SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
An internal file server has an administrative web console exposed on the same network as all user laptops. A scan shows that any authenticated employee can reach the console, and several failed login attempts are coming from a workstation that should never manage servers. What is the best hardening action?
⚠ Common exam trap
CompTIA often tests the misconception that password policies (rotation, complexity, or expiration) are sufficient hardening for exposed management interfaces, when in fact network segmentation and access control are the primary mitigations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move the console to a separate management network and restrict access to admin hosts only.
The administrative web console should be isolated on a separate management network (out-of-band management) with strict access control lists (ACLs) allowing only designated admin hosts. This prevents lateral movement from compromised user workstations and eliminates the attack surface exposed to all authenticated employees. Network segmentation is a fundamental defense-in-depth control for managing critical infrastructure, as it enforces the principle of least privilege at the network layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Move the console to a separate management network and restrict access to admin hosts only.
Why this is correct
Administrative interfaces should not be reachable from ordinary user endpoints. Moving the console to a dedicated management network and allowing access only from approved admin systems reduces the attack surface and limits who can even attempt to log in. That is a strong hardening control because it addresses both exposure and misuse. If a workstation should never manage servers, network-level segmentation is the right place to enforce that boundary before authentication is even attempted.
- ✗
Increase the number of shared passwords so administrators can log in faster.
Why it's wrong here
Increasing the number of shared passwords directly undermines non-repudiation and accountability, as multiple administrators would use the same credentials, making it impossible to trace specific actions to a specific user. It also expands the credential attack surface: each shared password becomes a higher-value target that, if compromised, grants broad, anonymous access to the management console. This violates the principles of least privilege and separation of duties, which are fundamental to secure administrative access.
- ✗
Leave the console exposed but shorten the password expiration period.
Why it's wrong here
Shortening the password expiration period does nothing to reduce the network exposure of the administrative web console to unauthorized user endpoints. An attacker on the internal network can still reach the interface and attempt brute-force, credential-stuffing, or exploit unpatched vulnerabilities, regardless of how frequently passwords are rotated. Furthermore, overly frequent rotation often encourages weaker or reused passwords, and it fails to address the root issue: the console should be isolated on a separate management network and restricted to authorized admin hosts.
- ✗
Disable logging so failed attempts do not generate noise.
Why it's wrong here
Disabling logging removes the only visibility needed to detect brute-force attacks, credential-stuffing attempts, or successful intrusions on the administrative console. Security monitoring and incident response rely on audit logs to reconstruct what happened, identify compromised accounts, and contain damage. While failed attempts may generate noise, the proper solution is to tune alerting thresholds, not to eliminate logs entirely; without logs, an attacker can operate undetected and the organization loses forensic evidence critical for recovery and compliance.
Visual reference
Go deeper
Related to this question
Learn chapter
Network-Based Attacks
Key term
Hardening
Hardening is the process of securing a computer system or network by reducing its attack surface, disabling unnecessary services, and applying security configurations.
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A vulnerability scan finds that an administrative SSH service on a Linux server is listening on 0.0.0.0 and is reachable from the internet. The server is meant to be managed only from the internal admin subnet. What is the best remediation?
medium- A.Patch the SSH client on administrator laptops so the server cannot be reached externally.
- ✓ B.Restrict SSH to the management network and block public access with firewall or host-based rules.
- C.Enable a captive portal on the public interface so only authenticated users see the service.
- D.Replace SSH with FTP because FTP can be configured to allow administrative access more easily.
Why B: The vulnerability is that SSH is exposed to the internet on 0.0.0.0, which violates the principle of least privilege and exposes the administrative interface to unauthorized access. The best remediation is to restrict SSH to the internal management subnet using firewall rules (e.g., iptables, security group ACLs) or host-based rules (e.g., tcpwrappers, /etc/hosts.allow), ensuring only trusted internal IPs can reach the service. This directly addresses the exposure without changing the protocol or client configuration.
Variation 2. A vulnerability scan finds an administrative SSH service listening on 0.0.0.0 on a server that should be managed only from the internal network. What is the main security issue?
easy- ✓ A.Exposed management service
- B.Default credentials
- C.Outdated component
- D.Weak permissions
Why A: The SSH service binding to 0.0.0.0 means it is listening on all network interfaces, including external-facing ones. This exposes the administrative management interface to potentially untrusted networks, violating the principle of least privilege and increasing the attack surface. The main security issue is that a service intended for internal management only is accessible from outside the trusted internal network.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.