SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Layered security: Defense in depth

  Why this is correct

  Layered security is correctly implemented through defense in depth, which deliberately deploys multiple overlapping security controls across physical, technical, and administrative layers. If one control is bypassed or fails, another independent control continues to provide protection, creating resilience against a variety of attack vectors. This approach does not rely on any single mechanism, making it far more difficult for an attacker to achieve full compromise.

• ✓

  Minimize risk: Least privilege

  Why this is correct

  Minimizing risk is best achieved by the principle of least privilege, which dictates that users, processes, or systems are granted only the permissions and access rights absolutely necessary to perform their assigned functions. By limiting permissions to the bare minimum, the attack surface is reduced and the potential blast radius of a compromised account or compromised process is contained. This prevents excessive privileges from being used to access or modify resources beyond the intended scope.

• ✓

  Prevent fraud: Separation of duties

  Why this is correct

  Preventing fraud is the primary purpose of separation of duties, a security principle that splits critical, sensitive tasks among multiple individuals so that no single person has end-to-end control over a high-risk process. For example, the person who authorizes a payment should not be the same person who issues the payment, forcing collusion between two or more insiders to commit fraud. This internal control creates a system of checks and balances that deters, prevents, and detects fraudulent activity.

• ✗

  Avoid insecure state: Defense in depth

  Why it's wrong here

  Avoiding an insecure state is achieved by fail secure controls, not defense in depth. Defense in depth is a layered protection strategy that assumes multiple defenses; it does not define how a system behaves when a component fails. A fail secure control ensures that upon a failure, such as a power loss or error, the system transitions to a secure state (e.g., locked doors default to locked) rather than an insecure one. Confusing fail secure with defense in depth misattributes a specific failure-mode guarantee to a general layered-security concept.

• ✗

  Reduce misconfiguration: Least privilege

  Why it's wrong here

  Reducing misconfiguration is the goal of secure defaults, not least privilege. Secure defaults ensure that when a system is initially deployed or configured, its out-of-the-box settings are already hardened, meaning insecure options are disabled by default and secure options are enabled. Least privilege, in contrast, is about restricting the rights and permissions of an authenticated user or process after deployment, not about the initial configuration state. Misconfiguration often stems from overly permissive defaults, which least privilege does not directly address.

• ✗

  Enforce consistently: Separation of duties

  Why it's wrong here

  Enforcing access decisions consistently is achieved by complete mediation, not separation of duties. Complete mediation requires that every access request to every object be verified against the authorization policy each and every time, without caching or relying on prior checks. Separation of duties, on the other hand, is a fraud-prevention control that divides responsibilities among different people. These are fundamentally different mechanisms: complete mediation is a property of access control systems, whereas separation of duties is an organizational and procedural control.

Go deeper

Related to this question