SY0-701 General Security Concepts Practice Question
This SY0-701 practice question tests your understanding of general security concepts. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Remote Access Security Requirement
Must have all of the following:
- Phishing-resistant second factor
- Works without relying on SMS or email delivery
- Suitable for privileged administrator logons
Available methods under review:
1. SMS one-time code
2. Email one-time link
3. Authenticator app TOTP code
4. FIDO2 hardware security key
Based on the exhibit, which authentication method best meets the stated remote-admin requirement?
Exhibit
Remote Access Security Requirement
Must have all of the following:
- Phishing-resistant second factor
- Works without relying on SMS or email delivery
- Suitable for privileged administrator logons
Available methods under review:
1. SMS one-time code
2. Email one-time link
3. Authenticator app TOTP code
4. FIDO2 hardware security key
A
SMS one-time code, because it is widely supported and easy for users to adopt.
Why wrong: SMS is convenient, but it is not phishing-resistant and can be intercepted through SIM-swap or message-forwarding attacks.
B
Email one-time link, because it can be delivered to any mailbox quickly.
Why wrong: Email-based approval depends on mailbox access and is not a strong choice for privileged access protection against phishing.
C
Authenticator app TOTP code, because it adds a second factor without special hardware.
Why wrong: TOTP improves security, but it is still more vulnerable to real-time phishing and proxy attacks than a phishing-resistant hardware key.
D
FIDO2 hardware security key, because it resists phishing and does not depend on SMS or email delivery.
The requirement explicitly calls for a phishing-resistant factor that does not depend on text messages or email. A FIDO2 hardware security key meets that need and is well suited for privileged administrator authentication because it strongly binds the login to the legitimate site.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FIDO2 hardware security key, because it resists phishing and does not depend on SMS or email delivery.
The remote-admin requirement emphasizes phishing resistance and independence from SMS or email delivery, which are vulnerable to interception or social engineering. FIDO2 hardware security keys use public-key cryptography and origin-bound credentials, making them phishing-resistant and eliminating reliance on potentially compromised communication channels. This aligns with the stated requirement better than the other options.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
SMS one-time code, because it is widely supported and easy for users to adopt.
Why it's wrong here
SMS is convenient, but it is not phishing-resistant and can be intercepted through SIM-swap or message-forwarding attacks.
✗
Email one-time link, because it can be delivered to any mailbox quickly.
Why it's wrong here
Email-based approval depends on mailbox access and is not a strong choice for privileged access protection against phishing.
✗
Authenticator app TOTP code, because it adds a second factor without special hardware.
Why it's wrong here
TOTP improves security, but it is still more vulnerable to real-time phishing and proxy attacks than a phishing-resistant hardware key.
✓
FIDO2 hardware security key, because it resists phishing and does not depend on SMS or email delivery.
Why this is correct
The requirement explicitly calls for a phishing-resistant factor that does not depend on text messages or email. A FIDO2 hardware security key meets that need and is well suited for privileged administrator authentication because it strongly binds the login to the legitimate site.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often choose TOTP (Option C) because it is a common second factor, but they overlook that the question specifically requires phishing resistance, which TOTP does not provide against modern adversary-in-the-middle attacks, whereas FIDO2 does.
Detailed technical explanation
How to think about this question
FIDO2 hardware security keys implement the WebAuthn and CTAP2 protocols, where the private key never leaves the device and each authentication is bound to the specific origin (domain) via the 'rpId' parameter. This prevents phishing because a key presented to a fraudulent domain will not produce a valid signature for the legitimate site. In contrast, TOTP (RFC 6238) relies on a shared secret and time-based codes that can be captured and reused in a relay attack.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
An employee at a financial services firm receives an email that appears to come from the IT helpdesk, asking them to reset their password via a link. The link leads to a convincing fake portal that harvests credentials. Security teams use phishing simulations and security-awareness training to reduce this attack vector. Questions like this test whether you can identify social engineering techniques and appropriate controls.
Quick reference
Asymmetric Encryption Algorithm Comparison
Algorithm
Key Exchange
Signatures
Equivalent Security Key
Notes
RSA-3072
Yes
Yes
128-bit
Widely deployed; slow for bulk data
ECDSA P-256
No
Yes
128-bit
Fast signatures; standard TLS certs
ECDH / ECDHE
Yes
No
128-bit
Perfect forward secrecy in TLS 1.3
DH / DHE
Yes
No
128-bit (3072-bit key)
Replaced by ECDHE in modern TLS
Ed25519
No
Yes
~128-bit
SSH keys, modern PKI
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
General Security Concepts — This question tests General Security Concepts — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: FIDO2 hardware security key, because it resists phishing and does not depend on SMS or email delivery. — The remote-admin requirement emphasizes phishing resistance and independence from SMS or email delivery, which are vulnerable to interception or social engineering. FIDO2 hardware security keys use public-key cryptography and origin-bound credentials, making them phishing-resistant and eliminating reliance on potentially compromised communication channels. This aligns with the stated requirement better than the other options.
What should I do if I get this SY0-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.