SY0-701 · Objective 4.4 · Security Operations
4.4 Alerting and monitoring explained
The official objective: “Explain security alerting and monitoring concepts and tools.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 4.4 covers
Objective 4.4 is about watching your environment and acting on what you see. It has three parts: what you monitor, the activities involved, and the tools that do the work.
Monitoring covers computing resources of every kind: systems, applications and infrastructure. Each produces logs and metrics that only become useful when collected and read.
The activities form a cycle. Log aggregation pulls logs from many sources into one place. Alerting raises a notification when something matches a rule. Scanning checks systems on a schedule. Reporting summarises what happened for people who need the bigger picture. Archiving keeps older data, often for compliance, after it leaves the fast searchable store. Alert response and remediation covers what happens after an alert: quarantine of a host or file, and alert tuning. Tuning is important on the exam. If a rule fires constantly on known, legitimate activity, such as a nightly backup job, analysts start ignoring it, which is how real attacks get missed. The fix is to refine the rule or add a narrowly scoped exception, not to switch it off.
The tools list is long. Security Content Automation Protocol (SCAP) gives standard formats for checking configurations and vulnerabilities, so different tools can read the same benchmark. Benchmarks such as those from CIS define good settings. Agents installed on systems collect detailed data; agentless monitoring uses existing protocols and installs nothing. A security information and event management (SIEM) system collects logs from many sources, normalises them and correlates events across them, which is what lets it spot a pattern like many failed logins on different servers followed by one success. Antivirus and data loss prevention watch for malware and for sensitive data leaving. SNMP traps are messages a device sends unprompted when something changes, such as an interface going down. NetFlow records who talked to whom, on which port, and how much data moved, without capturing contents. Vulnerability scanners find known weaknesses.
The exam often asks which tool fits a goal. Correlating events from many sources is a SIEM. Checking settings against a benchmark in a standard format is SCAP. Getting an immediate notice from a switch is an SNMP trap. Seeing traffic volumes between hosts without payloads is NetFlow.
What candidates mix up
- SIEM versus log aggregation: aggregation collects logs in one place; a SIEM also normalises, correlates and alerts.
- SNMP trap versus polling: a trap is pushed by the device when something happens; polling asks the device on a schedule.
- Tuning versus disabling: tuning keeps the detection while removing known benign triggers.
- NetFlow versus packet capture: NetFlow shows metadata about conversations; a packet capture holds the full contents.
Practice questions for 4.4
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
A security team wants an alert whenever one user account fails to log in on five different servers and then logs in successfully, all within two minutes. Which solution would generate this alert?
- AA SIEM correlation rule that evaluates aggregated logs from all servers within a time window
- BA host-based IDS on each server alerting when local failed logons exceed a threshold
- CA centralized syslog server that archives logs from every server for later searching
- DA domain account lockout policy that locks the account after five failed attempts
Show answer and explanation
Answer: A) A SIEM correlation rule that evaluates aggregated logs from all servers within a time window
Spotting a pattern that spans several hosts and a time window requires correlation across aggregated logs, which is the core job of a SIEM. Host-only tools, plain log storage, and lockout policies cannot raise this alert.
- ACorrect. A SIEM collects and normalizes logs from many sources and runs correlation or analytics rules over a set time window. That lets it spot a multi-step, multi-host pattern such as failed logins across systems followed by a success, and raise an alert.
- BIncorrect. A HIDS only sees events on its own host. One failure per server would never cross a local threshold, and no single agent can link failures on other servers to the later success.
- CIncorrect. Central log collection gathers the data but has no correlation rules or real-time alerting. Analysts would only find the pattern by searching by hand after it happened.
- DIncorrect. Account lockout is a preventive control that blocks further guessing. It does not detect or alert on a pattern of failures followed by a successful login.
Question 2
A SIEM rule that flags mass file reads fires hundreds of times a day. Each time, the trigger is the nightly backup job, which runs under a dedicated service account. Analysts have started skimming past these alerts. What is the BEST way to handle this?
- AAdd an exception to the rule that matches only the backup service account during its scheduled window
- BLower the rule's severity to informational so its alerts no longer page the on-call analysts
- CHave analysts review and manually close each backup alert as a false positive
- DReduce log ingestion from the file servers so the SIEM receives fewer file-access events
Show answer and explanation
Answer: A) Add an exception to the rule that matches only the backup service account during its scheduled window
When a known, legitimate process causes false positives, tune the detection with a narrowly scoped exception, for example a specific account and time window. That cuts noise and alert fatigue while keeping detection of real threats.
- AThis is tuning. A narrow exception that combines the known account with the expected time removes the false positives, and mass reads by any other account, or by this account at other times, still alert. Analysts can then trust the alerts again.
- BThe noisy alerts are still generated. Real mass-read activity caught by this rule would also be downgraded and easy to miss, so the alert fatigue and the detection gap both remain.
- CThis keeps the full alert volume and the analyst workload. Repeated manual closure is exactly what causes alert fatigue, so it does not address the root cause.
- DIngesting fewer logs removes visibility into real data theft from those servers. It trades a noise problem for a blind spot.
Question 3
A network switch immediately sends a message to the monitoring server when one of its interfaces goes down, without waiting to be polled. What is this message?
- AAn SNMP trap
- BA NetFlow record
- CA DMARC report
- DA CSR
Show answer and explanation
Answer: A) An SNMP trap
- ASNMP traps are unsolicited alerts sent by devices when significant events occur.
- BNetFlow summarizes traffic flows; it doesn't announce interface failures.
- CDMARC reports concern email authentication results.
- DA CSR requests a certificate from a CA.
Other Security Operations objectives
Also: the Security Operations domain page (28% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.