SY0-701 General Security Concepts Practice Question
During an incident, a server administrator needs elevated access to production logs for exactly two hours after manager approval. The organization does not want standing privileged accounts. Which solution is the best fit?
⚠ Common exam trap
Candidates often confuse network-level access (VPN) with privileged access management, or assume a shared account with password rotation is sufficient, overlooking the need for time-bound, auditable, and non-repudiable elevation without standing privileges.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use just-in-time privileged access through a privileged access management workflow.
Just-in-time (JIT) privileged access through a Privileged Access Management (PAM) workflow is the best fit because it grants the administrator elevated permissions for exactly two hours, then automatically revokes them. This aligns with the requirement for time-limited access without maintaining standing privileged accounts, reducing the attack surface and ensuring compliance with the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add the administrator to a permanent domain admin group so access is always available.
Why it's wrong here
Domain Admins is a highly privileged group with full control over all domain controllers and directory services; adding someone permanently expands the attack surface and violates least privilege. Even if access is needed only during the incident, the account retains elevated rights indefinitely, increasing the risk of credential theft and lateral movement. Temporary elevation should be time-bound, scoped, and automatically revoked.
- ✓
Use just-in-time privileged access through a privileged access management workflow.
Why this is correct
Just-in-time access is ideal when elevation should be temporary, approved, and tightly controlled. A privileged access management workflow can grant the needed permissions for a limited window, automatically revoke them when time expires, and preserve logs for accountability. This reduces the attack surface compared with always-on admin rights while still letting the team respond quickly during an incident.
- ✗
Create a shared administrator account for the incident team and change the password afterward.
Why it's wrong here
A shared administrator account creates a common credential that masks individual identity, so audit logs cannot distinguish which team member performed a specific action on production systems. Changing the password afterward does not retroactively attribute any prior actions, and the shared secret might have been compromised or replicated during the incident, leaving a lingering persistence risk. Incident response requires unique, explicitly approved elevation tied to the requesting administrator to preserve accountability.
- ✗
Grant access by sending the administrator a VPN profile with broader network reach.
Why it's wrong here
A VPN profile only establishes network-layer connectivity, broadening the administrator's reach into the corporate network without granting any elevated permissions on the target systems or log repositories. Broader network access can actually increase exposure by making sensitive services accessible from the administrator's endpoint, without requiring authorization for each privilege escalation or generating the needed audit trail. This approach fails to deliver time-limited, approved elevation, and may bypass security controls that are already in place.
Go deeper
Related to this question
Learn chapter
Access Control Models (DAC, MAC, RBAC)
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.