Pass Your CompTIA SY0-701 Exam Easy!

Warnings may deter a person but cannot enforce a locked entry point. Written guidance and awareness influence behavior, but they do not by themselves enforce a technical or physical boundary. Here the decisive fact is people can walk through a side gate without a credential. “Fit the side gate with badge-controlled locking hardware” matches that requirement because a physical lock tied to access authorization blocks passage rather than simply documenting a trespass.

An unenforced instruction leaves the walk-through route physically open. The category of control depends on when and how it acts: prevention denies an unwanted event, detection observes it, deterrence discourages it and correction restores service after failure. In the reported situation, people can walk through a side gate without a credential. The effective mechanism is “Fit the side gate with badge-controlled locking hardware”: a physical lock tied to access authorization blocks passage rather than simply documenting a trespass.

Footage records unauthorized arrivals after the boundary has been crossed. The evidence is people can walk through a side gate without a credential. Cameras are primarily detective: they observe or preserve evidence, but a recording is not equivalent to preventing the observed act. By contrast, “Fit the side gate with badge-controlled locking hardware” operates on the specific concern: a physical lock tied to access authorization blocks passage rather than simply documenting a trespass.

An administrative reminder does not enforce code execution on endpoints. Written guidance and awareness influence behavior, but they do not by themselves enforce a technical or physical boundary. In the reported situation, a malware investigation shows that an executable launched successfully despite a high-priority alert from endpoint telemetry. The effective mechanism is “Enforce application control using an approved executable allowlist”: execution policy denies unsigned or unapproved binaries before they run on managed hosts.

Longer retention preserves investigation evidence without preventing execution. The evidence is a malware investigation shows that an executable launched successfully despite a high-priority alert from endpoint telemetry. Telemetry provides evidence and may trigger a response; it does not automatically deny a transaction or remediate its cause. By contrast, “Enforce application control using an approved executable allowlist” operates on the specific concern: execution policy denies unsigned or unapproved binaries before they run on managed hosts.

A detective alert still fires after the parent executable has started. Telemetry provides evidence and may trigger a response; it does not automatically deny a transaction or remediate its cause. Here the decisive fact is a malware investigation shows that an executable launched successfully despite a high-priority alert from endpoint telemetry. “Enforce application control using an approved executable allowlist” matches that requirement because execution policy denies unsigned or unapproved binaries before they run on managed hosts.

An announcement does not recover encrypted patient files. Retention and storage policies determine evidence availability and lifecycle; they do not automatically solve the active permission failure. Here the decisive fact is a hospital's backup restore process begins only after ransomware destroys a file share. “Restore legitimate service as a corrective control” matches that requirement because recovery after an incident repairs the operational state rather than stopping the original attack.

Detection discovers indicators but cannot itself reconstruct the unavailable files. The evidence is a hospital's backup restore process begins only after ransomware destroys a file share. Telemetry provides evidence and may trigger a response; it does not automatically deny a transaction or remediate its cause. By contrast, “Restore legitimate service as a corrective control” operates on the specific concern: recovery after an incident repairs the operational state rather than stopping the original attack.

Attachment scanning operates before malicious activity, unlike restoration of damaged data. Assessment identifies a state and supplies findings, but does not itself enforce a preventive control or finish remediation. Here the decisive fact is a hospital's backup restore process begins only after ransomware destroys a file share. “Restore legitimate service as a corrective control” matches that requirement because recovery after an incident repairs the operational state rather than stopping the original attack.

A badge rejection physically prevents entry instead of merely discouraging it. Physical mechanisms address passage or impact at a location; they cannot directly repair software validation and network authorization defects. In the reported situation, staff routinely prop open a locked equipment-room door during deliveries. The effective mechanism is “Post conspicuous monitored-access warnings with visible patrol presence”: visible enforcement expectations change the perceived likelihood of detection before a violation.

Restoration repairs failed systems but does not influence intent before unauthorized entry. The evidence is staff routinely prop open a locked equipment-room door during deliveries. Backups and replicated copies mainly serve recovery and resilience; they do not inherently prevent an attacker from obtaining present access. By contrast, “Post conspicuous monitored-access warnings with visible patrol presence” operates on the specific concern: visible enforcement expectations change the perceived likelihood of detection before a violation.

Post-event review is a detective response, not a visible deterrent. Physical mechanisms address passage or impact at a location; they cannot directly repair software validation and network authorization defects. Here the decisive fact is staff routinely prop open a locked equipment-room door during deliveries. “Post conspicuous monitored-access warnings with visible patrol presence” matches that requirement because visible enforcement expectations change the perceived likelihood of detection before a violation.

Intermittent isolation does not compensate for unfiltered reachable interfaces. The category of control depends on when and how it acts: prevention denies an unwanted event, detection observes it, deterrence discourages it and correction restores service after failure. In the reported situation, a 20-year-old industrial controller cannot run endpoint protection; replacing it is delayed by safety certification. The effective mechanism is “Restrict the controller to an isolated protocol gateway and tightly monitored peers”: segmentation supplies alternative risk reduction while the unavailable host control remains absent.

Removing safety telemetry adds risk instead of compensating for unsupported protection. The evidence is a 20-year-old industrial controller cannot run endpoint protection; replacing it is delayed by safety certification. The category of control depends on when and how it acts: prevention denies an unwanted event, detection observes it, deterrence discourages it and correction restores service after failure. By contrast, “Restrict the controller to an isolated protocol gateway and tightly monitored peers” operates on the specific concern: segmentation supplies alternative risk reduction while the unavailable host control remains absent.

A policy cannot add capabilities the controller does not support. The category of control depends on when and how it acts: prevention denies an unwanted event, detection observes it, deterrence discourages it and correction restores service after failure. Here the decisive fact is a 20-year-old industrial controller cannot run endpoint protection; replacing it is delayed by safety certification. “Restrict the controller to an isolated protocol gateway and tightly monitored peers” matches that requirement because segmentation supplies alternative risk reduction while the unavailable host control remains absent.

Management approves the policy, but the mobile platform performs the enforcement. The category of control depends on when and how it acts: prevention denies an unwanted event, detection observes it, deterrence discourages it and correction restores service after failure. In the reported situation, and the administrator remotely revokes its work profile and encryption keys. The effective mechanism is “Technical security control”: device-management software executes access restrictions and cryptographic actions directly.

Written instructions are not the mechanism deleting managed corporate access. The evidence is and the administrator remotely revokes its work profile and encryption keys. The category of control depends on when and how it acts: prevention denies an unwanted event, detection observes it, deterrence discourages it and correction restores service after failure. By contrast, “Technical security control” operates on the specific concern: device-management software executes access restrictions and cryptographic actions directly.

No mechanical barrier or physical access device performs the remote wipe. Physical mechanisms address passage or impact at a location; they cannot directly repair software validation and network authorization defects. Here the decisive fact is and the administrator remotely revokes its work profile and encryption keys. “Technical security control” matches that requirement because device-management software executes access restrictions and cryptographic actions directly.

Encryption cannot establish that a visitor is accompanied at a doorway. The category of control depends on when and how it acts: prevention denies an unwanted event, detection observes it, deterrence discourages it and correction restores service after failure. In the reported situation, employees need a practiced procedure for challenging a tailgater rather than an automated door interlock. The effective mechanism is “Operational security control”: people following a defined workflow can enforce escort and challenge requirements during entry.

Software settings are not the primary mechanism for an employee-run challenge. The evidence is employees need a practiced procedure for challenging a tailgater rather than an automated door interlock. The category of control depends on when and how it acts: prevention denies an unwanted event, detection observes it, deterrence discourages it and correction restores service after failure. By contrast, “Operational security control” operates on the specific concern: people following a defined workflow can enforce escort and challenge requirements during entry.

Approving acceptable risk is separate from actively executing entrance checks. A business risk or contractual measure can transfer or accept exposure without technically removing the vulnerable path. Here the decisive fact is employees need a practiced procedure for challenging a tailgater rather than an automated door interlock. “Operational security control” matches that requirement because people following a defined workflow can enforce escort and challenge requirements during entry.

Findings measure risk indicators but cannot authorize the enterprise's appetite. Assessment identifies a state and supplies findings, but does not itself enforce a preventive control or finish remediation. In the reported situation, a company has conflicting proposals about how much breach risk to tolerate. The effective mechanism is “Designated business leadership through managerial governance”: authorized decision-makers determine appetite and treatment boundaries; engineers implement the approved design.

Vendor defaults cannot set the organization's acceptable legal and business exposure. The evidence is a company has conflicting proposals about how much breach risk to tolerate. Telemetry provides evidence and may trigger a response; it does not automatically deny a transaction or remediate its cause. By contrast, “Designated business leadership through managerial governance” operates on the specific concern: authorized decision-makers determine appetite and treatment boundaries; engineers implement the approved design.

A purchasing budget can inform the financial consequences of risk treatment, but procurement savings are not delegated authorization to accept company-wide exposure. Risk appetite includes legal, operational, safety and reputational consequences beyond the price of a proposed control. The scenario asks who sets the boundary before engineers implement mitigation; that requires accountable business leadership through governance. Procurement should provide cost evidence to that decision, not substitute a budget target for an approved organizational risk threshold.

Video can assist investigation but does not return missing assets by itself. The category of control depends on when and how it acts: prevention denies an unwanted event, detection observes it, deterrence discourages it and correction restores service after failure. Here the decisive fact is it does not lock the gates or prevent traffic. “Detective surveillance” matches that requirement because the recording creates observations and investigative evidence of movement after or during the event.

No instruction or approved rule is conveyed solely by capturing images. The evidence is it does not lock the gates or prevent traffic. The category of control depends on when and how it acts: prevention denies an unwanted event, detection observes it, deterrence discourages it and correction restores service after failure. By contrast, “Detective surveillance” operates on the specific concern: the recording creates observations and investigative evidence of movement after or during the event.

A camera lens cannot mechanically deny access to a vehicle. Physical mechanisms address passage or impact at a location; they cannot directly repair software validation and network authorization defects. Here the decisive fact is it does not lock the gates or prevent traffic. “Detective surveillance” matches that requirement because the recording creates observations and investigative evidence of movement after or during the event.

A network rule cannot encrypt a stolen laptop's local storage. Network restrictions govern allowed flows and trust boundaries, not every application-layer input or business permission. Here the decisive fact is a developer asks why a policy that says 'all laptops require encryption' does not ensure the drives are protected. “Deploy managed full-disk encryption with compliance enforcement” matches that requirement because the policy states intent, while device configuration and compliance checks implement protection.

Changing a directive does not alter the disk encryption state. The category of control depends on when and how it acts: prevention denies an unwanted event, detection observes it, deterrence discourages it and correction restores service after failure. In the reported situation, a developer asks why a policy that says 'all laptops require encryption' does not ensure the drives are protected. The effective mechanism is “Deploy managed full-disk encryption with compliance enforcement”: the policy states intent, while device configuration and compliance checks implement protection.

Less log history neither encrypts files nor confirms device compliance. The evidence is a developer asks why a policy that says 'all laptops require encryption' does not ensure the drives are protected. Telemetry provides evidence and may trigger a response; it does not automatically deny a transaction or remediate its cause. By contrast, “Deploy managed full-disk encryption with compliance enforcement” operates on the specific concern: the policy states intent, while device configuration and compliance checks implement protection.