SY0-701 Question 382
Single answerOther considerations: Complexity , Cost , Single point of failure , Technical debt , Ongoing supportabilityA mid-sized company is replacing its aging VPN solution. The security team proposes a highly customized design that chains multiple security tools together with custom scripts for authentication, logging, and access control. The design would meet the technical requirements, but only one senior engineer fully understands the implementation. The CFO is concerned about budget, and the operations team warns that future upgrades may break the custom integrations. Which concern should the security manager identify as the MOST significant long-term risk when evaluating this proposal?
- A
The solution introduces significant technical debt and ongoing supportability risks
- B
The solution eliminates single points of failure because it uses multiple tools
- C
The solution reduces complexity by distributing security functions across several platforms
- D
The solution is primarily a compliance issue because custom scripts are not allowed in secure environments
Show answer and explanation
Correct answer: A
Explanation
The best answer is the concern about technical debt and ongoing supportability. In Security+, candidates are expected to evaluate security solutions not just for immediate effectiveness, but also for operational sustainability. A design that relies heavily on custom code, undocumented integrations, or institutional knowledge may satisfy current security requirements while creating future risk through maintenance challenges, upgrade incompatibilities, and staff dependency. This also relates to complexity and potential single points of failure: if one person or one brittle script is essential to operations, resiliency suffers. Security best practices and common guidance from organizations such as NIST emphasize maintainability, documentation, configuration management, and reducing unnecessary complexity in secure system design. In practical terms, a more supportable and standardized solution is often preferable to a highly customized one, even if the custom solution appears technically capable in the short term.
- A. Correct.
Correct. The scenario highlights a design that works now but depends on custom integrations, specialized knowledge, and fragile upgrade paths. That is a classic example of technical debt: a short-term or highly tailored implementation that increases future maintenance burden, upgrade difficulty, and operational risk. Ongoing supportability is also a major concern because only one engineer understands the environment, making troubleshooting and lifecycle management difficult.
- B. Incorrect.
Incorrect. Using multiple tools does not automatically eliminate a single point of failure. In fact, if the workflow depends on custom scripts or one engineer's knowledge, the environment may introduce new operational single points of failure. More components can also increase failure domains rather than reduce them.
- C. Incorrect.
Incorrect. Distributing functions across several platforms usually increases complexity unless the architecture is deliberately simplified and well integrated. In this case, chaining multiple tools with custom scripts increases administrative overhead, troubleshooting difficulty, and the chance of integration failures.
- D. Incorrect.
Incorrect. This is not primarily a compliance issue. Many secure environments use custom scripts where properly governed, documented, and controlled. The bigger issue in the scenario is maintainability, lifecycle risk, and supportability over time, not an inherent prohibition on customization.