SY0-701 General Security Concepts Practice Question
Exhibit
Security event summary - Malicious attachment passed the email filter - Macro execution was blocked by application control - Process launch was contained by EDR - Stolen password alone could not reach the admin portal because MFA was required - Offline backups were used for recovery testing after the incident
Based on the exhibit, which security principle does the organization appear to be using most clearly?
⚠ Common exam trap
It's easy for candidates to confuse defense in depth with zero trust because both involve multiple controls, but zero trust specifically requires explicit verification for every access request, whereas defense in depth focuses on layered, independent safeguards without necessarily re-verifying identity at each layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Defense in depth, because several different controls stop or limit the attack at different stages.
The exhibit shows multiple security controls—an email filter blocking the attachment, a web filter blocking the download link, and an endpoint detection and response (EDR) tool blocking execution—each acting at a different stage of the attack chain. This layered approach, where no single control is relied upon to stop the threat, is the hallmark of defense in depth. The correct answer is B because the scenario clearly demonstrates overlapping controls that provide redundancy and mitigate risk at various points.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Zero trust, because all access is denied until a user proves identity again.
Why it's wrong here
Zero trust could be part of the design, but the exhibit emphasizes multiple independent safeguards working together. The controls are not only about continuous verification; they also stop threats at different stages, which is broader than a single trust model.
- ✓
Defense in depth, because several different controls stop or limit the attack at different stages.
Why this is correct
Defense in depth is demonstrated by multiple layers: email filtering, application control, EDR containment, MFA, and backup recovery. The attack is not stopped by one control alone. Instead, each layer provides a separate barrier or recovery path, reducing the chance that a single failure becomes a full compromise.
- ✗
Least privilege, because the attachment was blocked from having administrator rights.
Why it's wrong here
Least privilege concerns giving users and processes only the rights they need. While that idea may help some controls in the exhibit, it does not fully explain the layered approach shown. The dominant theme is that several defenses worked together across the attack path.
- ✗
Need-to-know, because only the security team should be aware of the incident.
Why it's wrong here
Need-to-know is about limiting information access, not about layering security tools. The exhibit describes technical safeguards that intervene at different points in the attack chain. The issue is resilience through multiple controls, not restricted awareness of the event.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Endpoint detection and response
Endpoint detection and response (EDR) is a cybersecurity solution that continuously monitors endpoint devices for suspicious activity and automatically responds to threats to stop attacks in real time.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.