SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Deploying Data Loss Prevention (DLP) solutions to monitor and block sensitive data leaving via email or USB

  Why this is correct

  DLP solutions perform deep content inspection and contextual analysis to detect regulated or proprietary data in motion via email and at rest on endpoints such as USB drives. By enforcing policy to block, quarantine, or encrypt sensitive data, DLP directly addresses insider exfiltration, where a trusted employee might otherwise copy customer PII or source code to personal storage. This is a data-centric control tailored to stop confidentiality breaches from occurring.

• ✓

  Implementing user behavior analytics (UBA) to flag unusual access patterns or large downloads

  Why this is correct

  User behavior analytics (UBA) establishes a baseline of normal activity for each user using machine learning and statistical modeling. It then continuously evaluates current behavior against that baseline, triggering alerts when an insider accesses systems off-hours, downloads unusually large volumes of files, or attempts to reach unrelated data stores. UBA is a detective control designed to surface both compromised credentials and malicious insiders early, before a large-scale leak occurs.

• ✓

  Enforcing strict role-based access controls (RBAC) with the principle of least privilege

  Why this is correct

  Role-based access control (RBAC) assigns permissions based on an employee's job function, ensuring each user can access only the resources necessary to perform their duties. The principle of least privilege further reduces the attack surface by limiting access rights to the minimum needed, so even a legitimate insider cannot easily reach sensitive data outside their responsibility. This is a foundational preventive control that contains the potential blast radius of any insider act, but it requires continuous role reviews and provisioning to remain effective.

• ✗

  Requiring all employees to use complex passwords changed every 30 days

  Why it's wrong here

  Mandating complex password changes every 30 days is an older authentication practice that actually encourages unsafe behaviors such as slight password variations or writing credentials down. Moreover, it does not address the core insider-threat scenario where a trusted employee with legitimate access intentionally exfiltrates data. This measure primarily protects against remote account compromise, not malicious acts performed with authenticated sessions, and modern guidelines recommend longer passphrases rather than frequent rotation.

• ✗

  Installing antivirus software on all endpoints

  Why it's wrong here

  Endpoint antivirus software scans for known malware signatures and heuristic indicators, protecting the host from malicious code introduced by external attackers. It does not monitor user activity such as copying files to a USB drive, sending sensitive attachments via email, or using a cloud sync tool, because those actions involve legitimate system functionality. A malicious insider typically uses standard built-in utilities, so antivirus provides no meaningful barrier to data theft and is not an insider-threat control.

• ✗

  Conducting annual security awareness training for all staff

  Why it's wrong here

  Security awareness training is important for reducing accidental insider incidents like phishing-induced credential loss or accidental data exposure. However, a deliberate insider attacker already knows the organization's policies and still chooses to violate them, making education ineffective against malice. Since training relies on employee goodwill and provides no technical enforcement, it cannot monitor or block data movement and therefore lacks the concrete protection offered by DLP or behavioral monitoring.

Go deeper

Related to this question