CompTIA SY0-701 Bundle

An operational procedure instructs administrators or help-desk staff how to perform specific access-management tasks, including the steps to remove a privilege and document completion. Such procedures might eventually implement the attestation policy, but no procedural workflow is stated here. The annual approval obligation is a governance decision by management, not instructions for technicians carrying it out.

A technical preventive control acts at the point an unauthorized event would occur, such as a privilege-management system denying a role assignment until approval. Although that technology could support annual access reviews, the scenario explicitly says there is no automated enforcement or configured review system. A written mandate alone cannot technically prevent an administrator from retaining excess privileges.

A detective monitoring rule identifies potentially suspicious activity through alerts or logs after relevant events occur, for example a sudden increase in administrator commands. Monitoring could reveal access misuse between annual reviews, but the proposed obligation involves department managers approving entitlements on schedule. Nothing states that anomaly detection was deployed, nor would alerting replace managerial attestation.

Technical preventive controls enforce restrictions through systems or software, such as a firewall rejecting unauthorized network connections or an IAM policy denying a login. This badge reader uses electronics, but the question is classifying the turnstile's primary protection: a physical gate bars actual movement through the entrance. The electronic credential reader enables the physical barrier rather than making the barrier principally a digital-access control.

Detective physical controls create evidence of a physical event, such as the cameras observing people at the entrance or a sensor notifying guards of an opening. The laboratory's cameras serve that role, but the question asks specifically about the turnstiles, which stay locked until badge authorization. An element that physically stops crossing the entry boundary is preventive rather than merely investigative.

A deterrent control attempts to influence a potential intruder not to act, for example by making surveillance or penalties conspicuous. The turnstile's visibility may incidentally deter someone, but its defining function is to prevent passage with a locked barrier until a valid badge is accepted. Classifying the barrier solely as deterrent would overlook the enforced entry restriction, even if an attacker ignores it.

A technical detective control commonly analyzes digital activity, such as correlating identity-provider login events or endpoint telemetry to flag suspicious system behavior. The camera is also electronic, which may tempt a learner toward this answer, but the protected boundary in this case is physical entry. No network or system event is being evaluated; the video records people entering a building, so the physical detective classification is more precise.

Physical preventive controls impede an attempted physical entry, for example by keeping an access gate locked until a legitimate credential is presented. A CCTV camera can observe the same doorway, but this installation has no mechanism to deny passage. The fact that it records an intruder is valuable evidence after the event, not proof that the intruder was stopped at the entrance.

Physical deterrent controls seek to discourage an intrusion by making an adverse consequence seem likely, such as a visible warning sign or plainly displayed patrol. A visible camera can have an incidental deterrent effect, which makes this option tempting. However, the implementation is explicitly described as unattended recording for later inspection; its demonstrated function is capturing evidence, not a designed warning or barrier.

Managerial controls establish objectives and obligations for an organization, such as directing periodic access reviews or requiring executives to accept residual risk. An access-review policy may have discovered this entitlement error, but the scenario describes a technician manually removing a privilege after discovery. Execution of the corrective step is operational work rather than the managerial decision that required it in the first place.

An operational directive is a documented instruction that tells personnel how to perform routine control activities, including where to document a privilege removal. The technician follows such a directive, so the term is relevant, but the question asks for the staff-led action actually illustrated. Removing the mistaken privilege is the corrective operation, while the procedure is only the rulebook governing that operation.

A technical corrective control uses a configured system to repair an unwanted state, such as an endpoint agent automatically quarantining malware or a policy engine removing inappropriate group membership. Here the help-desk technician individually reviews and revokes the account role. Even though the technician uses software to make the change, the correction is performed as a human operational process, not by an autonomous technical safeguard.

A technical corrective control restores a more secure state after a problem has been identified, such as isolating an infected endpoint or removing malicious persistence. The firewall's deny rule acts on a connection attempt before it can establish management access. Although the firewall might later help responders isolate a breached server, no after-the-fact remediation or restoration is described in this particular scenario.

A physical preventive control uses a barrier or entry mechanism to restrict movement into a facility, such as a locked server-room door or controlled turnstile. It can support defense in depth for a hosted system, so the term prevention may sound relevant. This question concerns inbound network sessions handled by a firewall, not people crossing a protected physical boundary.

A technical detective control discovers or records suspicious events, such as an intrusion-detection alert that asks an analyst to investigate a management login attempt. Firewall logging may provide detective evidence and can be useful for tuning policy. However, the rule explicitly drops packets before they reach the service; choosing detection would confuse a secondary log artifact with the primary preventive enforcement behavior.

