nerdexam
CompTIA

SY0-501 · Question #527

A company stores highly sensitive data files used by the accounting system on a server file share. The accounting system uses a service account named accounting-svc to access the file share. The…

The correct answer is A. Exploitation of local console access and removal of data. Despite full disk encryption and restrictive file/share permissions, the data remains vulnerable to exploitation through local console access, which can lead to privilege escalation and unauthorized data removal.

Submitted by femi9· Mar 4, 2026Threats, vulnerabilities, and mitigations

Question

A company stores highly sensitive data files used by the accounting system on a server file share. The accounting system uses a service account named accounting-svc to access the file share. The data is protected will a full disk encryption, and the permissions are set as follows:

File system permissions: Users = Read Only Share permission: accounting-svc = Read Only Given the listed protections are in place and unchanged, to which of the following risks is the data still subject?

Options

  • AExploitation of local console access and removal of data
  • BTheft of physical hard drives and a breach of confidentiality
  • CRemote exfiltration of data using domain credentials
  • DDisclosure of sensitive data to third parties due to excessive share permissions

How the community answered

(43 responses)
  • A
    72% (31)
  • B
    14% (6)
  • C
    9% (4)
  • D
    5% (2)

Why each option

Despite full disk encryption and restrictive file/share permissions, the data remains vulnerable to exploitation through local console access, which can lead to privilege escalation and unauthorized data removal.

AExploitation of local console access and removal of dataCorrect

Full disk encryption protects data at rest, but once the system is booted and an attacker gains local console access, the disk is decrypted. With local console access, an attacker can often exploit system vulnerabilities to escalate privileges, bypass existing file system permissions, and then remove the sensitive data, compromising its integrity and availability.

BTheft of physical hard drives and a breach of confidentiality

Full disk encryption is explicitly stated as being in place, which directly mitigates the risk of data confidentiality breaches if physical hard drives are stolen while the system is powered off.

CRemote exfiltration of data using domain credentials

While remote exfiltration is possible if `accounting-svc` credentials (which have read-only access) are compromised, the question highlights 'removal of data' as a risk, which is an integrity/availability concern, and local console access offers a more direct path to bypass security controls for such an action.

DDisclosure of sensitive data to third parties due to excessive share permissions

The listed permissions, 'Users = Read Only' for file system and 'accounting-svc = Read Only' for share permissions, are restrictive and do not represent excessive share permissions that would lead to unintended disclosure.

Concept tested: Local system security and privilege escalation risks

Source: https://learn.microsoft.com/en-us/compliance/regulatory/auditing/securing-your-windows-server

Topics

#full disk encryption#local console access#data protection#access controls

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-501 Practice