What Would Have Prevented the VPN Appliance Admin Login?
Given a scenario, apply common security techniques to computing resources.
Given a scenario, select mitigation techniques or controls to secure an enterprise environment.
The local administrator account for a company's VPN appliance was unexpectedly used to log in to the remote management interface. Which of the following would have most likely prevented this from happening?
Answer
Correct answer: B — Changing the VPN appliance's default local administrator password would have blocked the unexpected remote management login.
Community Votes
60% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This item tests default/factory credentials on network appliances, not general account hygiene — the trap is selecting least privilege (A) or individual user IDs (C), which change what a logged-in admin can do rather than whether the login succeeds at all.
A VPN appliance's local administrator account was used unexpectedly to reach its remote management interface, and the question asks which control would most likely have stopped it. The decisive factor is appliance hardening: changing the factory default local admin password removes the well-known credential the login depended on.
Many candidates choose A (least privilege) because restricting administrator rights sounds preventive, but the attacker already authenticated successfully as the local admin; least privilege only limits damage after login and never blocks a valid default credential.
Community Discussion (18 comments)
d4a5620
👍 21
idk if it's my ADHD or what but I had to re-read this question like 5 times and I still don't completely understand what they're asking lol
Shaman73
👍 8
B. Changing the default password
Linas312
👍 1
Selected: C
None really, the answer here is likely B, but in this scenario C is the only thing that makes sense as preventive action: A: irrelevant, admin should have access B: This presumes the admin is left with a default password which isnt stated.. the question worded doesn't say anything about misconfiguration, it can't just expect you to assume thats the case C: only preventive action, maybe if localadmin was USER10 , it can prevent the account from being a target. D. not preventive action If answer is B, it should be a different scenario or at least worded differently. nothing to say there was no configuration
MarysSon
👍 1
Selected: A
I’m sorry but B is possible, but it isn’t the obvious answer. There is no indication that the system’s default password was used or any nefarious activity occurred. Sometimes system administrators use their privileged accounts when their normal accounts will accomplish a specific task: in that case, A would be a better answer.
Anyio
👍 2
Selected: B
B. Changing the default password Explanation: Default administrator accounts often come with weak or widely known credentials, making them an easy target for attackers. Changing the default password to a strong, unique one is a fundamental security practice that would have likely prevented unauthorized access. Other Options: A. Using least privilege: This is important but doesn't address the issue if the default password is still in use. C. Assigning individual user IDs: While useful for tracking and accountability, it doesn't prevent unauthorized access if the default admin account remains active. D. Reviewing logs more frequently: Log reviews can help detect incidents but won't prevent them. Changing the default password directly addresses the vulnerability.
chavers93
👍 4
Selected: B
Keyword "unexpectedly" and "logged in". if expected it would be with privilege. But not known Somebody could have cracked an easy password. My choice is B
ProudFather
👍 1
Selected: C
C: By assigning individual user IDs, the company can track who is accessing the remote management interface and hold individuals accountable for their actions. This helps prevent unauthorized access and makes it easier to identify potential security threats.
fmeox567
👍 2
Selected: B
The most likely action that would have prevented the local administrator account from being used unexpectedly to log in to the remote management interface is: B. Changing the default password Here’s why: - Changing the default password: Many VPN appliances come with default usernames and passwords. If these are not changed, anyone with knowledge of the default credentials (which are often easily found online) can gain access to the appliance. Changing the default password to something strong and unique would make it much more difficult for unauthorized users to log in. - A. Using least privilege: While this is a good security practice, it typically refers to ensuring users have only the minimum level of access needed to perform their tasks. In the case of an administrator account being used, the issue is more likely related to the strength of the password rather than inappropriate access rights being assigned.
9ef4a35
👍 1
I will go for C, this will help to track the exact user that logged in
KelvinYau
👍 1
Selected: C
Nowadays, there are not much systems that allow you to log in with a default password. In 2024, the answer should be either A or C. The best option is to disable local admin accounts and assign individual users with least privilege. So C & A is correct
famuza77
👍 2
I would choose A
Ty13
👍 1
Selected: B
Answer is B. It's the local admin account. A and C wouldn't work here because those are talking specifically about non-local accounts. To put it another way, go check your home router - if it's old enough, there's like a 99% chance the default username/password is just admin/admin. It's hard-coded so if you ever physically reset the device then the creds will always default back.
