Security+ SY0-701 Domain 4: Security Operations — 14 practice questions with answers

Domain 4 is 28% of the CompTIA Security+ (SY0-701) exam, which works out to roughly 25of the up to 90 questions on the real test. Below are study notes for the domain's objectives, then every question from our free Security+ SY0-701 practice test that targets this domain, with the correct answer and the reasoning behind it. Try to answer each one before reading the explanation.

Objectives in this domain

• 4.1 Given a scenario, apply common security techniques to computing resources
• 4.2 Explain the security implications of proper hardware, software, and data asset management
• 4.3 Explain various activities associated with vulnerability management
• 4.4 Explain security alerting and monitoring concepts and tools
• 4.5 Given a scenario, modify enterprise capabilities to enhance security
• 4.6 Given a scenario, implement and maintain identity and access management
• 4.7 Explain the importance of automation and orchestration related to secure operations
• 4.8 Explain appropriate incident response activities
• 4.9 Given a scenario, use data sources to support an investigation

What to focus on

At 28% this is the largest domain and the one where hands-on experience shows most. It covers the daily work of a security team: hardening endpoints, mobile devices and wireless networks, tracking assets from acquisition to disposal (including sanitization versus destruction), and running a vulnerability programme from scanning and prioritisation (CVSS, exposure, environment) through remediation and rescanning.

Monitoring questions expect you to know what each tool sees. A SIEM correlates logs from many sources; EDR and XDR watch endpoint behaviour; DLP watches data leaving; NAC decides whether a device may join the network; SNMP traps, NetFlow and packet captures each answer a different question. Identity and access management (4.6) covers provisioning, SSO and federation (SAML, OAuth, OpenID Connect), MFA factors, privileged access management, and access models such as RBAC, ABAC and mandatory access control.

Incident response (4.8) follows a fixed order: preparation, detection, analysis, containment, eradication, recovery and lessons learned. Questions often hinge on which step comes next, or on forensic duties such as legal hold, chain of custody and order of volatility. Objective 4.9 then asks which log or data source would answer a specific investigative question.

Practice questions and explanations

1. 1. A security team monitors network traffic and system logs to identify potential security incidents. Which tool aggregates logs from multiple sources for analysis?

   1. A) IDS (Intrusion Detection System)
   2. B) SIEM (Security Information and Event Management)
   3. C) DLP (Data Loss Prevention)
   4. D) NAC (Network Access Control)

   Answer: B — SIEM (Security Information and Event Management)

   A SIEM collects, aggregates, and analyzes log data from multiple sources across the organization's IT infrastructure. It provides real-time monitoring, correlation of events, alerting, and reporting, enabling security teams to detect and respond to potential security incidents effectively.

2. 2. During an incident response, what is the primary goal of the containment phase?

   1. A) To identify the root cause of the incident
   2. B) To limit the scope and impact of the incident
   3. C) To restore systems to normal operation
   4. D) To document lessons learned

   Answer: B — To limit the scope and impact of the incident

   The containment phase of incident response focuses on limiting the scope and impact of a security incident. This may involve isolating affected systems, blocking malicious IP addresses, disabling compromised accounts, or segmenting network traffic to prevent the incident from spreading.

3. 3. Which type of vulnerability scan is performed with valid credentials to provide the most comprehensive results?

   1. A) External scan
   2. B) Credentialed (authenticated) scan
   3. C) Passive scan
   4. D) Discovery scan

   Answer: B — Credentialed (authenticated) scan

   A credentialed (authenticated) scan uses valid login credentials to log into target systems, providing deeper visibility into the system's configuration, installed software, patches, and security settings. This produces more accurate and comprehensive results than non-credentialed scans, which can only assess externally visible vulnerabilities.

4. 4. A company wants to ensure that deleted data cannot be recovered from decommissioned hard drives. Which method should they use?

   1. A) Formatting the drive
   2. B) Degaussing or physical destruction
   3. C) Deleting the partition table
   4. D) Encrypting the drive after deletion

   Answer: B — Degaussing or physical destruction

   Degaussing (using a strong magnetic field to erase data) or physical destruction (shredding, crushing, or incinerating) are the most reliable methods for ensuring data cannot be recovered. Simple formatting or deleting partitions does not actually remove the data from the disk platters and can be recovered with forensic tools. Note that degaussing only works on magnetic media: it does nothing to an SSD or flash drive, which needs cryptographic erase, a vendor secure-erase command or physical destruction.

5. 5. Which of the following is a key benefit of implementing automation in security operations?

   1. A) Eliminating the need for security analysts
   2. B) Reducing response time to security events and minimizing human error
   3. C) Replacing all manual security processes
   4. D) Guaranteeing zero false positives

   Answer: B — Reducing response time to security events and minimizing human error

   Security automation reduces response time by automatically executing predefined actions for common security events, and minimizes human error in repetitive tasks. SOAR (Security Orchestration, Automation, and Response) platforms help automate incident response playbooks, but human analysts are still needed for complex decision-making.

6. 6. An organization implements a system that monitors endpoint behavior and can automatically isolate a compromised device. What type of solution is this?

