SY0-701 Security Architecture Practice Question
A team moved a Linux VM to IaaS. They need OS login events, process activity, and network flow metadata sent to one central platform for alerting. What is the best first step?
⚠ Common exam trap
Many exam-takers assume cloud providers automatically collect guest OS telemetry (like login events and process activity) when they only provide infrastructure-level logs (e.g., hypervisor or network flow logs), leading them to choose Option A or D incorrectly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy an endpoint logging agent and enable cloud-native flow logs to a centralized logging service.
Deploying an endpoint logging agent (e.g., auditd, osquery, or a SIEM agent) on the Linux VM captures OS login events and process activity at the guest level, while enabling cloud-native flow logs (e.g., AWS VPC Flow Logs, Azure NSG flow logs) provides network flow metadata. Sending both to a centralized logging service (e.g., AWS CloudWatch Logs, Azure Log Analytics, or a third-party SIEM) ensures all required telemetry is aggregated for alerting. This approach directly addresses the need for host-level and network-level visibility without relying on the cloud provider to collect guest OS internals.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable only perimeter security groups and assume the cloud provider will collect all host telemetry.
Why it's wrong here
Perimeter security groups filter network traffic at the instance/database boundary and do not inspect guest OS activity such as SSH or console logins. The cloud provider operates under a shared responsibility model: it supplies hypervisor and physical infrastructure telemetry, but the customer must enable and collect guest-level logs from the VM. Assuming provider-side host telemetry is collected for customer VMs ignores this boundary and leaves login events invisible.
- ✓
Deploy an endpoint logging agent and enable cloud-native flow logs to a centralized logging service.
Why this is correct
Deploying an endpoint logging agent on the VM captures systemd journal entries, /var/log/auth.log, and auditd records, yielding timestamps, usernames, source IPs, and session details for every login. Enabling cloud-native flow logs (e.g., VPC Flow Logs, Azure NSG flow logs) adds connection-level metadata, revealing failed auth traffic patterns and lateral movement. Sending both to a centralized logging service (CloudWatch Logs, Log Analytics, or a SIEM) supports real-time alerting, long-term retention, and efficient incident investigation.
- ✗
Store the VM snapshots in object storage and review them manually during incidents.
Why it's wrong here
VM snapshots in object storage are point-in-time disk images, not an event stream; they only capture state when a snapshot is triggered. Manually reviewing them during incidents provides no proactive alerting and makes correlating specific login attempts with timestamps difficult. They are useful for forensic recovery, but cannot replace continuous OS login telemetry.
- ✗
Rely on the hypervisor console and disable guest-level logging to reduce overhead.
Why it's wrong here
The hypervisor console provides out-of-band access to the VM's display, but it does not maintain an audit trail of guest-level authentication attempts beyond what the OS itself records. Disabling guest-level logging removes auth.log, journald, and auditd evidence, which is exactly where successful and failed login events are stored. Relying solely on the console also lacks the structured, queryable logs needed for automated detection and compliance reporting, so security operations lose all visibility into OS login activity.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.