SY0-701 General Security Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable every management service so support can connect easily.

  Why it's wrong here

  Enabling every management service needlessly expands the attack surface and violates the secure-default principle of disable-what-you-don't-need. Services like Telnet, RDP, SSH, or SNMP each provide a potential entry point for attackers, especially if left with default misconfigurations or weak credentials. Even when remote administration is required, it should be limited to a single secured channel (e.g., SSH or VPN-gated RDP) rather than exposing every service simultaneously.

• ✗

  Use the domain admin account to run the database service.

  Why it's wrong here

  Running the database service under a domain admin account massively exceeds least-privilege requirements; a compromise of the database process would hand an attacker full domain controller access and allow lateral movement across the entire organization. Domain admin credentials are also subject to special protections (e.g., Group Policy restrictions), and using them for a service makes them impossible to rotate without interrupting the database. A dedicated, low-privilege service account should be created with only the local rights needed to run the database engine.

• ✓

  Disable unused services and run the database under a dedicated least-privilege service account.

  Why this is correct

  Correct. Removing unnecessary services reduces the attack surface, and a dedicated service account limits the damage if the database process is compromised. This is a direct application of least privilege and secure defaults. It also supports cleaner auditing because the service activity is separated from administrator activity and unrelated functions are not exposed.

• ✗

  Share the same account with backup software to simplify troubleshooting.

  Why it's wrong here

  Sharing the same account across the database service and backup software couples their permissions and eliminates separation of duties; it becomes impossible to attribute a malicious or erroneous action to a specific application in audit logs. The backup software often requires additional privileges (like reading database files or volume snapshot access) that the database service does not need, so the shared account ends up over-privileged for one or both workloads, and a compromise of either puts both at risk. Separate accounts allow independent compromise and precise troubleshooting without violating least privilege.