Pass Your CompTIA SY0-701 Exam Easy!

A network rule cannot encrypt a stolen laptop's local storage. Network restrictions govern allowed flows and trust boundaries, not every application-layer input or business permission. Here the decisive fact is a developer asks why a policy that says 'all laptops require encryption' does not ensure the drives are protected. “Deploy managed full-disk encryption with compliance enforcement” matches that requirement because the policy states intent, while device configuration and compliance checks implement protection.

Changing a directive does not alter the disk encryption state. The category of control depends on when and how it acts: prevention denies an unwanted event, detection observes it, deterrence discourages it and correction restores service after failure. In the reported situation, a developer asks why a policy that says 'all laptops require encryption' does not ensure the drives are protected. The effective mechanism is “Deploy managed full-disk encryption with compliance enforcement”: the policy states intent, while device configuration and compliance checks implement protection.

Less log history neither encrypts files nor confirms device compliance. The evidence is a developer asks why a policy that says 'all laptops require encryption' does not ensure the drives are protected. Telemetry provides evidence and may trigger a response; it does not automatically deny a transaction or remediate its cause. By contrast, “Deploy managed full-disk encryption with compliance enforcement” operates on the specific concern: the policy states intent, while device configuration and compliance checks implement protection.

Awareness messaging does not inspect and block a file-upload workflow. Written guidance and awareness influence behavior, but they do not by themselves enforce a technical or physical boundary. Here the decisive fact is a financial firm needs to prevent unauthorized uploads of labeled customer files from managed endpoints. “Enforce endpoint DLP blocking for the classified files and prohibited destinations” matches that requirement because content-aware policy can stop an outbound transfer before restricted data leaves the host.

Snapshots support recovery, not prevention of an unauthorized outbound copy. Backups and replicated copies mainly serve recovery and resilience; they do not inherently prevent an attacker from obtaining present access. In the reported situation, a financial firm needs to prevent unauthorized uploads of labeled customer files from managed endpoints. The effective mechanism is “Enforce endpoint DLP blocking for the classified files and prohibited destinations”: content-aware policy can stop an outbound transfer before restricted data leaves the host.

A review identifies transfers after data has already been exposed. Telemetry provides evidence and may trigger a response; it does not automatically deny a transaction or remediate its cause. Here the decisive fact is a financial firm needs to prevent unauthorized uploads of labeled customer files from managed endpoints. “Enforce endpoint DLP blocking for the classified files and prohibited destinations” matches that requirement because content-aware policy can stop an outbound transfer before restricted data leaves the host.

Switching capacity does not remove the environmental condition causing damage. The category of control depends on when and how it acts: prevention denies an unwanted event, detection observes it, deterrence discourages it and correction restores service after failure. In the reported situation, and an automatic failover starts replacement capacity without changing why overheating happened. The effective mechanism is “Corrective availability control”: the alternate capacity restores service after the component fails, reducing outage duration.

No written governance instruction is executed by a failover event. The evidence is and an automatic failover starts replacement capacity without changing why overheating happened. A business risk or contractual measure can transfer or accept exposure without technically removing the vulnerable path. By contrast, “Corrective availability control” operates on the specific concern: the alternate capacity restores service after the component fails, reducing outage duration.

Failover repairs availability and does not alter an adversary's intent. The category of control depends on when and how it acts: prevention denies an unwanted event, detection observes it, deterrence discourages it and correction restores service after failure. Here the decisive fact is and an automatic failover starts replacement capacity without changing why overheating happened. “Corrective availability control” matches that requirement because the alternate capacity restores service after the component fails, reducing outage duration.

Building access controls do not repair this application's overbroad permissions. Physical mechanisms address passage or impact at a location; they cannot directly repair software validation and network authorization defects. In the reported situation, a shared account lets employees see other departments' salary records. The effective mechanism is “Confidentiality of payroll records”: unapproved read access exposes restricted information even though uptime and data accuracy remain intact.

The reported service is reachable; the failure is its overly broad readership. The evidence is a shared account lets employees see other departments' salary records. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. By contrast, “Confidentiality of payroll records” operates on the specific concern: unapproved read access exposes restricted information even though uptime and data accuracy remain intact.

No dispute about the author of a message is described. A signature can show which key signed an object, but provenance and authorization depend on how that key and build process are trusted. Here the decisive fact is a shared account lets employees see other departments' salary records. “Confidentiality of payroll records” matches that requirement because unapproved read access exposes restricted information even though uptime and data accuracy remain intact.

An unapproved change does not by itself demonstrate that a third party read the invoice. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. In the reported situation, an employee alters an invoice amount in transit while the intended recipient still receives it on time. The effective mechanism is “Integrity of transaction data”: the amount was modified without authorization, regardless of timely delivery.

Duplicate links would not establish the authenticity of the changed total. The evidence is an employee alters an invoice amount in transit while the intended recipient still receives it on time. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. By contrast, “Integrity of transaction data” operates on the specific concern: the amount was modified without authorization, regardless of timely delivery.

The delivered invoice is accessible, so an outage is not the observed fault. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. Here the decisive fact is an employee alters an invoice amount in transit while the intended recipient still receives it on time. “Integrity of transaction data” matches that requirement because the amount was modified without authorization, regardless of timely delivery.

Proving who changed settings does not supply failover capacity. Access entitlements govern which specific operations a principal may perform; granting broad roles can expand the damage of credential compromise. Here the decisive fact is a security architect deploys redundant DNS instances so an authorized client can keep resolving a service after one node crashes. “Availability through fault tolerance” matches that requirement because an independent service path preserves legitimate use during a single-node failure.

