SY0-701 General Security Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use one shared contractor account and rotate the password when people leave.

  Why it's wrong here

  Using one shared contractor account with periodic password rotation does not address individual accountability or identity lifecycle. Because every contractor authenticates as the same account, it is impossible to attribute commands, file modifications, or resource access to a specific person, undermining auditing and non-repudiation. Password rotation only invalidates tokens after the fact and does not remove the need for unique, time-boxed accounts; additionally, anyone who knew the previous password may still have other established credentials (e.g., cached or remembered browser sessions). This violates least privilege and separation of duties.

• ✓

  Configure an account expiration date and automatic deprovisioning tied to the approved role.

  Why this is correct

  Correct. Time-bound accounts with automatic deprovisioning are designed for contractors and other temporary users. They enforce least privilege over time, remove access when the engagement ends, and force a new approval process for any future engagement. This reduces the risk of forgotten accounts and prevents accidental restoration of access without review.

• ✗

  Disable the account after the contract ends but keep all group memberships unchanged.

  Why it's wrong here

  Disabling a contractor's account at the end of the engagement while leaving all group memberships intact does not actually remove the underlying permissions. If that account is later re-enabled—whether accidentally, through password reset, or by a service account—it instantly regains every resource access it had before, with no new review or approval. The account object remains a dormant identity with high entitlements, creating a dangerous attack surface for privilege escalation and a classic "orphaned account" scenario. Proper deprovisioning requires deleting or removing the account from all groups, and preferably applying an expiration date to enforce automatic cleanup.

• ✗

  Create a local workstation account so the contractor does not need centralized identity services.

  Why it's wrong here

  Creating a local workstation account for a contractor avoids centralized directory services and leaves the organization with no single point of control for the account's lifecycle. Local accounts are stored independently on each computer, so password policies, multifactor authentication, and account expiration settings cannot be centrally enforced or audited. If the contractor needs access to multiple systems, you must manage separate local accounts per machine, multiplying administrative overhead and security gaps. This also makes it impossible to automatically tie termination or contract end dates to access revocation, directly impairing compliance with audit and data protection requirements.

Go deeper

Related to this question