SY0-701 Security Operations Practice Question
A security analyst notices repeated attempts to copy large amounts of data to USB drives from a user's workstation. The analyst suspects the user may be exfiltrating company proprietary data. The company wants to implement a technical control that can both detect and block such data exfiltration without completely disabling all USB ports, as some users require USB for authorized work. Which of the following would best meet this requirement?
⚠ Common exam trap
A common mix-up: candidates confuse detection-only controls (like HIDS alerts) with prevention controls, or they assume encryption (BitLocker) can stop data exfiltration, when in fact encryption only protects data at rest and does not prevent copying from the host.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a data loss prevention (DLP) agent configured with rules to monitor and block unauthorized data transfers to removable media.
A Data Loss Prevention (DLP) agent can be configured with granular rules to monitor and block unauthorized data transfers to removable media (e.g., USB drives) based on content inspection, file type, or volume thresholds. This allows authorized USB usage while preventing exfiltration of proprietary data, meeting the requirement for both detection and blocking without disabling all USB ports.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a host-based intrusion detection system (HIDS) that alerts on USB insertion events.
Why it's wrong here
A host-based intrusion detection system (HIDS) such as OSSEC or Tripwire can monitor USB insertion events by parsing Windows event logs or syslog entries, but it operates in a purely passive, alert-only mode. It cannot inspect the actual data being written to the removable media, nor can it stop a user from copying sensitive files in real time—it only generates a notification after the fact. This leaves a window for exfiltration to succeed, and the requirement explicitly calls for both detection and blocking, which a HIDS does not provide.
When this WOULD be correct
If the requirement was only to detect and alert on USB usage events (e.g., for auditing or forensic purposes) without needing to block data transfers, a HIDS would be appropriate.
- ✓
Deploy a data loss prevention (DLP) agent configured with rules to monitor and block unauthorized data transfers to removable media.
Why this is correct
A DLP agent can inspect data in real time, apply policies to classify sensitive content, and block transfers that violate company rules. This meets the need to both detect and block exfiltration while still permitting authorized USB use.
- ✗
Enable BitLocker encryption on all USB drives to prevent unauthorized data access.
Why it's wrong here
BitLocker encrypts the contents of USB drives, protecting data if the drive is lost or stolen. However, it does not prevent data from being copied to the drive in the first place, so it does not address the exfiltration problem.
When this WOULD be correct
A question where the requirement is to protect sensitive data on USB drives from unauthorized access if the drive is lost or stolen, and the control is a preventive encryption measure, not detection or blocking of data transfers.
- ✗
Configure the local group policy to disable all USB ports on all workstations.
Why it's wrong here
Configuring local group policy to disable all USB ports via Administrative Templates > System > Removable Storage Access would create a blanket prohibition across every workstation, blocking even sanctioned business use of USB drives. This approach fails the requirement to preserve legitimate USB workflows for authorized users, and it lacks any data-aware inspection—so it cannot differentiate sensitive files from benign ones or log what was attempted. Additionally, applying such a policy locally requires domain-level GPO changes and may inadvertently disable boot devices or other necessary peripherals, making it an inflexible, all-or-nothing control.
When this WOULD be correct
In a scenario where the organization has no need for USB devices and wants to completely eliminate the risk of USB-based data exfiltration or malware introduction, disabling all USB ports via group policy is a straightforward and effective technical control.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Deploy a data loss prevention (DLP) agent configured with rules to monitor and block unauthorized data transfers to removable media.Correct answer▾
Why this is correct
A DLP agent can inspect data in real time, apply policies to classify sensitive content, and block transfers that violate company rules. This meets the need to both detect and block exfiltration while still permitting authorized USB use.
✗Implement a host-based intrusion detection system (HIDS) that alerts on USB insertion events.Wrong answer — click to see why▾
Why this is wrong here
A HIDS alerts on USB insertion but does not block data transfers; it only detects, not prevents, exfiltration.
★ When this WOULD be the correct answer
If the requirement was only to detect and alert on USB usage events (e.g., for auditing or forensic purposes) without needing to block data transfers, a HIDS would be appropriate.
Why candidates choose this
Candidates may confuse detection with prevention, or think that alerting on USB insertion is sufficient to stop exfiltration.
✗Enable BitLocker encryption on all USB drives to prevent unauthorized data access.Wrong answer — click to see why▾
Why this is wrong here
BitLocker encryption protects data at rest by encrypting the USB drive, but it does not monitor or block the act of copying data to the drive. It cannot detect or prevent exfiltration because the user can still copy data to an encrypted drive.
★ When this WOULD be the correct answer
A question where the requirement is to protect sensitive data on USB drives from unauthorized access if the drive is lost or stolen, and the control is a preventive encryption measure, not detection or blocking of data transfers.
Why candidates choose this
Candidates may confuse encryption with data loss prevention, thinking that encrypting the drive prevents unauthorized copying, but encryption only secures data after it is written, not the act of writing.
✗Configure the local group policy to disable all USB ports on all workstations.Wrong answer — click to see why▾
Why this is wrong here
Disabling all USB ports prevents all USB use, including authorized work, which contradicts the requirement to allow some users to use USB for legitimate purposes.
★ When this WOULD be the correct answer
In a scenario where the organization has no need for USB devices and wants to completely eliminate the risk of USB-based data exfiltration or malware introduction, disabling all USB ports via group policy is a straightforward and effective technical control.
Why candidates choose this
Candidates may think that disabling USB ports is the simplest way to stop data exfiltration, overlooking the need to allow authorized USB usage as specified in the question.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Endpoint Detection and Response (EDR)
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Data Loss Prevention
Data Loss Prevention (DLP) is a set of tools and processes that help organizations stop sensitive information from being shared, leaked, or stolen, whether accidentally or on purpose.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.