SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  IDS, because it alerts on suspicious traffic without affecting application delivery.

  Why it's wrong here

  A network-based IDS monitors a mirrored copy of traffic through a SPAN port or TAP and raises alerts when it matches attack signatures, but it is a passive device that cannot drop or modify the packets it inspects. Because it is usually out-of-band, it does not sit in the request path to the customer portal, so an exploit could succeed before an analyst even reads the alert. Even inline IPS versions typically lack the deep HTTP parsing needed to catch web-specific obfuscation, making IDS a monitoring aid rather than a protective security control for application delivery.

• ✓

  WAF, because it understands web requests and can block malicious application-layer traffic.

  Why this is correct

  A web application firewall is deployed inline in front of the portal and operates at Layer 7, where it decodes and inspects HTTP/HTTPS requests, including headers, cookies, parameters, and request bodies. By matching traffic against signature-based rules (such as the OWASP Core Rule Set) and behavior, it can distinguish normal requests from SQL injection, cross-site scripting, and other application-layer attacks, then actively block or sanitize them before they reach the backend. This real-time, application-aware blocking is exactly what the team needs for a customer-facing portal that accepts untrusted input.

• ✗

  DLP, because it can stop sensitive data from being posted to the portal.

  Why it's wrong here

  Data loss prevention (DLP) tools inspect content for patterns that represent confidential information, such as credit card numbers, social security numbers, or classification labels, and can block data exfiltration via web uploads, email, or USB. However, DLP regulates the movement of sensitive data outward and has no concept of web application attack payloads like SQL injection or malicious request sequences. It cannot distinguish a benign product search from an exploitation attempt against the portal's backend, so it would not satisfy the requirement to inspect and block malicious traffic to the customer-facing application itself.

• ✗

  NAC, because it verifies whether devices are allowed onto the network.

  Why it's wrong here

  Network access control (NAC) enforces security policies at the point where devices join the network—checking endpoint posture, authentication, and compliance with health requirements via 802.1X or DHCP before granting admission. NAC operates at the network and data-link layers and, once a device is admitted, it does not examine the HTTP requests that device sends to a web server. It is therefore incapable of rejecting a malicious request inside the portal's session, because it lacks any awareness of application-layer protocol content or web vulnerabilities.

Go deeper

Related to this question