Pass Your CompTIA SY0-701 Exam Easy!

Employee education cannot update live access policy when device health changes. Written guidance and awareness influence behavior, but they do not by themselves enforce a technical or physical boundary. In the reported situation, a web service trusts its earlier VPN login forever. The effective mechanism is “Reevaluate device and session risk at sensitive resource access”: continuous context-aware decisions avoid treating network membership as permanent trust.

Removing decisions allows precisely the unrestricted access at issue. The evidence is a web service trusts its earlier VPN login forever. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. By contrast, “Reevaluate device and session risk at sensitive resource access” operates on the specific concern: continuous context-aware decisions avoid treating network membership as permanent trust.

Subnet location ignores the new unsafe endpoint state. Network restrictions govern allowed flows and trust boundaries, not every application-layer input or business permission. Here the decisive fact is a web service trusts its earlier VPN login forever. “Reevaluate device and session risk at sensitive resource access” matches that requirement because continuous context-aware decisions avoid treating network membership as permanent trust.

File-change detection does not decide who may request a resource. Telemetry provides evidence and may trigger a response; it does not automatically deny a transaction or remediate its cause. Here the decisive fact is while a gateway applies that decision. “The policy engine in the control plane” matches that requirement because the engine evaluates attributes and rules; enforcement happens separately at the gateway.

Forwarding packets is not equivalent to deciding identity-dependent business policy. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. In the reported situation, while a gateway applies that decision. The effective mechanism is “The policy engine in the control plane”: the engine evaluates attributes and rules; enforcement happens separately at the gateway.

Logging captures outcomes but does not produce the access permit decision. The evidence is while a gateway applies that decision. Telemetry provides evidence and may trigger a response; it does not automatically deny a transaction or remediate its cause. By contrast, “The policy engine in the control plane” operates on the specific concern: the engine evaluates attributes and rules; enforcement happens separately at the gateway.

A register records acceptance decisions without acting on a live connection. A business risk or contractual measure can transfer or accept exposure without technically removing the vulnerable path. Here the decisive fact is a microsegmentation gateway terminates a session when the control plane revokes its permission. “Policy enforcement point in the data plane” matches that requirement because the enforcement point carries out allow and deny decisions on resource traffic.

The engine computes decisions but does not directly terminate packets or sessions. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. In the reported situation, a microsegmentation gateway terminates a session when the control plane revokes its permission. The effective mechanism is “Policy enforcement point in the data plane”: the enforcement point carries out allow and deny decisions on resource traffic.

A static report cannot intercept the revoked session. Telemetry provides evidence and may trigger a response; it does not automatically deny a transaction or remediate its cause. Here the decisive fact is a microsegmentation gateway terminates a session when the control plane revokes its permission. “Policy enforcement point in the data plane” matches that requirement because the enforcement point carries out allow and deny decisions on resource traffic.

A stored recording documents damage instead of absorbing the impact. Cameras are primarily detective: they observe or preserve evidence, but a recording is not equivalent to preventing the observed act. In the reported situation, no pedestrian intrusion is involved. The effective mechanism is “Install crash-rated bollards before the wall”: bollards create a vehicle-impact barrier at the exposed approach.

Filtering malicious mail does not change a vehicle's physical route. The evidence is no pedestrian intrusion is involved. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. By contrast, “Install crash-rated bollards before the wall” operates on the specific concern: bollards create a vehicle-impact barrier at the exposed approach.

Stronger card cryptography does not stop accidental forklift collisions. Encryption addresses readability of protected data. Authentication, correct permissions and availability must still be enforced separately. Here the decisive fact is no pedestrian intrusion is involved. “Install crash-rated bollards before the wall” matches that requirement because bollards create a vehicle-impact barrier at the exposed approach.

User-account resets do not control how many people pass a physical threshold. Authentication checks a claimant, but it does not automatically narrow resource privileges or invalidate a different leaked secret. Here the decisive fact is one valid employee opens a door and two unbadged followers enter. “An access-control vestibule that verifies one entrant per authorization” matches that requirement because interlocking entry reduces piggybacking instead of trusting a held-open badge door.

Retrospective video cannot physically enforce one-person entry. The evidence is one valid employee opens a door and two unbadged followers enter. Cameras are primarily detective: they observe or preserve evidence, but a recording is not equivalent to preventing the observed act. By contrast, “An access-control vestibule that verifies one entrant per authorization” operates on the specific concern: interlocking entry reduces piggybacking instead of trusting a held-open badge door.

Mail filtering has no bearing on following someone through a lab doorway. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. Here the decisive fact is one valid employee opens a door and two unbadged followers enter. “An access-control vestibule that verifies one entrant per authorization” matches that requirement because interlocking entry reduces piggybacking instead of trusting a held-open badge door.

Normal internet requests would overwhelm an intrusion-focused tripwire. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. Here the decisive fact is a security team needs an alert if someone opens a document no authorized business process ever accesses. “A monitored honeyfile containing no real customer data” matches that requirement because a deliberately unused decoy document can report unauthorized reads without exposing genuine secrets.

