path should be trusted by default, even after initial authentication. Each access request is evaluated using identity, device health, and context before the action is allowed. That approach fits the scenario because sensitive actions are rechecked instead of relying on a one-time login event.

• ✗

  Need-to-know

  Why it's wrong here

  Need-to-know is an access control principle that restricts access to information or resources to only those users whose job role or mission requires it, often implemented through compartmentalization or formal clearance processes. It defines the static boundaries of what a user may access based on their assigned duties, but it does not address how access decisions are continually validated at the time of each action. The scenario describes a shift where each sensitive operation is rechecked against identity, device posture, and context, which is a dynamic, continuous verification approach—far beyond merely limiting access to information on a need-to-know basis.

• ✗

  Least privilege

  Why it's wrong here

  Least privilege is a foundational security principle that grants users only the minimum permissions necessary to perform their tasks, reducing the attack surface and limiting potential damage from a compromised account or process. However, it is fundamentally about the initial and ongoing assignment of static access rights, not about requiring explicit validation for every individual access attempt. In this scenario, the team is not simply trimming privileges; they are adopting a model where all access requests—even those from an already authenticated user—are evaluated each time based on identity assurance, device compliance, and contextual risk, which is the defining characteristic of zero trust.