SY0-701 Security Architecture Practice Question
A company moved an internal application to a cloud virtual machine. The security team wants operating system login events, process activity, and network flow metadata to be available in the SIEM for investigations. Which action best supports that goal?
⚠ Common exam trap
Many candidates think cloud provider dashboards or encryption are sufficient for security monitoring, but they fail to recognize that the specific data types required (OS events and network flows) must be explicitly enabled and forwarded from the guest OS and network layer, not inferred from provider-level metrics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable guest OS audit logging and cloud-native flow logs, then forward the data to the SIEM.
It directly addresses the requirement to collect operating system login events, process activity, and network flow metadata. Enabling guest OS audit logging (e.g., via Windows Event Log or syslog) captures login and process events, while cloud-native flow logs (e.g., AWS VPC Flow Logs or Azure NSG flow logs) provide network flow metadata. Forwarding both data streams to the SIEM ensures centralized visibility for investigations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rely only on the cloud provider's service health dashboard and billing alerts.
Why it's wrong here
The service health dashboard and billing alerts are operational and cost-monitoring tools, not security telemetry. They may indicate an outage or unexpected spend, but they cannot reveal a compromise inside a virtual machine, such as unauthorized logons, process execution, or data exfiltration. Without host audit logs or network flow logs, a security analyst has no evidence to investigate a suspected breach or to meet forensic requirements.
- ✓
Enable guest OS audit logging and cloud-native flow logs, then forward the data to the SIEM.
Why this is correct
This combines host-level visibility with cloud network telemetry. Audit logs capture logons and system activity inside the virtual machine, while flow logs show network connections. Forwarding both to a SIEM gives analysts the context needed to correlate suspicious behavior across layers.
- ✗
Encrypt the virtual machine disks and disable all logging to reduce exposure.
Why it's wrong here
Encrypting VM disks protects data at rest from physical theft, but it does nothing to detect or prevent an active intrusion. Disabling all logging is especially dangerous because it strips away the very evidence needed for incident detection, investigation, and post-incident forensics. In fact, modern compliance frameworks and security best practices require logging to be enabled, so turning it off actually increases exposure by creating an untraceable environment for attackers.
- ✗
Install only a web application firewall because that covers server log collection.
Why it's wrong here
A web application firewall only inspects inbound web traffic to the application, leaving other network protocols, internal lateral movement, and guest OS activity completely invisible. It does not capture operating system audit logs, user logon events, or outbound connections from the VM, all of which are critical for detecting a compromised workload. Cloud-native flow logs complement a WAF by recording metadata about every network conversation, while guest OS audit logging provides the host-level evidence needed to confirm a breach.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.