SY0-701 General Security Concepts Practice Question
Exhibit
Current controls on the finance share: - SMB signing enabled - Weekly access review - Nightly backups to immutable storage - Antivirus scans at 02:00 Incident: a valid VPN account was used to access 40,000 files in 8 minutes and copy them to a local drive. Goal: detect unauthorized bulk access quickly before exfiltration completes.
Based on the exhibit, what additional control is the best fit?
Current controls on the finance share: - SMB signing enabled - Weekly access review - Nightly backups to immutable storage - Antivirus scans at 02:00
Incident: a valid VPN account was used to access 40,000 files in 8 minutes and copy them to a local drive. Goal: detect unauthorized bulk access quickly before exfiltration completes.
⚠ Common exam trap
Many exam-takers confuse backup frequency (a recovery control) with detection controls, or think that obscuring the share name provides meaningful security, when the question specifically asks for a control to detect unauthorized bulk access quickly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add file access auditing with alert thresholds forwarded to the SIEM.
File access auditing with alert thresholds forwarded to the SIEM directly addresses the goal of detecting unauthorized bulk access quickly. By monitoring for abnormal file access patterns—such as 40,000 files in 8 minutes—the SIEM can trigger an alert before exfiltration completes, enabling rapid response. This control complements the existing weekly access review by providing real-time detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add file access auditing with alert thresholds forwarded to the SIEM.
Why this is correct
File access auditing enables granular tracking of who accessed which files and when. When combined with alert thresholds (e.g., a user reading hundreds of files in minutes), the SIEM can generate real-time alerts for potential bulk data exfiltration. As a detective control, it directly addresses the missing visibility into abnormal access patterns and supports timely incident response.
- ✗
Increase the backup schedule from nightly to hourly.
Why it's wrong here
Increasing backup frequency from nightly to hourly improves recovery point objectives, reducing data loss in a disaster or ransomware event. However, backups operate in the background and simply copy data to secondary storage; they provide no analysis of access patterns. Suspicious bulk reads by a valid account would still go unnoticed because the control does not generate security alerts or audit events.
- ✗
Rename the share to a less obvious name.
Why it's wrong here
Renaming the share to something less obvious is a form of security through obscurity. It might reduce casual discovery, but it does not authenticate, authorize, or monitor access, and it will not stop an attacker who enumerates network shares or already possesses valid credentials. Moreover, it produces no audit trail, so abnormal usage cannot be detected or investigated.
- ✗
Disable SMB signing so the file transfer runs faster.
Why it's wrong here
Disabling SMB signing to improve transfer speed removes integrity and authenticity protections from SMB sessions, exposing traffic to potential tampering or man-in-the-middle attacks. While the performance gain may be real, this change is a security regression and has no relationship to detecting bulk reads. It would not flag abnormal file access; in fact, it could make exfiltration easier for an attacker.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
SMB
SMB is a network file-sharing protocol that allows applications to read, write, and request services from server programs in a computer network.
Key term
VPN
A VPN creates an encrypted tunnel over a public network to securely connect remote users or sites to a private network.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.