SY0-701 Security Architecture Practice Question
A Linux operations team has a standing need to restart services and edit protected configuration files on production servers, but administrators should not keep root privileges all day. Every elevation must be approved through a ticket and logged centrally. Which solution best meets this requirement?
⚠ Common exam trap
Many exam-takers confuse 'single sign-on' (SSO) with 'privilege elevation control,' assuming SSO's convenience implies security control, when in fact SSO only handles authentication, not authorization or session auditing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use privileged access management with just-in-time elevation and session logging
Privileged Access Management (PAM) with just-in-time (JIT) elevation and session logging meets the requirement because it grants temporary, request-based root privileges that are automatically revoked after the task, and it centrally logs all commands executed during the elevated session. This ensures every elevation is approved via a ticket and auditable, without administrators retaining permanent root access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create one shared root password and rotate it weekly
Why it's wrong here
A single shared root password, even when rotated weekly, creates a superuser account with standing privileges accessible to anyone who knows the password. There is no way to attribute specific actions to an individual, the password is often shared via insecure channels, and root access bypasses all normal auditing and logging controls. Rotation does not eliminate the standing privilege or the lack of accountability—it only tries to reduce the window of exposure, which is insufficient for compliance and least-privilege requirements.
- ✓
Use privileged access management with just-in-time elevation and session logging
Why this is correct
PAM with just-in-time elevation is the best match because it grants administrative rights only when needed and only after approval. Central session logging provides accountability, and the regular user account remains the default for normal work. This reduces standing privilege, limits misuse, and gives auditors a clear record of who elevated, when, and why.
- ✗
Assign each administrator the server local administrator role permanently
Why it's wrong here
Permanently assigning the local administrator role to each administrator grants persistent, standing privileges on every server, meaning elevated access is always available without any approval or business justification for each action. This violates the principle of least privilege and dramatically increases the blast radius if an administrator's account is compromised, as the adversary inherits administrative control over all systems. It also makes session auditing difficult because normal work and administrative activities are blended together, whereas a PAM solution would require per-session elevation and provide clear separation of duties.
- ✗
Use single sign-on so administrators only authenticate once each morning
Why it's wrong here
Single sign-on only addresses the frequency of authentication, not the authorization to perform privileged actions; it does not remove standing admin rights or enforce an approval workflow before sensitive operations. Even if administrators authenticate only once in the morning, their SSO token grants access to applications and systems based on their assigned roles, which in this scenario would still include permanent administrative privileges. Furthermore, SSO typically does not provide session-level logging of what an administrator actually did after elevation, so it fails to meet the accountability and audit requirements that privileged access management would satisfy.
Go deeper
Related to this question
Learn chapter
Proxy Servers and Forward/Reverse Proxies
Key term
Privileged access
Privileged access is a special level of permission that allows a user or system to perform high-impact actions like installing software, changing system settings, or accessing sensitive data across an IT environment.
Key term
PAM
Privileged Access Management (PAM) is a security framework that controls, monitors, and audits access to critical systems and accounts with elevated permissions.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A help desk team needs to reset passwords on servers during incidents, but they should not keep standing administrator rights all day. Which two controls best support this requirement? Select two.
easy- ✓ A.Use privileged access management (PAM) to control and audit elevated access.
- ✓ B.Grant time-limited or just-in-time elevation only when the task is approved.
- C.Share one permanent domain administrator account with the whole team.
- D.Use a regular user account and disable all authentication logging.
- E.Give every help desk user full access all the time so work is faster.
Why A: Privileged Access Management (PAM) solutions enforce just-in-time (JIT) elevation, time-bound access, and session auditing. This allows the help desk team to obtain administrator rights only when needed for incident response, eliminating the need for standing admin rights while maintaining full audit trails.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.