SY0-701 Security Architecture Practice Question
A team manages virtual machines in a public cloud and wants an audit trail of who created instances, changed security groups, and modified IAM settings. What should be enabled first?
⚠ Common exam trap
A common mix-up: candidates confuse guest OS-level controls (antivirus, screen saver) with cloud provider-level audit logging, leading candidates to pick a security tool that addresses a different threat surface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud control plane or audit logging.
Cloud control plane or audit logging (e.g., AWS CloudTrail, Azure Monitor, or Google Cloud Audit Logs) captures all API calls that create instances, modify security groups, or change IAM settings. This provides the required audit trail of who performed each action, when, and from what source, which is essential for security incident response and compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Host-based antivirus on each virtual machine.
Why it's wrong here
Host-based antivirus (AV) on each VM detects and remediates malware within the guest OS by scanning file signatures and monitoring process behavior, but it has no visibility into the cloud provider's control plane. It cannot record management actions such as VM power-state changes, security-group modifications, or IAM role updates, because those events occur in the cloud API layer outside the guest. Therefore, AV is a data-plane safeguard and does not satisfy the requirement for an administrative audit trail.
- ✓
Cloud control plane or audit logging.
Why this is correct
This is the best answer because audit logs record management actions such as instance creation, security group changes, and IAM updates. Those events are central to cloud investigations and change tracking. Enabling cloud-native logging first gives the team visibility into who did what and when, which is essential for security monitoring and accountability.
- ✗
A guest operating system screen saver policy.
Why it's wrong here
A guest OS screen saver policy—such as locking the console after a timeout—is a local endpoint control designed to prevent unauthorized interactive access to the VM's desktop. It does not generate logs of cloud management operations like instance launches, VPC peering, or identity policy changes, and it operates entirely within the guest session. Since the team's objective is to track who performed cloud-level changes, this policy provides no relevant audit data and cannot support security investigations.
- ✗
A static public IP address for every virtual machine.
Why it's wrong here
Assigning a static public IP address to every VM gives each instance a fixed, externally reachable address, but it creates no record of administrative actions or configuration changes. It also enlarges the attack surface by ensuring the VMs remain continuously exposed to the internet, which may require additional perimeter controls. Static IPs are a network addressing choice, not a logging mechanism, and thus they fail to provide the required visibility into management-plane activity.
Go deeper
Related to this question
Learn chapter
Cloud Security Fundamentals
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.