Fhaddad81
👍 1
I will select C since its local administrator with default permission and should not be used remotely and best practice to assign individual user for each IT admin should manage this device
chasingsummer
👍 1
Selected: C
I think you need to have separate account for VPN and separate account for management. Option C makes the most sense; Assigning individual user IDs
420JhonnySins69
👍 3
Selected: A
I'm just want to vote for A, because it seems the most reasonable.
internslayer
👍 2
This is why I hate Sec+ questions. It should be assumed that part of assigning individual user accounts would be to disable a shared local admin account. Using shared accounts is bad practice!!
dbrowndiver
👍 3
Selected: B
Many devices and applications come with default administrator credentials that are intended to be changed immediately after installation. Failure to change these passwords leaves systems vulnerable to unauthorized access. By changing the default password for the local administrator account, the company would significantly reduce the risk of unauthorized access. Attackers often attempt to use default credentials to gain entry, so ensuring these are changed is a fundamental security practice.
c80f5c5
👍 3
i guess you could assume both administrative accounts have the same default login
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The stem says the built-in local administrator account of the VPN appliance was used "unexpectedly" — nobody authorized that session — which is the classic signature of factory default credentials on a network device. Appliances ship with known admin usernames and passwords, so an attacker who knows them logs straight into the remote management interface with no cracking required. Changing the default password (and disabling unused default accounts) on the local administrator account is the only option listed that removes the very credential that made the login possible. That is why B is the preventive control CompTIA expects here: the attack never gets off the ground once the factory password is gone.Why the Other Options Are Wrong
A (least privilege) governs what an authenticated principal can do after login, so an attacker holding valid local admin credentials still gets in — it reduces impact, not access. C (assigning individual user IDs) is strong account hygiene, but the scenario already states the local administrator account was used, and that built-in account survives unless its password is changed or the account is disabled; nothing in the stem says the local admin account was removed. D (reviewing logs more frequently) is purely detective — reviewing logs sooner might have detected the intrusion earlier, but it cannot stop the login from happening. Only B directly addresses the known/default credential that made the unexpected remote management session possible.Community Comment Notes
Roughly 60 learners voted for B and several spelled out the reasoning; Anyio noted that default administrator accounts "often come with weak or widely known credentials," and dbrowndiver observed that devices "come with default administrator credentials" meant to be changed right after installation. chavers93 keyed on the words "unexpectedly" and "logged in" to argue that someone simply used an easy password, and c80f5c5 suggested assuming the appliance shares the same factory login. Dissent exists: 420JhonnySins69 said they "just want to vote for A" without a security rationale, while Linas312 called C "only preventive action" and objected that the stem never says the password was default. internslayer raised the sharpest critique — assigning individual accounts should include disabling the shared local admin — which is exactly why the wording matters, and one commenter admitted re-reading the question five times before understanding it.Exam Strategy
When a stem describes an account or interface being accessed "unexpectedly," ask how the attacker obtained valid credentials before looking at access-restriction options — on appliances, default credentials are the go-to SY0-701 answer. Also classify the options as preventive versus detective, and eliminate detective choices like log review automatically.Official Reference
Exam Strategy
When an appliance or interface is entered unexpectedly, ask how valid credentials were obtained — factory default admin passwords are the standard SY0-701 explanation. Sort the four options into preventive (password change, least privilege applied pre-access) versus detective (log review) and drop the detective ones immediately.
Frequently Asked Questions
Why is assigning individual user IDs (C) not the preventive control here?
It removes shared accounts, but the appliance's built-in local admin account still exists with its factory password. Only changing that password or disabling the account stops a known-credential login.
Doesn't least privilege (A) limit the damage of a default admin login?
It limits what the session can do afterwards, but it does not stop the authentication itself — and a local admin account usually has full control of the appliance anyway.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →