CompTIA SY0-701 Bundle

A policy enforcement point is the gateway or agent that allows, blocks, monitors, or terminates an actual subject-to-resource connection. It applies the result of a policy decision but need not calculate that decision itself. Because the scenario expressly states the gateway is already enforcing and asks for the separate component that evaluates context, selecting the enforcement point would confuse execution with decision-making.

The policy administrator arranges or tears down communication paths in response to a policy engine's decision, often instructing enforcement points to establish the authorized session. It can be mistaken for the engine because it participates in the control plane, but the question identifies a separate session-establishment component. The contextual allow-or-deny evaluation belongs to the engine, not to the administrator coordinating connectivity.

A network access switch forwards Ethernet frames and may implement port-level admission rules, VLANs, or access-control lists based on commands from other components. That network function does not by itself describe the logical policy engine assessing identity claims, posture and per-resource rules. Even if a switch acts as an enforcement location, the requested role is the distinct component that makes the access decision.

Risk-based step-up verification adds authentication scrutiny when user, device, or session context makes a request unusually risky. It may produce evidence for a policy decision, so it is relevant in a zero-trust architecture. However, this question starts after the allow decision and describes configuring a connection path through a gateway, not challenging a user for an additional authenticator or reassessing sign-in risk.

The policy enforcement point is the component that mediates access to the resource and permits, monitors, or blocks the subject's connection according to control-plane instructions. In the scenario, the inline gateway fills that enforcement role. The separate controller tells the gateway when to establish or remove the path; conflating that controller with the gateway would miss the architectural separation of administrator and enforcement point.

The policy engine evaluates identity, resource policy, device posture, and other contextual inputs to decide whether a subject should access a resource. Its decision precedes the step described here. The controller neither calculates the authorization result nor evaluates the underlying risk evidence; it operationalizes the already-issued allow decision by provisioning the gateway path, which is the policy administrator's role.

The policy engine evaluates access requests and determines whether the subject should be allowed to reach the resource. The case says that assessment has already been completed, with the result transmitted by a separate controller. The inline gateway is implementing the decision rather than independently choosing the policy outcome, so the policy-engine role belongs earlier in the decision flow.

The policy administrator coordinates session setup or teardown based on the policy engine's decision, often configuring a gateway or distributing session-specific information. It can appear close to the gateway in an implementation, but the stem identifies the controller as a separate component transmitting the instruction. The inline gateway acting on that instruction is the enforcement point, not the administrator making the connection possible.

Continuous diagnostics and mitigation provides posture or telemetry about devices, users, and systems, such as health assessment results that can inform zero-trust decisions. It is an important input to the policy engine but does not itself open and close the subject's network path. The problem explicitly asks about the gateway that enforces the final decision, rather than the service that supplied device-health evidence.

Being on the office LAN does not grant implicit trust in a zero-trust architecture. A valid earlier sign-in may prove the user's identity, but it says nothing conclusive about the unmanaged laptop's health or that resource's permission rules. Automatically trusting the internal location would bypass the per-request authorization decision and would weaken protection against compromised insiders or endpoints.

A VPN creates a protected tunnel and may authenticate a remote endpoint to a network, but tunnel establishment does not establish that the requested financial-record access is authorized. An unmanaged device can still be compromised even while communicating through an encrypted VPN. Zero trust evaluates relevant identity, resource policy and device state rather than treating any network connection as blanket permission.

Additional MFA for anomalous foreign sign-ins is a useful adaptive authentication measure, but geography alone is neither a complete resource policy nor a substitute for device posture assessment. A compromised employee session originating locally may still be risky. Granting broad financial-record access after a single geographic check would violate least privilege and the per-resource trust evaluation that the question requires.

A previously recognized username or successful earlier session does not guarantee that the current request is low risk. The new unmanaged device and unusual sign-in location are changes in context that the organization expressly uses to trigger added assurance. Automatically allowing the session would ignore the policy's adaptive check and could let a stolen credential or hijacked session reach sensitive resources.

Disabling contextual evaluation would discard the very evidence the policy requires the identity system to consider. Membership in an office subnet only describes a network source and does not prove that a session comes from a trusted device or the legitimate user. The stated conditions call for adaptive authentication rather than a static location-based trust decision.

A firewall allow rule regulates packet paths based on network and protocol criteria. It cannot by itself demonstrate that the human claimant completed an additional authentication factor, particularly when a session moves between devices or locations. Network admission can complement identity checks, but the requested response must be enforced by an authentication system capable of challenging the user and recording completion.

Cameras detect or record activity and might alert guards to an approaching vehicle, but they do not physically absorb the force of a truck striking the wall. The problem explicitly requires impact resistance rather than observation alone. Video surveillance could be useful supplementary evidence around the loading dock, yet it would leave the server-room wall exposed to vehicle collision.