Encrypted data does not provide an alternate DNS resolver when a node fails. Encryption addresses readability of protected data. Authentication, correct permissions and availability must still be enforced separately. In the reported situation, a security architect deploys redundant DNS instances so an authorized client can keep resolving a service after one node crashes. The effective mechanism is “Availability through fault tolerance”: an independent service path preserves legitimate use during a single-node failure.

Package provenance is unrelated to continuity of the resolver cluster. A signature can show which key signed an object, but provenance and authorization depend on how that key and build process are trusted. Here the decisive fact is a security architect deploys redundant DNS instances so an authorized client can keep resolving a service after one node crashes. “Availability through fault tolerance” matches that requirement because an independent service path preserves legitimate use during a single-node failure.

A proof of origin does not keep an application running during outages. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. Here the decisive fact is the saved document carries a signature verifiable with its registered public key. “Non-repudiation of the signed transaction” matches that requirement because valid signature verification links the approved document to control of the signing key, subject to trustworthy key identity.

A signature does not expand the signer's purchasing authority. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. In the reported situation, the saved document carries a signature verifiable with its registered public key. The effective mechanism is “Non-repudiation of the signed transaction”: valid signature verification links the approved document to control of the signing key, subject to trustworthy key identity.

A digital signature verifies integrity and origin but does not encrypt the document. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. Here the decisive fact is the saved document carries a signature verifiable with its registered public key. “Non-repudiation of the signed transaction” matches that requirement because valid signature verification links the approved document to control of the signing key, subject to trustworthy key identity.

The premise states a successful login, so permission evaluation is the separate control. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. Here the decisive fact is an engineer receives a 403 response when opening an administrative report. “Authentication succeeded, but authorization denied that resource” matches that requirement because identity verification and resource permission are separate checks with different outcomes.

The denial could be logged correctly and is not evidence of failed accounting. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. In the reported situation, an engineer receives a 403 response when opening an administrative report. The effective mechanism is “Authentication succeeded, but authorization denied that resource”: identity verification and resource permission are separate checks with different outcomes.

An HTTP denial after login does not imply a broken encrypted channel. Encryption addresses readability of protected data. Authentication, correct permissions and availability must still be enforced separately. Here the decisive fact is an engineer receives a 403 response when opening an administrative report. “Authentication succeeded, but authorization denied that resource” matches that requirement because identity verification and resource permission are separate checks with different outcomes.

Uptime statistics cannot tie configuration edits to a privileged identity. Telemetry provides evidence and may trigger a response; it does not automatically deny a transaction or remediate its cause. Here the decisive fact is a SOC needs an audit trail proving which privileged account modified firewall rules and at what time. “Accounting through tamper-resistant activity records” matches that requirement because accounting captures attributable events, while authentication and authorization govern access.

Verifying an identity does not preserve a record of specific rule modifications. The evidence is a SOC needs an audit trail proving which privileged account modified firewall rules and at what time. Authentication checks a claimant, but it does not automatically narrow resource privileges or invalidate a different leaked secret. By contrast, “Accounting through tamper-resistant activity records” operates on the specific concern: accounting captures attributable events, while authentication and authorization govern access.

A permit decision does not chronicle what the user subsequently changed. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. Here the decisive fact is a SOC needs an audit trail proving which privileged account modified firewall rules and at what time. “Accounting through tamper-resistant activity records” matches that requirement because accounting captures attributable events, while authentication and authorization govern access.

No exploitation attempts or attack simulation are described. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. Here the decisive fact is a consultant compares a bank's current password controls with a target standard and records missing capabilities without immediately installing anything. “A security gap analysis” matches that requirement because comparing actual and desired states identifies control deficiencies and a remediation backlog.

There is no active incident or host isolation in the assessment. The evidence is a consultant compares a bank's current password controls with a target standard and records missing capabilities without immediately installing anything. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. By contrast, “A security gap analysis” operates on the specific concern: comparing actual and desired states identifies control deficiencies and a remediation backlog.

The assessment documents gaps; it does not change stored credentials. Access entitlements govern which specific operations a principal may perform; granting broad roles can expand the damage of credential compromise. Here the decisive fact is a consultant compares a bank's current password controls with a target standard and records missing capabilities without immediately installing anything. “A security gap analysis” matches that requirement because comparing actual and desired states identifies control deficiencies and a remediation backlog.

Employee education cannot update live access policy when device health changes. Written guidance and awareness influence behavior, but they do not by themselves enforce a technical or physical boundary. In the reported situation, a web service trusts its earlier VPN login forever. The effective mechanism is “Reevaluate device and session risk at sensitive resource access”: continuous context-aware decisions avoid treating network membership as permanent trust.

Removing decisions allows precisely the unrestricted access at issue. The evidence is a web service trusts its earlier VPN login forever. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. By contrast, “Reevaluate device and session risk at sensitive resource access” operates on the specific concern: continuous context-aware decisions avoid treating network membership as permanent trust.

Subnet location ignores the new unsafe endpoint state. Network restrictions govern allowed flows and trust boundaries, not every application-layer input or business permission. Here the decisive fact is a web service trusts its earlier VPN login forever. “Reevaluate device and session risk at sensitive resource access” matches that requirement because continuous context-aware decisions avoid treating network membership as permanent trust.