SY0-701 General Security Concepts Practice Question
Exhibit
Firewall rule change #4219: - Requested by: NetworkOps1 - Approved by: NetworkOps1 - Implemented by: NetworkOps1 - Audit note: the same person can create, approve, and deploy production firewall changes. Proposed redesign: - Engineer drafts the change. - Security reviewer approves it. - A different administrator implements it during a maintenance window. - The change ticket is visible only to the people assigned to the task.
Based on the exhibit, which security principle is the proposed workflow most directly enforcing?
⚠ Common exam trap
Watch out — candidates often confuse separation of duties with least privilege because both involve limiting actions, but separation of duties specifically divides a process across multiple people, whereas least privilege limits the scope of permissions per person.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Separation of duties, because no single person can create, approve, and implement the same production change.
The proposed workflow enforces separation of duties by requiring three distinct roles—requester, approver, and implementer—to complete a single firewall change. No single person can both create and approve the change, nor can they implement it without prior approval. This directly prevents any one individual from having end-to-end control over a production change, which is the core of separation of duties.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Least privilege, because each person gets only the minimum access needed for the task.
Why it's wrong here
Least privilege is part of the redesign, but it is not the primary principle being enforced by the workflow separation. The audit finding is about one person being able to create, approve, and deploy the same change. The proposed fix is designed mainly to ensure no single person controls the entire process from start to finish.
- ✗
Defense in depth, because multiple layers of security are added around firewall changes.
Why it's wrong here
Defense in depth would involve layered technical and administrative controls, such as logging, approvals, and segmentation. While those may exist in the background, the exhibit focuses on dividing duties among different people. The core issue is not the number of layers, but who is allowed to perform each stage of the change process.
- ✓
Separation of duties, because no single person can create, approve, and implement the same production change.
Why this is correct
This is the correct principle because the redesign intentionally splits the workflow among different roles. One person drafts the change, another approves it, and a third implements it. That reduces fraud and mistakes by preventing one individual from controlling every step. The limited ticket visibility also supports the same idea, but the central security principle is separation of duties.
- ✗
Need-to-know, because the ticket is visible only to assigned people.
Why it's wrong here
Need-to-know is reflected in the limited ticket visibility, but it is not the main issue highlighted by the audit note. The problem is that one person can request, approve, and deploy the change. The redesign primarily prevents one individual from having excessive control over a sensitive process, which is separation of duties.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.