FirstTry

Objective 4.6

SY0-701

Given a scenario, implement and maintain identity and access management

Objective 4.6 sits in Security Operations, which carries 28% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.

Objective title verbatim from the official objectives. CompTIA exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

4-6Security Operations

A new IT administrator only needs to reset passwords for one department. The identity team provisions them with a permanent Global Administrator role because it is faster than researching a narrower role. Which approach should have been used instead?

Grant the account only the specific permissions, scope, and duration needed for the taskCorrect · your answerCorrect: this is the full definition of least privilege provisioning as applied here.
Deny the account any access until an explicit permission rule matches the requestDeny by default addresses unmatched access requests, not how an existing role assignment is scoped.
Require the account to activate the role only for a limited, time-bound windowThis describes just-in-time activation, one piece of least privilege but not the whole practice being violated.
Base the account's permissions on attributes such as location and time of dayThis describes attribute-based access control, a different model, not the least privilege scoping issue.
Assign the role to a group instead of directly to the individual accountUsing a group changes who manages the assignment, not whether the permissions and duration are minimized.

Correct.

Checked against cheatsheetseries.owasp.org, July 2026

Concept

Least privilege in provisioning means granting a specific set of permissions, over a specific scope, for a specific period of time, rather than a broad standing role.

Why A

Provisioning a permanent Global Administrator role for a narrow task grants far more permission, scope, and duration than needed, which is exactly what least privilege provisioning avoids.

Source

Least privilege means you grant your administrators exactly the permission they need to do their job. There are three aspects to consider when you assign a role to your administrators: a specific set of permissions, over a specific scope, for a specific period of time. Avoid assigning broader roles at broader scopes even if it initially seems more convenient to do so.

Entra RBAC best practices, checked July 2026
#provisioning#least-privilege#privileged-access

Now you: objective 4.6 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

4-6Security Operations

An organization keeps two cloud-only accounts permanently assigned the Global Administrator role, excluded from normal daily use, reserved only for situations where all other administrators are accidentally locked out. What are these accounts called?

Sample question 2 of 3

4-6Security Operations

A help desk technician's on-premises directory account, synchronized to the cloud directory, is assigned a cloud administrator role. The on-premises account is later compromised through a phishing attack. What risk does this illustrate for privileged role assignments?

Sample question 3 of 3

4-6Security Operations

An intranet application for a small internal engineering team requires each employee to install a personal certificate on their browser and present it during the TLS handshake, in addition to a username and password. What is this approach, and where is it appropriate to use?

That’s 3 of the full Security+ bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Security Operations