SY0-701 General Security Concepts Practice Question
Exhibit
07:55:12 Account=FIN-ADMIN Action=ApproveInvoice Host=JUMP-02 IP=10.30.8.21 07:56:03 Account=FIN-ADMIN Action=ChangeVendorBank Host=JUMP-02 IP=10.30.8.21 07:57:44 Account=FIN-ADMIN Action=ExportReport Host=JUMP-02 IP=10.30.8.21 Note: FIN-ADMIN is used by three finance managers during after-hours support.
Based on the exhibit, which change best improves accountability while still allowing emergency access?
A finance team uses the following shared account on a jump host:
07:55:12 Account=FIN-ADMIN Action=ApproveInvoice Host=JUMP-02 IP=10.30.8.21 07:56:03 Account=FIN-ADMIN Action=ChangeVendorBank Host=JUMP-02 IP=10.30.8.21 07:57:44 Account=FIN-ADMIN Action=ExportReport Host=JUMP-02 IP=10.30.8.21
Note: FIN-ADMIN is used by three finance managers during after-hours support.
⚠ Common exam trap
It's easy for candidates to choose password rotation (Option A) thinking it improves security, but it fails to address the core issue of non-repudiation and accountability required for audit trails.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Replace the shared account with named user accounts, role-based access, and a separate break-glass account for rare emergencies.
Replacing the shared account with named user accounts ensures individual accountability through unique credentials and audit trails, while a separate break-glass account provides emergency access without compromising security. This aligns with the principle of least privilege and non-repudiation, as each finance manager's actions are logged under their own identity, and the break-glass account can be tightly controlled and monitored for rare use.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require the shared account password to be changed every 24 hours.
Why it's wrong here
Rotating a shared password every 24 hours does nothing to identify which person executed a command or accessed data during that time window. All sessions still authenticate with the same shared credential, so audit logs attribute every action to a generic account rather than a specific human. Frequent forced changes also create operational friction that can lead to users storing the current password in insecure places, while providing no real mechanism for non-repudiation.
- ✓
Replace the shared account with named user accounts, role-based access, and a separate break-glass account for rare emergencies.
Why this is correct
Replacing the shared account with named user accounts establishes a one-to-one binding between a human and a security principal, so access logs and system audit trails can be directly attributed to an individual for reviews or investigations. Role-based access control then enforces least privilege by granting only the permissions needed for each person's job function, while a break-glass account, protected by MFA, vaulting, and automatic alerting, retains emergency availability without sacrificing attribution. This combination directly satisfies the NIST accountability principle: knowing who did what, when, and why.
- ✗
Enable automatic account lockout after five failed logons.
Why it's wrong here
Account lockout after five failed logons is purely a brute-force and credential-guessing mitigation; it stops a process, not a person, and has no ability to trace successful actions back to a specific user when everyone shares the same account. After an attacker or an exhausted user triggers the lockout, legitimate staff are blocked from a resource that still lacks per-person attribution, and the lockout itself can be used as a denial-of-service vector. This control would be valuable alongside unique accounts but cannot substitute for them when the core requirement is individual accountability.
- ✗
Restrict the jump host by MAC address and subnet only.
Why it's wrong here
Restricting the jump host by MAC address and subnet limits which network interfaces can initiate a connection, yet MAC addresses are easily spoofed and subnets identify locations, not people; neither control authenticates a human identity. Even if only authorized devices reach the host, every user still logs in with the same shared account, so the jump host's session history and command logs remain tied to a single ambiguous principal. Without unique identifiers and per-user credentials, these perimeter filters do not provide the granular accounting needed to hold individuals responsible for their actions.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Shared account
A shared account is a user account that is used by multiple people instead of being assigned to a single individual.
Key term
Non-repudiation
Non-repudiation is a security principle that ensures a party in a digital transaction cannot deny their involvement or the authenticity of their digital signature.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, what is the best change to improve accountability without removing emergency access?
hard- A.Keep the shared account and add more logging of the shared password.
- ✓ B.Require named accounts with role-based elevation through a privileged access workflow.
- C.Remove all command logging to protect administrator privacy.
- D.Use a single shared account with a longer password and monthly rotation.
Why B: Implementing named accounts with role-based elevation through a privileged access workflow (PAW) ensures each administrator has a unique identity for auditing, while still allowing temporary privilege escalation for emergency tasks. This directly improves accountability by tying actions to specific users, unlike shared accounts which obscure individual responsibility. The workflow maintains emergency access by granting time-limited elevated permissions through an approval process, avoiding permanent standing privileges.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.