SY0-701 Question 407
Single answerStandards: Password , Access control , Physical security , EncryptionA healthcare company is updating security controls for a records room that stores paper files and a workstation used to access patient data. To meet compliance requirements, the security administrator must align with common security standards for password management, access control, physical security, and encryption. Which action BEST addresses these requirements with the most appropriate combination of controls?
- A
Require shared passwords for the records staff, keep the records room locked during business hours only, and rely on HTTPS alone to protect all patient data
- B
Implement unique user accounts with a strong password policy, restrict records room entry using badge access with audit logs, and enable full-disk encryption on the workstation
- C
Allow staff to write complex passwords on paper if stored in unlocked desk drawers, use a mechanical key with no entry tracking for the records room, and encrypt only emailed patient records
- D
Use biometric access for the records room, disable passwords on the workstation to reduce lockouts, and depend on the building's front-door lock for physical security
Show answer and explanation
Correct answer: B
Explanation
The best answer is Option 2 because it applies defense in depth across the required domains: password standards, access control, physical security, and encryption. Unique user accounts and strong password policies support core access control principles such as identification, authentication, and accountability. Physical entry controls like badge systems with audit logs are stronger than simple locks because they help enforce least privilege and provide evidence for investigations. Full-disk encryption protects data at rest on the workstation, which is especially important for regulated information such as patient records. This approach is consistent with common security guidance found in NIST publications such as NIST SP 800-63 for digital identity considerations and NIST SP 800-53 controls related to access enforcement, audit logging, and media protection. It also aligns with the broader expectation in regulated environments that sensitive data be protected both physically and logically, with layered controls rather than a single safeguard.
- A. Incorrect.
This is incorrect because shared passwords violate accountability and non-repudiation principles. Security standards and best practices require unique identities so actions can be traced to specific users. Locking the records room only during business hours is insufficient because unauthorized internal access can still occur. HTTPS protects data in transit for web sessions, but it does not replace encryption at rest such as full-disk encryption on endpoints storing sensitive data.
- B. Correct.
This is correct because it combines appropriate administrative, logical, physical, and technical controls. Unique user accounts with a strong password policy support identification, authentication, and accountability. Badge access with audit logs enforces physical access control and provides a record of entry attempts. Full-disk encryption protects patient data at rest on the workstation if the device is stolen or improperly accessed. This combination aligns well with common requirements reflected in frameworks and regulations that emphasize least privilege, access logging, and protection of sensitive data.
- C. Incorrect.
This is incorrect because writing passwords on paper and storing them in unlocked drawers weakens password security and increases the risk of compromise. A mechanical key without entry tracking may provide basic physical restriction, but it lacks auditing and does not support stronger access control oversight. Encrypting only emailed records addresses only a limited data-in-transit scenario and leaves local stored data insufficiently protected.
- D. Incorrect.
This is incorrect because biometric access can be a valid physical security control, but disabling passwords on the workstation removes a critical authentication layer and is not an acceptable tradeoff. Relying only on the building's front-door lock is too broad and does not provide layered physical security for a sensitive records room. Standards and best practices favor defense in depth, not substituting one control while eliminating another essential control.