SY0-701 Security Architecture Practice Question
An organization is redesigning access for its HR portal. HR staff need to update employee records, managers need to approve leave requests, and payroll staff need access to salary data, but no single user should receive all of those permissions by default. What is the best access model?
⚠ Common exam trap
Many exam-takers confuse RBAC with simpler models like DAC or MAC, or assume that convenience (e.g., faster approvals) justifies overriding least privilege, but the exam emphasizes that role separation and minimal permissions are mandatory for secure access design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create separate roles for HR, managers, and payroll, and grant only the permissions needed for each job function.
Role-Based Access Control (RBAC) assigns permissions based on job functions, ensuring that HR staff, managers, and payroll personnel receive only the privileges necessary for their roles. This enforces the principle of least privilege and prevents any single user from inheriting all permissions by default, which aligns with the organization's security requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create separate roles for HR, managers, and payroll, and grant only the permissions needed for each job function.
Why this is correct
This is correct because it applies role-based access control (RBAC) and the principle of least privilege. By creating distinct roles for HR, managers, and payroll, each job function receives only the permissions required for its operational duties, preventing unnecessary access to sensitive records such as salary or disciplinary data. This role separation also enforces segregation of duties, so no single role can control an entire HR process, reducing the risk of fraud or accidental modification of critical records.
- ✗
Assign everyone the same portal permissions to simplify administration.
Why it's wrong here
Assigning identical portal permissions to every employee simplifies user administration, but it fails to restrict access to sensitive HR data based on job need. This violates least privilege and widens the attack surface, as any user with a compromised account or malicious intent could view or modify payroll, performance, and personal information without authorization. Compliance frameworks—like HIPAA, GDPR, or SOX—also expect organizations to implement access controls that reflect individual responsibility, so a flat-permission model exposes the company to regulatory penalties and audit failures.
- ✗
Give every manager full HR and payroll access so approvals are faster.
Why it's wrong here
Granting all managers full HR and payroll access may speed approvals, but it is an over-privileged, one-size-fits-all role that violates least privilege. Because managers would have unrestricted visibility and edit rights over salary, benefits, and personnel files, a single careless action or compromised credential could cause significant data loss, confidentiality breaches, or unauthorized changes. Moreover, it erases segregation of duties: a manager who also handles payroll could manipulate their own compensation without detection, undermining internal controls and audit integrity.
- ✗
Use one shared administrator account for all HR actions to keep audits simple.
Why it's wrong here
Using one shared administrator account for all HR actions appears to simplify oversight, but it removes individual accountability because actions cannot be attributed to a specific person. In any audit, a shared account produces a single non-repudiation gap; if a critical record is altered, investigators cannot determine which authorized user performed the change, making it impossible to enforce accountability or identify the source of a breach. This directly contradicts the objective of a reliable audit trail and conflicts with regulatory and identity governance best practices, which require unique user accounts and strong authentication.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Cloud Security Fundamentals
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An HR department wants each employee to access only the systems required for their job. A new hire should receive the same permissions as other HR specialists, and changes to the role should update access centrally. Which access model should be used?
easy- ✓ A.Role-based access control (RBAC)
- B.Attribute-based access control (ABAC)
- C.Multi-factor authentication (MFA)
- D.Privileged access management (PAM)
Why A: Role-based access control (RBAC) is the correct model because it assigns permissions based on job roles (e.g., HR specialist), ensuring that a new hire automatically inherits the same access as others in that role. Centralized role management allows changes to the role's permissions to propagate to all members, meeting the requirement for centralized updates.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.