SY0-701 Question 212
Single answerSelection of effective controlsA healthcare company stores patient records in a cloud-based application that is accessed by employees, contractors, and a small number of third-party billing partners. An internal audit found that several former contractors still had active accounts and that one shared service account had broad access to all patient records. Management wants a control that will most effectively reduce the risk of unauthorized access while also supporting compliance requirements for least privilege and accountability. Which control should the security team implement FIRST?
- A
Implement role-based access control (RBAC) with unique user accounts and a formal provisioning/deprovisioning process
- B
Deploy a network intrusion detection system (NIDS) to monitor traffic to the cloud application
- C
Require full-disk encryption on all employee laptops that access the application
- D
Conduct annual security awareness training focused on handling patient data
Show answer and explanation
Correct answer: A
Explanation
The best answer is to implement RBAC with unique accounts and a formal joiner-mover-leaver process. The scenario specifically identifies unauthorized access risk caused by stale accounts, shared credentials, and overly broad permissions. The most effective control is the one that directly addresses those root causes. In Security+ terms, this combines preventive and administrative controls: authorization through RBAC, identification through unique accounts, and account lifecycle management through provisioning/deprovisioning. These measures align with widely accepted best practices such as the principle of least privilege, separation of duties where appropriate, and accountability through individual user attribution. Guidance from NIST SP 800-53, including controls such as AC-2 (Account Management), AC-3 (Access Enforcement), and AC-6 (Least Privilege), supports selecting access governance controls in this type of scenario. In regulated environments such as healthcare, these controls also help support auditability and compliance expectations around controlling and tracking access to sensitive records.
- A. Correct.
Correct. RBAC maps access to job responsibilities, which directly supports least privilege by limiting users to only the records and functions needed for their roles. Replacing shared accounts with unique identities improves accountability and auditability because actions can be tied to a specific user. A formal provisioning and deprovisioning process addresses the audit finding about former contractors retaining access, making this the most effective first control for the stated risk.
- B. Incorrect.
Incorrect. A NIDS is a detective control that may help identify suspicious traffic patterns, but it does not directly fix excessive permissions, shared accounts, or delayed account removal. Someone might choose this because monitoring is important, but the problem described is primarily an access control weakness that requires a preventive identity and access management solution.
- C. Incorrect.
Incorrect. Full-disk encryption is valuable for protecting data at rest on endpoints if a laptop is lost or stolen, but it does not address inappropriate logical access within the cloud application. This option is plausible because healthcare data is sensitive, but the audit findings point to identity lifecycle management and authorization problems, not endpoint storage exposure.
- D. Incorrect.
Incorrect. Security awareness training is an administrative control that can improve user behavior, but it will not by itself remove former contractors' access or eliminate the risks created by shared accounts and excessive privileges. Candidates may select this because compliance programs often require training, but it is less effective than implementing direct technical and administrative access controls for the issue presented.