SY0-701 Security Architecture Practice Question
A help desk team needs to reset passwords on servers during incidents, but they should not keep standing administrator rights all day. Which two controls best support this requirement? Select two.
⚠ Common exam trap
Many exam-takers think sharing a single domain admin account is efficient for a team, but CompTIA tests that this violates auditability and the principle of least privilege, making it the opposite of what the scenario requires.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use privileged access management (PAM) to control and audit elevated access.
Privileged Access Management (PAM) solutions enforce just-in-time (JIT) elevation, time-bound access, and session auditing. This allows the help desk team to obtain administrator rights only when needed for incident response, eliminating the need for standing admin rights while maintaining full audit trails.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use privileged access management (PAM) to control and audit elevated access.
Why this is correct
PAM is a security framework that centralizes management of privileged accounts, including secure credential storage, automated password rotation, and session recording. It enforces a controlled workflow where help desk staff check out elevated credentials only for approved tasks, and every action is logged and attributable to an individual. This transforms ad-hoc privileged access into an auditable, approval-based process, directly supporting least privilege and compliance.
- ✓
Grant time-limited or just-in-time elevation only when the task is approved.
Why this is correct
Just-in-time (JIT) elevation provides administrative rights dynamically when a specific task is approved, automatically revoking them after a defined time window. This eliminates the need for standing privileged accounts, which are a prime target for attackers because they provide persistent access. By granting elevation only at the moment of need, the help desk operates with minimal privilege and the blast radius of a compromised session is greatly reduced.
- ✗
Share one permanent domain administrator account with the whole team.
Why it's wrong here
A shared permanent domain administrator account creates a single credential with unlimited authority that is used by multiple people, making it impossible to attribute actions to a specific individual with confidence. Because the password is static and widely known, it also becomes a high-value target for phishing, credential theft, or insider abuse. This violates non-repudiation, accountability, and least privilege, and it is a common root cause of lateral movement in attacks.
- ✗
Use a regular user account and disable all authentication logging.
Why it's wrong here
A regular user account lacks the required privileges to reset server passwords, so the task simply cannot be performed. Disabling authentication logging removes the ability to trace who logged in and when, eliminating forensic evidence and making unauthorized access undetectable. This combination is both ineffective and dangerous, as it forfeits accountability and leaves no trail for incident response or compliance audits.
- ✗
Give every help desk user full access all the time so work is faster.
Why it's wrong here
Giving every help desk user full, permanent access grants far more privilege than is needed for occasional password resets, violating the principle of least privilege. If any one of those accounts is compromised, the attacker instantly gains domain-wide control, creating a massive risk. This approach also produces no audit trail that distinguishes routine work from malicious actions, making it an insecure and unsustainable practice.
Go deeper
Related to this question
Learn chapter
Proxy Servers and Forward/Reverse Proxies
Key term
PAM
Privileged Access Management (PAM) is a security framework that controls, monitors, and audits access to critical systems and accounts with elevated permissions.
Key term
Privileged access
Privileged access is a special level of permission that allows a user or system to perform high-impact actions like installing software, changing system settings, or accessing sensitive data across an IT environment.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A Linux operations team has a standing need to restart services and edit protected configuration files on production servers, but administrators should not keep root privileges all day. Every elevation must be approved through a ticket and logged centrally. Which solution best meets this requirement?
hard- A.Create one shared root password and rotate it weekly
- ✓ B.Use privileged access management with just-in-time elevation and session logging
- C.Assign each administrator the server local administrator role permanently
- D.Use single sign-on so administrators only authenticate once each morning
Why B: Privileged Access Management (PAM) with just-in-time (JIT) elevation and session logging meets the requirement because it grants temporary, request-based root privileges that are automatically revoked after the task, and it centrally logs all commands executed during the elevated session. This ensures every elevation is approved via a ticket and auditable, without administrators retaining permanent root access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.