SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use the root account so the job never fails.

  Why it's wrong here

  Using the root account for a nightly maintenance job is a clear violation of least privilege: root has unrestricted access to the entire operating system, so any flaw in the script, an accidental overwrite, or a compromised dependency could destroy system files, alter kernel settings, or grant attackers complete control. Audit logs become less meaningful because every action is attributed to root, and the script would require root-level credentials to be stored or exposed. A non-root service account with sudo rules limited to restarting the specific service and writing to the designated log archive directory achieves the same goal with a much smaller blast radius.

• ✓

  Create a dedicated service account with only the delegated rights needed, and run the script as a scheduled job.

  Why this is correct

  A dedicated noninteractive account supports automation while keeping permissions tightly scoped to the task. The account can be granted only the ability to restart the specific service and write the required log archive location, rather than full administrator access. Scheduling the job also makes the activity repeatable and auditable. This approach supports least privilege, reduces human error, and avoids interactive logons on every server.

• ✗

  Store an administrator's SSH key inside the script.

  Why it's wrong here

  Storing an administrator's SSH private key inside the script is a dangerous practice because the key is a high-value, persistent secret that grants broad access, likely with administrative privileges. Any user with read access to the script, a backup copy, or a version control repository could extract the key and impersonate the administrator; the key cannot be easily rotated without breaking every script that references it. It also bypasses central credential management, auditing, and policies like MFA, leaving the organization vulnerable to silent lateral movement if the script is ever exposed.

• ✗

  Have an operator log in and run the commands manually each night.

  Why it's wrong here

  Having an operator manually log in each night is unreliable and poorly suited for security operations: it depends on a human being available and remembering to execute the commands, leading to missed runs, inconsistent timing, and no centralized audit record. Human interaction also risks ad-hoc changes, such as running different commands or skipping steps, creating configuration drift that is hard to detect. In contrast, a scheduled job runs deterministically, generates logs automatically, and can be integrated with alerting so that any failure is immediately visible, making manual execution a fragile anti-pattern for repeatable tasks.