Question 1,140 of 1,013
SY0-701 General Security Concepts Practice Question
Exhibit
Jump host session log: ``` 10:02 sharedadmin login successful from 10.20.1.45 10:03 sudo /opt/deploy/apply_patch.sh 10:11 sudo systemctl restart appsvc 10:12 logout ``` Audit note: - Three administrators used the same shared account this week. - Logs do not identify which person executed which command. - Management still wants a break-glass option for after-hours maintenance.
Based on the exhibit, what is the best change to improve accountability without removing emergency access?
⚠ Common exam trap
A common mix-up: candidates think improving logging (Option A) or password rotation (Option D) is sufficient for accountability, but CompTIA emphasizes that shared accounts inherently lack individual attribution, regardless of how much logging or rotation is applied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require named accounts with role-based elevation through a privileged access workflow.
Implementing named accounts with role-based elevation through a privileged access workflow (PAW) ensures each administrator has a unique identity for auditing, while still allowing temporary privilege escalation for emergency tasks. This directly improves accountability by tying actions to specific users, unlike shared accounts which obscure individual responsibility. The workflow maintains emergency access by granting time-limited elevated permissions through an approval process, avoiding permanent standing privileges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Keep the shared account and add more logging of the shared password.
Why it's wrong here
Adding more logging of the shared password does not solve the attribution problem; logging the password value or its use actually increases credential exposure in log files, creating a new attack vector for credential theft. Even if every authentication event is logged, all administrators authenticate with the same identity, so the logs cannot distinguish which human performed a given command. This approach also violates least privilege and fails to support non-repudiation, making it an ineffective and risk-increasing change.
- ✓
Require named accounts with role-based elevation through a privileged access workflow.
Why this is correct
This is the best answer because the issue is accountability. Shared accounts prevent the organization from knowing which person performed the actions in the log. Named accounts plus privileged elevation preserve break-glass access while ensuring each command is tied to an individual identity. That improves accounting and auditability without removing the operational ability to maintain the system.
- ✗
Remove all command logging to protect administrator privacy.
Why it's wrong here
Removing all command logging eliminates the audit trail needed to detect unauthorized changes, troubleshoot incidents, and satisfy compliance or forensic requirements. Without logs, the organization cannot reconstruct what occurred during a security breach or prove that administrators followed procedures, which is a direct violation of the accountability principle central to the Security+ objectives. Administrator privacy should be protected through role-based access controls and restricted log access, not by destroying evidence that is essential for incident response and continuous monitoring.
- ✗
Use a single shared account with a longer password and monthly rotation.
Why it's wrong here
Strengthening the shared password and rotating it monthly does not address the fundamental flaw of shared accounts: multiple individuals still operate under a single identity, so the logs remain incapable of tying actions to a specific person. A longer or frequently rotated password may reduce the risk of external credential compromise, but it offers no improvement in accountability or auditability for internal administrative actions. The core issue is attribution, not password strength, so this change leaves the organization blind to which administrator performed a given privileged action.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.