SY0-701 General Security Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  File integrity monitoring on firewall configuration files and rule exports.

  Why this is correct

  File integrity monitoring (FIM) works by generating cryptographic hashes of firewall configuration files and rule exports at a known-good state, then periodically re-hashing and comparing them to detect any unauthorized modification. When drift is detected, FIM alerts the security team to the exact file and time of change, enabling rapid investigation and remediation. This is a detective control because it identifies that unauthorized edits have occurred but does not automatically revert them.

• ✓

  Automated configuration management to reapply the approved baseline after drift.

  Why this is correct

  Automated configuration management, such as Ansible, Puppet, or a firewall vendor's API, continuously compares the live device state to an approved baseline and automatically reapplies the correct rules if drift is found. This is a corrective control that minimizes the window of exposure by restoring the known-good configuration without requiring manual intervention. However, it should be paired with file integrity monitoring to provide visibility into when and why the drift occurred.

• ✗

  A login banner warning administrators that unauthorized changes are monitored.

  Why it's wrong here

  A login banner is a deterrent and legal notice that informs administrators that activity is monitored, but it does not actively monitor, detect, or restore unauthorized changes. Since banners are easily ignored and do not enforce any technical control, they cannot prevent a determined insider from modifying firewall objects. Any claimed monitoring in the banner would rely on separate logging or FIM tools, making it redundant to the actual controls.

• ✗

  Mandatory annual security awareness training for all IT staff.

  Why it's wrong here

  Mandatory annual security awareness training is a long-term administrative control that educates staff on policies and best practices, but it does not provide real-time detection or automated recovery from firewall configuration drift. Training may reduce accidental misconfigurations over time, yet an authorized administrator could still intentionally or mistakenly alter a rule, and the system would not know until a later review. The infrequency of annual training makes it completely unsuited for addressing immediate, ongoing drift incidents.

• ✗

  Quarterly business impact reviews of the firewall change log.

  Why it's wrong here

  Quarterly business impact reviews of the firewall change log are a governance process that evaluate the business consequences of past changes, but they are far too slow and manual to detect or correct unauthorized edits in a timely manner. These reviews depend on the quality and integrity of the change log itself, which may be tampered with or incomplete, and they only provide a retrospective analysis. For active drift, you need a technical control that alerts on changes in near-real-time, not a quarterly meeting.