SY0-701 General Security Concepts Practice Question
A financial institution is implementing a new policy for all remote access to its payment processing system. The system will generate a unique digital signature for each administrative action, and all actions will be recorded in a tamper-evident audit log that is replicated to an immutable storage location. The primary objective of this policy is to ensure that administrators who perform sensitive operations cannot later deny having executed them. Which security goal is this policy primarily intended to enforce?
⚠ Common exam trap
Many exam-takers confuse authentication (proving identity at login) with non-repudiation (proving identity for a specific action after the fact), but the question's focus on digital signatures and tamper-evident logs clearly points to non-repudiation, not just authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Non-repudiation
The policy's use of unique digital signatures for each administrative action, combined with a tamper-evident audit log replicated to immutable storage, directly enforces non-repudiation. Non-repudiation ensures that an administrator cannot deny having performed a specific action because the digital signature cryptographically binds the action to the administrator's identity, and the immutable log prevents any subsequent alteration or deletion of the record. This is the primary security goal when the objective is to prevent denial of responsibility for sensitive operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Authorization
Why it's wrong here
Authorization is the process of granting or denying a user's access to specific resources and actions based on their identity and permissions, such as role-based access control. While authorization ensures that a user can only perform allowed operations, it does not provide any means of proving that those operations actually occurred or that the user is accountable for them. A user who is authorized to make a transaction can still later deny having done so, unless a separate non-repudiation mechanism is implemented.
When this WOULD be correct
A question describing a policy that defines which administrators can access the payment system based on their roles, using role-based access control (RBAC) or access control lists (ACLs), would make authorization the correct answer.
- ✓
Non-repudiation
Why this is correct
Non-repudiation is a security service that provides cryptographic proof of the origin, authenticity, and integrity of a transaction or communication. In a financial institution's policy, mechanisms such as digital signatures, hash chaining, and tamper-evident audit logs ensure that an individual cannot plausibly deny having initiated or approved a specific action. This directly supports accountability and legal defensibility, making it the correct goal for preventing false denial.
- ✗
Authentication
Why it's wrong here
Authentication is the process of verifying a user's claimed identity through credentials such as passwords, biometrics, or security tokens. While authentication establishes who is allowed into a system at a given moment, it does not bind that verified identity to subsequent actions in a way that prevents the user from later claiming they never performed them. For example, a user can log in successfully and then deny sending a funds transfer unless additional non-repudiation controls are in place.
When this WOULD be correct
A question where the primary goal is to verify the identity of a user before granting access, such as 'A system requires users to provide a password and a one-time code before accessing sensitive data. Which security goal is being enforced?'
- ✗
Availability
Why it's wrong here
Availability is the principle that systems, data, and services remain accessible and usable when required, often ensured through redundancy, failover, and protection against denial-of-service attacks. The policy described is focused on creating accountability for individual actions, not on maintaining uptime or resilience. Even if a fully available system is in place, it would not stop a user from denying that they performed an action, so availability is not the correct answer.
When this WOULD be correct
A question describing a policy to ensure that a payment processing system remains operational during peak hours, with redundant servers and failover mechanisms, would make availability the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Non-repudiationCorrect answer▾
Why this is correct
Non-repudiation is a security service that provides cryptographic proof of the origin, authenticity, and integrity of a transaction or communication. In a financial institution's policy, mechanisms such as digital signatures, hash chaining, and tamper-evident audit logs ensure that an individual cannot plausibly deny having initiated or approved a specific action. This directly supports accountability and legal defensibility, making it the correct goal for preventing false denial.
✗AuthorizationWrong answer — click to see why▾
Why this is wrong here
The policy focuses on preventing denial of actions through digital signatures and tamper-evident logs, which is non-repudiation, not authorization. Authorization controls what actions a user is allowed to perform, but does not prevent denial of those actions.
★ When this WOULD be the correct answer
A question describing a policy that defines which administrators can access the payment system based on their roles, using role-based access control (RBAC) or access control lists (ACLs), would make authorization the correct answer.
Why candidates choose this
Candidates may confuse authorization with non-repudiation because both involve administrative actions, but authorization is about permissions, not about irrefutably proving actions were taken.
✗AuthenticationWrong answer — click to see why▾
Why this is wrong here
The policy focuses on preventing denial of actions (non-repudiation) through digital signatures and tamper-evident logs, not on verifying identity (authentication). Authentication is about proving who you are, not proving that you performed a specific action.
★ When this WOULD be the correct answer
A question where the primary goal is to verify the identity of a user before granting access, such as 'A system requires users to provide a password and a one-time code before accessing sensitive data. Which security goal is being enforced?'
Why candidates choose this
Candidates may confuse authentication with non-repudiation because both involve identity, but authentication only verifies identity at a point in time, whereas non-repudiation provides proof of actions that cannot be denied later.
✗AvailabilityWrong answer — click to see why▾
Why this is wrong here
The policy focuses on preventing denial of actions (non-repudiation), not ensuring system uptime or resource accessibility, which is the goal of availability.
★ When this WOULD be the correct answer
A question describing a policy to ensure that a payment processing system remains operational during peak hours, with redundant servers and failover mechanisms, would make availability the correct answer.
Why candidates choose this
Candidates may confuse the audit log's role in recording actions with ensuring the system is available for future access, or think that tamper-evident logs relate to system reliability.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
Key term
Non-repudiation
Non-repudiation is a security principle that ensures a party in a digital transaction cannot deny their involvement or the authenticity of their digital signature.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.