SY0-701 Security Operations Practice Question
Help desk staff must restart one Windows service and read its event logs on 150 servers, but they should not have local administrator rights or interactive logon to the systems. Which approach best supports this requirement?
⚠ Common exam trap
Test-takers frequently assume that adding users to the local Administrators group or using a shared admin account is the simplest way to delegate tasks, overlooking that JEA provides a secure, auditable, and least-privilege alternative that specifically prevents interactive logon and limits command scope.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Just Enough Administration constrained endpoint for the allowed tasks.
Just Enough Administration (JEA) allows you to create constrained PowerShell endpoints that delegate specific administrative tasks—such as restarting a service and reading event logs—without granting full local administrator rights or interactive logon. By defining role capabilities that limit cmdlets and parameters, help desk staff can perform only the required operations on all 150 servers via a constrained endpoint, meeting the security requirement precisely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create one shared local administrator account for the entire help desk team.
Why it's wrong here
A shared local administrator account creates a single set of credentials that is reused by every help desk technician, eliminating individual attribution in security logs and making it impossible to determine who restarted the service or read the logs. Because the account has local admin rights on every server, it also violates least privilege and becomes a high-value target for credential theft and lateral movement. Storing or transmitting the password securely becomes impractical, and any compromise of that one credential compromises the entire fleet.
- ✗
Add the staff to the local Administrators group on every server.
Why it's wrong here
Adding help desk staff to the local Administrators group on every server grants them unrestricted control over the operating system — including installing drivers, changing security policy, and accessing all local files — far beyond the single service restart and log read required. This expands the attack surface and exposure of the enterprise, since any compromised technician workstation can then be used to perform fully privileged actions on any server. It also creates a massive management burden to maintain consistent group memberships and to audit or revoke access when roles change.
- ✓
Use a Just Enough Administration constrained endpoint for the allowed tasks.
Why this is correct
JEA (Just Enough Administration) is the correct technique because it lets you register a constrained PowerShell endpoint that exposes only the exact cmdlets needed — for example, Restart-Service filtered to the specific service name and Get-Content/Get-WinEvent for its log files. Users connect to the JEA endpoint and execute the permitted commands under a virtual account with just enough privilege, while full console or admin access is never granted. JEA also automatically records session transcripts, preserving an auditable trail that ties each action back to the individual technician.
- ✗
Run the maintenance job under each technician's personal account on a schedule.
Why it's wrong here
Scheduling a maintenance job under each technician's personal account embeds their password or stores a saved credential in the task, creating a long-lasting secret that can be stolen and that breaks as soon as the technician's password changes or the account is disabled. It also does not scale cleanly: every technician would need a separate scheduled task with the same effect, and the task runs in an unattended context with the technician's real privileges, muddying the audit trail and potentially giving the script broader permissions than the help desk procedure calls for. A password change or account deactivation would silently render the task inoperative, making this approach both insecure and operationally fragile.
Go deeper
Related to this question
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.