SY0-701 General Security Concepts Practice Question
A web portal for customer refunds checks device health at sign-in, then re-checks the device and user context before each refund over a threshold. A session that started on a managed laptop is blocked when the laptop later fails posture checks, even though the password remains valid. Which principle is best illustrated?
⚠ Common exam trap
Candidates often confuse 'Zero Trust' with 'defense in depth' because both involve multiple security layers, but Zero Trust specifically mandates continuous re-validation of trust for each access request, not just layered static controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Zero trust
The scenario describes a system that continuously verifies trust—checking device health at sign-in and re-evaluating both device and user context before each high-value action—and blocks access even when the password is valid. This is the core of Zero Trust: 'never trust, always verify,' where authentication and authorization are re-assessed at every transaction, not just at session start. The policy enforces access decisions based on real-time posture (e.g., device compliance, user behavior) rather than relying solely on a static credential.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a layered security strategy that combines multiple controls such as firewalls, intrusion prevention, and endpoint protection to create redundancy. However, it does not specifically describe the continuous re-evaluation of device health and session risk that this portal performs. The key differentiator here is the explicit, repeated trust verification before each sensitive action, which is the hallmark of zero trust rather than merely stacking layers.
- ✓
Zero trust
Why this is correct
The portal does not trust the session simply because the user authenticated once. It repeatedly evaluates device posture and context before granting sensitive actions, and it can deny access when risk changes. That is the core of zero trust: verify explicitly, assume no persistent trust, and re-evaluate access continuously instead of relying on an initial login event.
- ✗
Least privilege
Why it's wrong here
Least privilege is an access control model that grants users only the minimum permissions required to perform their job functions. While this principle reduces the blast radius of a compromised account, it does not entail real-time device health monitoring or dynamic session re-authentication. The portal's behavior focuses on verifying the trustworthiness of the device and context at every step, which is unrelated to permission level minimization.
- ✗
Need-to-know
Why it's wrong here
Need-to-know is a data classification principle that restricts access to sensitive information based on whether the user requires it for their specific role or task. It governs what data a user can see, not whether the session or device is currently trustworthy. The portal’s continuous device health validation is a form of dynamic trust assessment, not an information-centric access restriction.
Go deeper
Related to this question
Learn chapter
Authentication Methods
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Zero Trust
Zero Trust is a security framework that assumes no user, device, or network is automatically trusted, requiring verification for every access request regardless of its origin.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.