SY0-701 General Security Concepts Practice Question
After imaging laptops, the security team wants to ensure screen-lock timeouts, local admin restrictions, and USB storage controls remain consistent on every device even after users make changes. What is the best approach?
⚠ Common exam trap
Many exam-takers confuse security controls like antivirus or encryption with configuration management, thinking they can prevent or revert policy changes, when in fact only a dedicated configuration management and compliance solution can enforce and remediate baseline settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enforce a hardened baseline with configuration management and compliance checks.
Configuration management tools (e.g., Microsoft Intune, Group Policy, or Ansible) can enforce a hardened baseline by applying settings like screen-lock timeouts, local admin restrictions, and USB storage controls. These tools also perform compliance checks to detect and remediate any drift caused by user changes, ensuring consistency across all devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rely on users to follow the build sheet during setup and avoid future changes.
Why it's wrong here
This approach treats security configuration as a one-time manual task rather than an ongoing control. Users are not security mechanisms; even with a build sheet, there is no enforcement or detection if a setting changes. Over time, users may alter display settings, power settings, or install software that changes policy, and without automated monitoring the organization has no visibility. This fails because secure configuration must be continuously validated and remediated, not assumed from initial setup.
- ✓
Enforce a hardened baseline with configuration management and compliance checks.
Why this is correct
Correct. A hardened baseline defines the approved secure settings, and configuration management helps enforce those settings consistently across all laptops. Compliance checks detect drift after deployment, which is important when users or software might change security-related options. This approach directly supports secure configuration and repeatability at scale.
- ✗
Increase antivirus scan frequency so policy settings do not change.
Why it's wrong here
Antivirus software is a reactive detection tool that scans files and memory for malicious patterns; it does not inspect or protect registry keys, Group Policy objects, or user preference sets that define screen lock behavior. Increasing scan frequency cannot prevent a user or application from changing the policy, nor does it detect that drift has occurred. In fact, the antivirus itself can be disabled or misconfigured. It is not a configuration management or compliance mechanism.
- ✗
Apply full disk encryption only, since it covers all endpoint hardening needs.
Why it's wrong here
Full disk encryption (e.g., BitLocker) is a data-at-rest control that encrypts the entire volume to prevent unauthorized access to files if the device is physically stolen. It operates at the storage layer and has no awareness of operating system policy settings such as screen lock inactivity timeouts, so it cannot enforce or monitor them. Endpoint hardening also covers user rights, peripheral devices, and application controls, which are outside the scope of encryption. Relying on encryption alone leaves these controls unverified and unsupported.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Group Policy
Group Policy is a Windows-based feature that allows administrators to centrally manage and enforce settings for users and computers across an organization.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.