Many employees open it legitimately, making access a weak intrusion signal. Written guidance and awareness influence behavior, but they do not by themselves enforce a technical or physical boundary. In the reported situation, a security team needs an alert if someone opens a document no authorized business process ever accesses. The effective mechanism is “A monitored honeyfile containing no real customer data”: a deliberately unused decoy document can report unauthorized reads without exposing genuine secrets.

Legitimate backup access would produce noise and unnecessary sensitive-data risk. Backups and replicated copies mainly serve recovery and resilience; they do not inherently prevent an attacker from obtaining present access. Here the decisive fact is a security team needs an alert if someone opens a document no authorized business process ever accesses. “A monitored honeyfile containing no real customer data” matches that requirement because a deliberately unused decoy document can report unauthorized reads without exposing genuine secrets.

Key custody does not simulate attackable network systems. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. Here the decisive fact is a decoy environment intentionally imitates several vulnerable machines to study attacker movement among them. “A connected honeynet of decoys” matches that requirement because a coordinated decoy network allows observation of lateral movement across simulated hosts.

Caching legitimate pages is not the purpose of an intentionally vulnerable decoy environment. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. In the reported situation, a decoy environment intentionally imitates several vulnerable machines to study attacker movement among them. The effective mechanism is “A connected honeynet of decoys”: a coordinated decoy network allows observation of lateral movement across simulated hosts.

One instrumented token cannot reproduce multi-host network behavior. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. Here the decisive fact is a decoy environment intentionally imitates several vulnerable machines to study attacker movement among them. “A connected honeynet of decoys” matches that requirement because a coordinated decoy network allows observation of lateral movement across simulated hosts.

A magnetic contact reports closure state rather than a moving heat signature. Physical mechanisms address passage or impact at a location; they cannot directly repair software validation and network authorization defects. In the reported situation, a guard must determine whether an alarm at a secured fence is triggered by body heat rather than nearby machinery vibration. The effective mechanism is “Passive infrared motion sensing”: pIR detection reacts to thermal contrast rather than contact pressure or acoustic reflections.

Ultrasonic devices rely on reflected sound, not thermal infrared contrast. The evidence is a guard must determine whether an alarm at a secured fence is triggered by body heat rather than nearby machinery vibration. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. By contrast, “Passive infrared motion sensing” operates on the specific concern: pIR detection reacts to thermal contrast rather than contact pressure or acoustic reflections.

Pressure sensors require force on the sensing area and do not detect heat radiation. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. Here the decisive fact is a guard must determine whether an alarm at a secured fence is triggered by body heat rather than nearby machinery vibration. “Passive infrared motion sensing” matches that requirement because pIR detection reacts to thermal contrast rather than contact pressure or acoustic reflections.

Recording images does not directly measure weight on the tile. Cameras are primarily detective: they observe or preserve evidence, but a recording is not equivalent to preventing the observed act. Here the decisive fact is a cabinet alarm must activate only when someone steps onto its protected floor tile. “A pressure-sensitive floor mat” matches that requirement because a pressure mat registers the applied load at the chosen approach position.

Radar movement sensing does not establish contact pressure on the floor. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. In the reported situation, a cabinet alarm must activate only when someone steps onto its protected floor tile. The effective mechanism is “A pressure-sensitive floor mat”: a pressure mat registers the applied load at the chosen approach position.

Thermal motion can trigger without a foot touching the specific tile. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. Here the decisive fact is a cabinet alarm must activate only when someone steps onto its protected floor tile. “A pressure-sensitive floor mat” matches that requirement because a pressure mat registers the applied load at the chosen approach position.

Identity proof does not confer unrestricted access rights. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. In the reported situation, a person enters a code from an authenticator. The effective mechanism is “Authentication of an asserted identity”: both mechanisms establish confidence that the peer is who it claims to be, using different evidence.

Neither identity check automatically stores an immutable activity history. The evidence is a person enters a code from an authenticator. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. By contrast, “Authentication of an asserted identity” operates on the specific concern: both mechanisms establish confidence that the peer is who it claims to be, using different evidence.

Authentication cannot make the server continuously available. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. Here the decisive fact is a person enters a code from an authenticator. “Authentication of an asserted identity” matches that requirement because both mechanisms establish confidence that the peer is who it claims to be, using different evidence.

Monitoring does not reduce what a stolen privileged identity may do. Telemetry provides evidence and may trigger a response; it does not automatically deny a transaction or remediate its cause. Here the decisive fact is a company has many unused privileged accounts and wants to shrink the reachable blast radius if one identity is compromised. “Grant only the permissions required for each job function” matches that requirement because least privilege limits the resources available to a compromised account.

Broad rights amplify the attacker’s reach after a single credential compromise. Authentication, authorization and accounting are distinct functions; similarly, information confidentiality, integrity and service availability describe different outcomes. In the reported situation, a company has many unused privileged accounts and wants to shrink the reachable blast radius if one identity is compromised. The effective mechanism is “Grant only the permissions required for each job function”: least privilege limits the resources available to a compromised account.

A shared secret increases blast radius and impairs accountability. Authentication checks a claimant, but it does not automatically narrow resource privileges or invalidate a different leaked secret. Here the decisive fact is a company has many unused privileged accounts and wants to shrink the reachable blast radius if one identity is compromised. “Grant only the permissions required for each job function” matches that requirement because least privilege limits the resources available to a compromised account.