A primary built-in authentication control would be implemented by the payroll server itself, checking a second factor when an administrator establishes a session. The scenario explicitly rules out native MFA on that legacy system. Authentication is instead enforced upstream at the jump host, so calling it built-in would misrepresent which component implements the protection and could obscure bypass paths.

Physical deterrents are signs, visible guards, or similar measures intended to discourage unauthorized entry into a place. The payroll server's exposure is remote administrative access through a network connection, not an attempt to walk into a room. Placing physical warnings around the site would not authenticate remote administrators or close a direct network route to the server.

Risk acceptance would be a documented decision to tolerate the missing MFA without implementing equivalent mitigation, after evaluating the residual exposure. That is not what the temporary architecture does: it adds a mandatory authentication chokepoint, surveillance of administrative activity, and network restrictions. These are practical substitute safeguards. Acceptance might still be needed for any remaining residual risk, but it is not the role of the jump-host design.

A compensating control substitutes an alternative safeguard when a desired primary control cannot be deployed, and its adequacy must be assessed against the resulting risk. For example, a monitored staffed checkpoint might temporarily replace a failed automated gate. The notices do not provide equivalent access validation or detection in place of any stated failed safeguard; they chiefly communicate consequences to discourage behavior.

A physical detective control supplies evidence that an event occurred, such as a camera recording a doorway or a sensor reporting a breached entrance. A warning sign may make the premises conspicuous, but it does not sense movement, collect an access log, or send a notification. A learner should not mistake a visible security message for instrumentation capable of detecting an unauthorized arrival.

A physical preventive control uses an enforceable physical obstruction or admission process, such as a locked gate that requires badge authorization. A prosecution warning can influence behavior but leaves the entrance exactly as passable as before. Because the warehouse added no locks, guards, or access devices, the signs alone cannot prevent an entrant from crossing the boundary, even if they reduce attempted intrusions.

A technical corrective control changes a computing system after identifying a fault or unwanted state; for example, an endpoint agent might remove malware or restore an altered configuration. The facilities instruction specifies how people should behave during normal operation, not a technical fix after an incident. No automated corrective mechanism, endpoint product, or already-detected defect is part of the stated requirement.

A technical preventive control enforces a condition through technology, such as a door controller that verifies badges or a firewall that rejects unauthorized packets. Displaying a badge may make human checks easier, but the instruction is not a deployed controller. The stem expressly excludes electronic enforcement, so interpreting a written employee procedure as a technical blocking mechanism would add an unsupported implementation.

A managerial directive typically establishes high-level security policy, governance obligations, risk ownership, or management approval requirements. An organization may have a managerial policy that authorizes badge programs, which makes this alternative superficially related. The stem narrows the subject to the facilities team's day-to-day wearing instruction and explicitly distinguishes it from executive risk policy; therefore the more specific operational category applies.

A technical preventive control enforces a rule to stop an unauthorized action from occurring, such as automatically denying risky authentication attempts or locking an account after a threshold. The identity platform might support such policies, which makes this plausible. In the described configuration it sends a notification only; there is no lockout, denied token, or other enforcement decision, so prevention is not established.

A technical corrective control changes an affected system to restore a desired secure state, for example disabling an abused credential or quarantining a confirmed malicious program. Investigators may take corrective measures after reading this alert. However, the platform itself has only reported failed logins and has not reset credentials, rolled back account entitlements, or removed an attacker, making the corrective label premature.

A physical detective control records or senses activity in a building, such as a door-contact alarm or camera observing a protected corridor. Both physical and technical controls can be detective, which explains why this label can attract a learner. The collected events here are authentication failures from an identity service rather than physical entry, so the technical rather than physical implementation category is required.

A technical detective control identifies events or artifacts that indicate suspicious behavior, such as signaling that an executable matches a malicious signature. Detection is an essential input to this case, so the category appears relevant. But the action being classified goes beyond observing the file: it isolates the process and removes the malware to restore the endpoint, which is corrective behavior.

An operational corrective action is performed by personnel following an operating procedure, such as a technician manually revoking a mistakenly assigned administrator role. The objective can resemble automated remediation, so the word corrective alone is not enough to decide. In this scenario, a software agent performs the isolation and deletion without the described human procedure, making the control technical rather than operational.

A technical preventive control blocks unauthorized activity before it succeeds, such as an application-control policy refusing to launch an untrusted executable. Endpoint software can provide both prevention and remediation capabilities, which may be confusing. Here the executable is already on the host and the requested action is cleanup following detection. Classifying that removal as the original prevention would ignore the time ordering stated in the stem.