SY0-701 Security Architecture Practice Question
A company wants visibility into who changed settings in its cloud account and what commands ran on a cloud VM. Which two log sources should the team enable first? Select two.
⚠ Common exam trap
Watch out — candidates often confuse guest OS logs with hypervisor logs or assume cloud provider logs alone are sufficient, missing that VM-level command execution requires OS-level logging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud provider audit or API logs
Cloud provider audit or API logs (Option A) capture all changes made to the cloud account via the provider's management plane, including who modified settings and when. Guest operating system event logs (Option B) record commands executed within the VM itself, such as PowerShell or bash commands, providing visibility into runtime activities. Together, these two sources cover both the control plane (account-level changes) and data plane (VM-level commands) for comprehensive monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cloud provider audit or API logs
Why this is correct
Cloud provider audit or API logs (e.g., AWS CloudTrail, Azure Activity Log, Google Cloud Audit Logs) are the authoritative record of control-plane operations. Every API call that creates, modifies, or deletes a cloud resource is captured with the identity of the caller, source IP, timestamp, and request parameters. These logs are essential for determining exactly who changed security group rules, IAM policies, or other configuration settings, and they are tamper-evident by design when enabled with integrity validation or log file validation.
- ✓
Guest operating system event logs
Why this is correct
Guest operating system event logs reside inside the virtual machine and record local activity such as user logon/logoff attempts, service startup or failure, process execution, and modifications to system files. While cloud audit logs show the API call that launched a VM or changed its role, OS event logs reveal what commands were run on the host, what scripts executed, and whether a local account was created or modified. They are critical for forensic analysis of actions that occur after the cloud control plane is no longer involved, such as inside a compromised instance.
- ✗
Printer spooler logs
Why it's wrong here
Printer spooler logs capture print job metadata, spooler service errors, and driver load events on hosts with attached printers. These logs are entirely local to the print subsystem and do not contain any records of cloud control-plane API calls, IAM policy changes, or command execution within virtual machines. They would be irrelevant in an investigation of cloud configuration changes unless the question specifically concerned printing activity on a particular host, which is not the case here.
- ✗
Browser history from employees' home PCs
Why it's wrong here
Browser history from employees' home PCs is non-authoritative, outside corporate logging scope, and easily cleared or manipulated. Even if it showed visits to the cloud provider's web console, it would not record the underlying API parameters, the exact configuration change made, or the authenticated context beyond a possible URL fragment. Forensic investigations rely on server-side audit logs that cannot be altered by the user, not on client-side browsing artifacts that lack integrity and chain of custody.
- ✗
DHCP lease logs from the office router
Why it's wrong here
DHCP lease logs from the office router record which IP address was assigned to a given MAC address and for what period. While they might help correlate a device's IP at a specific time, they contain no information about cloud account activity, control-plane API calls, or commands executed inside a virtual machine. The logs are also limited to the local network segment and do not extend to cloud-hosted services, making them useless for this requirement.
Go deeper
Related to this question
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.