SY0-701 General Security Concepts Practice Question
A finance application records each approval with the manager's unique user ID and a digital signature. Auditors want proof that the manager cannot later deny approving the transaction. Which security objective is most directly being addressed?
⚠ Common exam trap
CompTIA often tests the distinction between accountability (logging who did what) and nonrepudiation (cryptographic proof that prevents denial), so candidates may pick 'Accountability' because they see user IDs and logs, missing that the digital signature is the key element for nonrepudiation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Nonrepudiation
Nonrepudiation ensures that a party cannot deny having performed a specific action. By recording the manager's unique user ID and a digital signature, the system provides cryptographic proof that the manager approved the transaction, making it impossible for them to later deny it. This directly addresses the audit requirement for undeniable evidence of approval.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Availability
Why it's wrong here
Availability is a pillar of the CIA triad focused on ensuring authorized users can access systems, data, and services when needed, typically through redundancy, fault tolerance, and protection against denial-of-service attacks. However, this property says nothing about proving that a specific manager approved a finance transaction; it only addresses whether the system remains up and responsive. Because the scenario requires preventing a manager from later denying an approval, availability is irrelevant to this requirement.
- ✓
Nonrepudiation
Why this is correct
Nonrepudiation is the security goal that provides strong, verifiable evidence that a specific party performed an action, making denial difficult or impossible. In a finance application, applying a manager's digital signature to an approval record binds that manager to the transaction cryptographically, ideally with a trusted timestamp. Because the signature can be verified with the manager's public key and requires possession of the manager's private key, the manager cannot plausibly claim they never approved the transaction. This makes nonrepudiation the correct answer.
- ✗
Confidentiality
Why it's wrong here
Confidentiality protects sensitive financial records from unauthorized disclosure by enforcing encryption, access controls, and data classification, ensuring that only authorized staff can read approval details. However, confidentiality is about preventing observation, not about proving the origin or authenticity of an action; a confidential record could still be forged, altered, or denied by the manager. Since the question asks for the property that prevents a manager from denying their approval, confidentiality is insufficient and incorrect.
- ✗
Accountability
Why it's wrong here
Accountability is a governance and audit function that assigns responsibility and traces actions to users via robust logging, monitoring, and identification mechanisms, producing an audit trail for review. Yet audit logs are administrative evidence and can be disputed, modified by insiders, or questioned in court because they do not inherently cryptographically bind the actor. Nonrepudiation, in contrast, provides stronger, legally defensible assurance—typically through digital signatures—that the manager cannot retract their approval, so accountability, while related, is not the primary goal the scenario demands.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Digital signature
A cryptographic technique used to verify the authenticity and integrity of a digital message or document, ensuring it came from the claimed sender and was not altered.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.