SY0-701 General Security Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Grant the technician full control of the entire file server for one day.

  Why it's wrong here

  Granting full control of the entire file server expands the technician's access to all shares and files, including rights to modify, delete, change permissions, or take ownership. Even a one-day grant exposes far more data than the ticket requires and creates a dangerous window for accidental or malicious changes. Least privilege dictates that access be narrowly scoped to the exact resource and action needed, not a global administrative role.

• ✓

  Give the technician read-only access to the single shared folder needed for the ticket.

  Why this is correct

  Providing read-only access to the specific shared folder needed for the ticket embodies least privilege by restricting both the access level and the scope. With read-only, the technician can view and inspect files to diagnose the issue but cannot alter, delete, or affect any other data. This also supports auditing, as the technician's actions are limited to one resource and can be traced if necessary. After the ticket is resolved, the access can be quickly revoked, leaving no unnecessary residual permissions.

• ✗

  Add the technician to the domain admins group until the issue is resolved.

  Why it's wrong here

  Adding the technician to the Domain Admins group grants near-total control over the Active Directory domain, including all users, computers, and domain controllers, and exposes high-value targets like the password database and DSNS records. This entirely exceeds the need to read a single shared folder, and even short-lived membership in a Tier 0 group is extremely risky because it can be used to create backdoors or change policies. Least privilege prohibits granting such broad, privilege-sensitive access when a scoped, read-only permission is sufficient.

• ✗

  Allow the technician to use any account in the department for convenience.

  Why it's wrong here

  Allowing the technician to use any department account removes accountability because actions cannot be attributed to a specific individual, and it disables the ability to audit who accessed the shared folder. Casual account selection may also grant more permissions than intended, as some departmental accounts might have broader access than necessary. Least privilege requires that access be individually authorized, restricted, and traceable to the requesting user, never through shared or arbitrary accounts.

Go deeper

Related to this question