SY0-701 General Security Concepts Practice Question
A company wants to reduce the chance that a stolen password can be used to access employee email. Which control is the best fit?
⚠ Common exam trap
A common mix-up: candidates choose password complexity (A) thinking stronger passwords prevent theft, but the question explicitly states the password is already stolen, so only a second factor like MFA can block its use.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Multi-factor authentication
Multi-factor authentication (MFA) requires at least two different authentication factors (e.g., something you know like a password and something you have like a time-based one-time password from an authenticator app). Even if an attacker steals the password, they cannot access the email without the second factor, directly reducing the risk of credential theft leading to account compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Password complexity requirements only
Why it's wrong here
Password complexity requirements reduce the likelihood of offline guessing or brute-force attacks, but they do nothing to invalidate a credential that has already been compromised. If an attacker obtains the actual password through phishing, keylogging, or a data breach, the complex password remains fully valid and reusable. A stolen password is a possession problem, not a strength problem; only a second authentication factor can block the attacker's subsequent use of the stolen secret.
- ✓
Multi-factor authentication
Why this is correct
Multi-factor authentication adds another verification step beyond the password, so an attacker who steals only a password still cannot easily log in. It is a practical preventive control for reducing account takeover risk, especially for email and other internet-facing services where passwords may be phished, reused, or exposed in breaches.
- ✗
Daily backup verification
Why it's wrong here
Daily backup verification ensures that data can be restored after destructive incidents such as ransomware, hardware failure, or accidental deletion. However, backups operate on a completely different security objective—availability and recovery—rather than authentication. An attacker who has stolen an email password can still log in and read, send, or exfiltrate messages in real time, and restoring a backup does not revoke the attacker's access or prevent the intrusion from continuing.
- ✗
Security awareness posters
Why it's wrong here
Security awareness posters educate users about risks like phishing or password reuse, but they are a training control, not a technical enforcement mechanism. Even a well-informed user can fall victim to a sophisticated credential phishing attack or unknowingly use the same password on a compromised website. Awareness raises the human firewall, yet it cannot automatically block an attacker who has already obtained a valid password, whereas multi-factor authentication enforces an additional proof-of-identity requirement at the moment of login.
Go deeper
Related to this question
Learn chapter
Authentication Methods
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.