SY0-701 General Security Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A firewall at the network perimeter

  Why this is correct

  A firewall at the network perimeter filters traffic based on a predefined rule set, blocking unauthorized access while permitting legitimate communication. This boundary control segments the network into trust zones and provides the first line of defense against external threats. Its value in defense in depth comes from being one of many layers, complemented by internal segmentation and host-based controls.

• ✓

  Mandatory access controls on sensitive files

  Why this is correct

  Mandatory access controls (MAC) enforce system-wide, non-discretionary policies that use classification labels (e.g., secret, top secret) and subject clearances to determine data access. The operating system or security kernel mediates every request, ensuring users cannot override permissions based on their own judgment. This ensures the principle of least privilege is enforced at the data level, making it a critical layer that complements network and host controls.

• ✓

  Regular security awareness training for employees

  Why this is correct

  Regular security awareness training reduces the human attack surface by teaching employees to recognize phishing, social engineering, and unsafe practices like password reuse. Because technical controls such as antivirus and firewalls cannot reliably stop a user from clicking a malicious link, training becomes the final layer that protects against infection or credential theft. It turns employees into active participants in the security posture, a crucial part of a layered strategy.

• ✗

  A single password policy for all users

  Why it's wrong here

  A single password policy for all users is ineffective because it fails to account for varying risk levels across different systems and roles. For example, an administrative account requires longer, more complex passwords and stricter rotation than a standard user, but a uniform policy either under-protects privileged accounts or overburdens typical users, encouraging insecure behavior. This approach is not a layered control; it is a one-size-fits-all measure that provides no defense-in-depth benefit.

• ✗

  Using only one antivirus solution for all endpoints

  Why it's wrong here

  Using only one antivirus solution creates a single point of failure, as every endpoint relies on the same detection signatures and heuristics, which malicious actors can specifically evade. A truly layered defense incorporates multiple overlapping tools—such as EDR, application whitelisting, and intrusion detection—that cover different attack vectors. Deploying just one AV product avoids this diversity and leaves the environment vulnerable to modern polymorphic malware and zero-days.

• ✗

  Disabling all logging to save storage space

  Why it's wrong here

  Disabling all logging removes the detective and reactive layer that is essential for identifying and investigating security incidents. Logs provide the forensic evidence needed to determine how an attacker gained access, what they exfiltrated, and which systems need recovery. Without this visibility, even if other controls like a firewall or MAC are bypassed, the breach may go undetected for months, rendering other layers less effective—a direct violation of the defense-in-depth principle.

Go deeper

Related to this question