   1. A) Antivirus software
   2. B) EDR (Endpoint Detection and Response)
   3. C) Firewall
   4. D) VLAN

   Answer: B — EDR (Endpoint Detection and Response)

   EDR (Endpoint Detection and Response) solutions continuously monitor endpoint activities, detect suspicious behaviors, and can automatically respond to threats by isolating devices, killing malicious processes, or rolling back changes. Unlike traditional antivirus, EDR focuses on behavior-based detection and automated response.

7. 7. During a forensic investigation, what is the correct order for handling digital evidence?

   1. A) Analyze, collect, preserve, document
   2. B) Identify, preserve, collect, analyze, report
   3. C) Collect, analyze, report, preserve
   4. D) Document, analyze, collect, destroy

   Answer: B — Identify, preserve, collect, analyze, report

   The proper order for digital forensics follows the chain: Identify (recognize potential evidence), Preserve (protect evidence from alteration), Collect (gather evidence using forensic methods), Analyze (examine evidence), and Report (document findings). Maintaining chain of custody throughout is critical for legal admissibility.

8. 8. Which log source would be MOST useful for investigating unauthorized access to a web application?

   1. A) DHCP server logs
   2. B) Web server access logs and application logs
   3. C) Print server logs
   4. D) NTP server logs

   Answer: B — Web server access logs and application logs

   Web server access logs record all HTTP requests including source IPs, requested URLs, response codes, and timestamps. Application logs record authentication attempts, errors, and application-specific events. Together, they provide the most relevant information for investigating unauthorized web application access.

9. 9. What is the primary purpose of a honeypot in network security?

   1. A) To store sensitive data securely
   2. B) To attract and detect attackers by simulating vulnerable systems
   3. C) To encrypt network traffic
   4. D) To balance network load across servers

   Answer: B — To attract and detect attackers by simulating vulnerable systems

   A honeypot is a decoy system designed to attract attackers and study their techniques. It appears as a legitimate, vulnerable target but is actually monitored and isolated. Honeypots help security teams detect attacks, gather threat intelligence, and understand attacker behavior without risking production systems.

10. 10. An administrator wants to ensure that only approved devices can connect to the corporate network. Which technology should be implemented?

    1. A) DLP
    2. B) NAC (Network Access Control)
    3. C) VPN
    4. D) WAF

    Answer: B — NAC (Network Access Control)

    Network Access Control (NAC) enforces security policies for devices attempting to connect to the network. It can check device health, compliance status, authentication credentials, and other attributes before granting network access. Non-compliant devices can be quarantined or denied access.

11. 11. Which backup strategy involves copying only the data that has changed since the last full backup?

    1. A) Full backup
    2. B) Differential backup
    3. C) Snapshot backup
    4. D) Mirror backup

    Answer: B — Differential backup

    A differential backup copies all data that has changed since the last full backup. Each differential backup grows larger as more changes accumulate. To restore, you need only the last full backup plus the latest differential backup. This differs from incremental backups, which copy only changes since the last backup of any type.

12. 12. A security analyst receives an alert about unusual outbound traffic to a foreign IP address at 3 AM. Which is the BEST first response action?

    1. A) Immediately shut down all network connections
    2. B) Investigate the traffic to determine if it is malicious and identify the source
    3. C) Ignore the alert as it's likely a false positive
    4. D) Reformat the machine generating the traffic

    Answer: B — Investigate the traffic to determine if it is malicious and identify the source

    The best first response is to investigate and triage the alert to determine if the traffic is malicious. This includes identifying the source host, analyzing the traffic content, checking for IOCs (Indicators of Compromise), and determining the scope of the potential incident before taking containment actions.

13. 13. Which of the following is a PRIMARY benefit of using infrastructure as code (IaC) from a security perspective?

    1. A) It eliminates the need for security monitoring
    2. B) It enables consistent, repeatable, and auditable infrastructure deployments
    3. C) It makes systems immune to cyber attacks
    4. D) It removes the need for access controls

    Answer: B — It enables consistent, repeatable, and auditable infrastructure deployments

    Infrastructure as Code (IaC) allows infrastructure configurations to be version-controlled, reviewed, tested, and deployed consistently. From a security perspective, this ensures repeatable deployments with known-good configurations, enables automated compliance scanning, and provides audit trails for all infrastructure changes.

14. 14. What is the purpose of a tabletop exercise in security operations?

    1. A) To test the physical security of data center tables
    2. B) To walk through a simulated incident scenario to evaluate response procedures
    3. C) To inventory all IT assets on employees' desks
    4. D) To practice installing security software manually

    Answer: B — To walk through a simulated incident scenario to evaluate response procedures

    A tabletop exercise is a discussion-based exercise where team members walk through a simulated incident scenario to evaluate and improve incident response plans, communication procedures, and decision-making processes. It does not involve actual system changes but helps identify gaps in procedures and training.

Reading answers is not the same as recalling them. When you have worked through every domain, take the timed Security+ SY0-701 practice test: it shuffles the questions and options and scores you by domain, so you can see whether this one still needs work.