SY0-701 Security Architecture Practice Question
An HR portal has three job functions: HR staff update employee records, managers approve leave requests, and payroll views salary data. The security team wants to prevent any one role from having all capabilities. Which access design is the best fit?
⚠ Common exam trap
Many candidates confuse 'role-based access control' with 'discretionary access control' (DAC) or think that audit logs alone are sufficient for security, but the SY0-701 exam emphasizes that preventive controls (like RBAC) are superior to detective controls (like logging) for enforcing separation of duties.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create role-based access groups aligned to each job function and grant only the permissions needed for that role.
Role-based access control (RBAC) is the correct design because it enforces the principle of least privilege by granting each job function only the permissions necessary for its tasks. This prevents any single role from accumulating all capabilities (e.g., HR staff cannot approve leave or view salary data), directly addressing the security team's requirement to separate duties. RBAC aligns with NIST SP 800-53 AC-6 and is a standard access control model for multi-role enterprise applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a single superuser account for the entire department so tasks can be completed quickly.
Why it's wrong here
A shared superuser account violates the principle of least privilege and eliminates individual accountability, since every departmental action traces back to one generic identity. It also undermines separation of duties by giving any single user the ability to perform critical, conflicting HR functions such as modifying employee records and approving changes. Consequently, a credential compromise or insider misuse would be difficult to attribute, and the entire portal's confidentiality and integrity would be at risk.
- ✓
Create role-based access groups aligned to each job function and grant only the permissions needed for that role.
Why this is correct
Role-based access control is the right design because it maps permissions to job responsibilities. HR, managers, and payroll each receive only the access they need, which supports separation of duties and makes access reviews easier. It also reduces the chance that one user or one account can perform every sensitive action in the portal.
- ✗
Give every employee access to all portal features and depend on audit logs to catch mistakes later.
Why it's wrong here
Granting all portal features to every employee converts authorization into an afterthought and relies on audit logs purely as a detective control, which cannot prevent unauthorized actions in real time. This approach expands the attack surface and invites accidental or deliberate data corruption, because users have no need-to-know access to sensitive salary or personnel records. Since audit logs only record activity after the fact, they are not an adequate substitute for enforcing least privilege at the access control layer.
- ✗
Require the payroll team to share one common password and use it only from the office network.
Why it's wrong here
Requiring payroll users to share one password removes non-repudiation, because any action taken under that credential cannot be traced to a specific individual, making forensic investigations and access reviews effectively meaningless. Network location alone is a weak, static condition that does not reflect job responsibilities or enforce fine-grained permissions, so a payroll user could still access unrelated HR functions from the office. This shared-credential practice also increases the risk of credential theft and provides no defense-in-depth for protecting sensitive payroll data.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Cloud Security Fundamentals
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An HR portal has three groups: HR staff can edit employee records, managers can approve leave, and payroll can view salary data. No one should have all functions. Which access model should the engineer implement?
medium- ✓ A.Role-based access control with separate groups mapped to each business function.
- B.A single shared admin account so all tasks can be completed quickly.
- C.Mandatory access control with all users assigned the same clearance level.
- D.Local account creation on the portal for each user, with permissions assigned manually one by one.
Why A: Role-Based Access Control (RBAC) allows the engineer to define three distinct roles (HR staff, managers, payroll) with granular permissions mapped to specific business functions, ensuring no single user inherits all privileges. This model enforces the principle of least privilege by separating duties across groups, preventing any user from having full access to the portal's sensitive operations.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.