A badge-controlled vestibule is designed to regulate the entry of people through adjoining doors, often to prevent tailgating into a sensitive room. It is not a crash-rated structural barrier and cannot reliably stop a truck from reaching an exterior wall. Pedestrian admission control may be appropriate at a server-room doorway, but the threat here approaches from the vehicle loading area.

Speed-limit warning signs can influence drivers and are inexpensive to install, but they are deterrents relying on voluntary compliance. A malicious driver or vehicle suffering a mechanical failure may ignore the sign. The organization explicitly needs a fixed structure that can withstand an impact, so warning drivers alone does not satisfy the prevention requirement.

A standard badge-controlled door verifies a credential at entry but may remain open long enough for a second person to follow the authorized employee. A no-tailgating sign communicates expectations without physically regulating how many individuals enter. Because the case has already demonstrated that two people can pass on one swipe, retaining the same door and adding a notice does not correct the one-person admission failure.

A camera provides a record of who entered and can support post-event investigation or a live guard response. However, the stated control objective is to stop a second person from passing behind an authorized entrant even if both try together. Recording the occurrence after the fact is detective, whereas the required mantrap enforces one verified person per admission cycle.

An ordinary turnstile may restrict passage somewhat, but the proposed model explicitly allows a second person to enter immediately after a valid swipe. It therefore does not enforce the one-person authorization cycle in the scenario. Some specialized high-security turnstiles may include anti-tailgating sensors, but that is not the design offered here and should not be assumed.

A pressure mat detects weight applied to a specific surface and can alarm even when a person remains motionless on it. It cannot reliably detect an intruder moving down an aisle without ever touching that mat, because no load change occurs. The museum wants coverage based on changes in infrared energy from moving bodies, not localized pressure on a floor sensor.

Magnetic reed contacts use a magnet and switch to indicate a door or window opening when the magnet moves out of proximity. They are useful for protecting an entry point, yet someone already inside could move around the storage aisle without operating any door. The question expressly excludes door activity as a trigger and asks for thermal movement detection, so a reed contact cannot satisfy the coverage requirement.

A microwave Doppler sensor detects movement by transmitting radio-frequency energy and measuring frequency shifts in reflections. It may detect motion in the aisle, making it a plausible alternative for a different performance specification. However, the museum specifically requires sensing changes in emitted infrared energy from moving bodies; microwave Doppler detection works by reflected radio waves, not passive thermal radiation.

A passive infrared detector responds to changing thermal patterns as a person moves through its view. It may stop registering a stationary person after the initial entry event and does not directly sense weight on a specific hidden floor location. The requirement is to alarm when pressure remains on one chosen mat, so an infrared motion detector is not the best match.

A magnetic reed contact detects when a door or window changes position relative to its frame magnet. This can identify unauthorized opening of the gallery entrance, but the intruder might already be inside and stand on the concealed mat without moving the door. The specified event is localized floor loading rather than perimeter opening.

Ultrasonic motion detectors transmit sound above human hearing and assess changes in reflected waves or echo timing. They can monitor motion through a space, yet they do not inherently respond to a motionless person's weight on a floor mat. Their sensing mechanism is incompatible with the explicit pressure-based trigger, even if they could provide supplementary aisle detection.

A honeytoken is intentionally placed synthetic data, such as a fake API key, account value, or tracking token, whose access or use signals suspicious behavior. A token may sit on a server and complement a deception environment, so the idea is related. The stem describes one running decoy host with services and instrumentation, not a planted credential or data element; honeypot is the broader asset type required.

A honeynet consists of multiple interconnected honeypots or decoy systems arranged to observe behavior across network paths, including lateral movement. The attacker may interact with several apparent hosts rather than one target. Here the team has installed one isolated decoy server, without a network of related decoys; choosing honeynet would invent the additional components needed for that term.

A honeyfile is a bait document placed where unauthorized discovery, reading, or copying can generate a signal, such as a fake payroll file with an embedded access marker. It can be hosted by a honeypot, which explains the conceptual overlap. But the object being classified is the complete instrumented server and its services, not a specific file designed to trigger a document-access alert.

A honeypot is an instrumented decoy system or service that resembles a legitimate target and attracts unauthorized connections. The scenario contains no standalone decoy server or running service; it plants a fabricated access key in a repository. An intruder's attempt to use the key is the monitored event, so the deception artifact is a credential, not an entire host.

A honeynet is a collection of connected decoy assets or services intended to let defenders observe attacks across a simulated environment, including lateral movement. The planted access key is a single inert artifact and does not establish linked hosts or a network of decoys. Network-level deception would fit only if multiple instrumented systems had actually been deployed.

A honeyfile is a planted document containing fictitious but plausible information, often configured to alert when it is opened, moved or copied. A repository entry may look like a file, but the deception mechanism in this question is a fake cloud credential whose attempted use triggers monitoring. The meaningful distinction is credential-use telemetry rather than access to a fake document.