nerdexam
CompTIA

SY0-501 · Question #160

An application team is performing a load-balancing test for a critical application during off- hours and has requested access to the load balancer to review. Which servers are up without having the ad

The correct answer is C. Give the application team read-only access. The security analyst must balance operational access needs with the principle of least privilege to protect other critical applications on the shared load balancer.

Submitted by olafpl· Mar 4, 2026Security operations

Question

An application team is performing a load-balancing test for a critical application during off- hours and has requested access to the load balancer to review. Which servers are up without having the administrator on call. The security analyst is hesitant to give the application team full access due to other critical applications running on the road balancer. Which of the following is the BEST solution for the security analyst to process the request?

Options

  • AGive the following allowed Joe to install the ap off hours
  • BDisable other critical applications before granting the team access.
  • CGive the application team read-only access
  • DShare the account with the application team

How the community answered

(54 responses)
  • A
    4% (2)
  • B
    11% (6)
  • C
    78% (42)
  • D
    7% (4)

Why each option

The security analyst must balance operational access needs with the principle of least privilege to protect other critical applications on the shared load balancer.

AGive the following allowed Joe to install the ap off hours

This option is vague and nonsensical as written, and does not address the core security concern of limiting access scope on a shared load balancer.

BDisable other critical applications before granting the team access.

Disabling other critical applications to grant access introduces unnecessary downtime and business risk, violating the principle of availability and creating more harm than the original problem.

CGive the application team read-only accessCorrect

Granting read-only access follows the principle of least privilege, allowing the application team to view server status and load-balancing metrics without the ability to modify configurations affecting other critical applications. This satisfies the team's requirement to check which servers are up during testing while maintaining security boundaries. Read-only access is a standard role-based access control (RBAC) approach that limits the blast radius of any potential misuse or accidental change.

DShare the account with the application team

Sharing an account violates the principle of individual accountability and non-repudiation, as actions cannot be traced to a specific user, and it exposes credentials that could be misused or leaked.

Concept tested: Principle of least privilege and role-based access control

Source: https://www.nist.gov/privacy-framework/nist-sp-800-53

Topics

#least privilege#access control#load balancer#separation of duties

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice