SY0-701 General Security Concepts Practice Question
After several unauthorized edits to firewall objects caused a production outage, a security team wants one control that will flag future configuration drift and another that will automatically restore the approved baseline before the next maintenance window. Which two controls best meet that goal? Select two.
⚠ Common exam trap
Test-takers frequently confuse passive controls like banners or training with active detection and remediation, or mistakenly think that a quarterly review meets the requirement for automatic restoration before the next maintenance window.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
File integrity monitoring on firewall configuration files and rule exports.
File integrity monitoring (FIM) on firewall configuration files and rule exports (Option A) detects unauthorized changes by computing cryptographic hashes of baseline files and alerting on any deviation. This directly flags configuration drift, meeting the first requirement. Automated configuration management (Option B) can reapply the approved baseline from a version-controlled repository, restoring the correct state before the next maintenance window, satisfying the second requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
File integrity monitoring on firewall configuration files and rule exports.
Why this is correct
File integrity monitoring (FIM) works by generating cryptographic hashes of firewall configuration files and rule exports at a known-good state, then periodically re-hashing and comparing them to detect any unauthorized modification. When drift is detected, FIM alerts the security team to the exact file and time of change, enabling rapid investigation and remediation. This is a detective control because it identifies that unauthorized edits have occurred but does not automatically revert them.
- ✓
Automated configuration management to reapply the approved baseline after drift.
Why this is correct
Automated configuration management, such as Ansible, Puppet, or a firewall vendor's API, continuously compares the live device state to an approved baseline and automatically reapplies the correct rules if drift is found. This is a corrective control that minimizes the window of exposure by restoring the known-good configuration without requiring manual intervention. However, it should be paired with file integrity monitoring to provide visibility into when and why the drift occurred.
- ✗
A login banner warning administrators that unauthorized changes are monitored.
Why it's wrong here
A login banner is a deterrent and legal notice that informs administrators that activity is monitored, but it does not actively monitor, detect, or restore unauthorized changes. Since banners are easily ignored and do not enforce any technical control, they cannot prevent a determined insider from modifying firewall objects. Any claimed monitoring in the banner would rely on separate logging or FIM tools, making it redundant to the actual controls.
- ✗
Mandatory annual security awareness training for all IT staff.
Why it's wrong here
Mandatory annual security awareness training is a long-term administrative control that educates staff on policies and best practices, but it does not provide real-time detection or automated recovery from firewall configuration drift. Training may reduce accidental misconfigurations over time, yet an authorized administrator could still intentionally or mistakenly alter a rule, and the system would not know until a later review. The infrequency of annual training makes it completely unsuited for addressing immediate, ongoing drift incidents.
- ✗
Quarterly business impact reviews of the firewall change log.
Why it's wrong here
Quarterly business impact reviews of the firewall change log are a governance process that evaluate the business consequences of past changes, but they are far too slow and manual to detect or correct unauthorized edits in a timely manner. These reviews depend on the quality and integrity of the change log itself, which may be tampered with or incomplete, and they only provide a retrospective analysis. For active drift, you need a technical control that alerts on changes in near-real-time, not a quarterly meeting.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.