Security+ authentication factors and least privilege
A password is something known; a physical security key is something possessed. Two passwords do not create two factor categories. Authentication establishes identity, while authorization determines what that identity may do. Least privilege and time-limited elevation reduce exposure after sign-in. The strength of MFA also depends on the method: some mechanisms are better at resisting phishing than others.
How to read the scenario
Do not treat successful authentication as permission for every action. Evaluate the account role, resource, task, and duration of access.
Identify the required outcome, the evidence already provided, and the limits on the technician’s action. Compare every option against those details before deciding. Record why the closest alternative does not meet the stated need.
Original practice example
A privileged maintenance task is authorized for one hour. Which TWO controls best limit unnecessary standing access? Select TWO.
- Share one administrator password across the team.
- Automatically expire the elevation after the task window.
- Grant just-in-time elevation.
- Permanently add the user to every admin group.
Show the answer and explanation
Automatically expire the elevation after the task window.; Grant just-in-time elevation.
Time-limited elevation grants required privilege for the task and removes it afterward, reducing standing exposure.
Study questions
Which objective does this guide support?
SY0-701, objective 4.6. This independent guide supports original practice and does not replace the full official objectives.
What should I watch for in a scenario?
Do not treat successful authentication as permission for every action. Evaluate the account role, resource, task, and duration of access.
Source and version
CompTIA official SY0-701 objectives, objective 4.6. Verified November 5, 2026. This guide targets SY0-701. SY0-801 is expected around November 17, 2026 and is outside this edition.