Current controls on the finance share: - SMB signing enabled - Weekly access review - Nightly backups to immutable storage - Antivirus scans at 02:00 Incident: a valid VPN account was used to access 40,000 files in 8 minutes and copy them to a local drive. Goal: detect unauthorized bulk access quickly before exfiltration completes.
Based on the exhibit, what additional control is the best fit?
Current controls on the finance share: - SMB signing enabled - Weekly access review - Nightly backups to immutable storage - Antivirus scans at 02:00
Incident: a valid VPN account was used to access 40,000 files in 8 minutes and copy them to a local drive. Goal: detect unauthorized bulk access quickly before exfiltration completes.
Answer choices
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
Add file access auditing with alert thresholds forwarded to the SIEM.
Auditing is a detective control that can identify abnormal bulk reads quickly and trigger timely response.
Increase the backup schedule from nightly to hourly.
More backups help recovery, but they do not detect suspicious file access or exfiltration in real time.
Rename the share to a less obvious name.
Security by obscurity does not detect misuse and does not stop a valid account from accessing files.
Disable SMB signing so the file transfer runs faster.
Disabling signing weakens integrity protections and does not address the core detection gap.
Common exam trap
NAT is not only about the public address. The inside/outside interface roles and the ACL or rule that matches traffic are just as important.
Technical deep dive
NAT questions usually test address translation, overload/PAT behaviour, static mappings and whether the right traffic is being translated. Read the interface direction and address terms carefully.
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SY0-701 questions linked to Security+ social engineering questions.
Practise SY0-701 questions linked to Security+ cryptography.
Practise SY0-701 questions linked to Security+ IAM questions.
Practise SY0-701 questions linked to Security+ risk management questions.
Practise SY0-701 questions linked to Security+ incident response questions.
Practise SY0-701 questions linked to Security+ malware questions.
Practise SY0-701 questions linked to Security+ vulnerability management questions.
Practise SY0-701 questions linked to Security+ security operations questions.
Practise SY0-701 questions linked to Security+ zero trust questions.
Practise SY0-701 questions linked to Security+ authentication factors questions.
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
Question 2
Question 3
Question 4
Question 5
Question 6
FAQ
Static NAT maps one inside address to one outside address.
The correct answer is: Add file access auditing with alert thresholds forwarded to the SIEM. — The exhibit shows preventive and recovery controls already exist, but the environment lacks visibility into suspicious file access behavior. File access auditing forwarded to the SIEM is the best fit because it is a detective control that can identify unusual bulk reads, large export behavior, and access patterns inconsistent with normal use. That gives defenders a chance to respond before exfiltration completes. It directly addresses the stated goal rather than only improving restoration or convenience. Why others are wrong: Increasing backup frequency helps with restoration after an incident, but it does not detect the incident while it is happening. Renaming the share is only obscurity and will not stop a valid VPN account from reading data. Disabling SMB signing would reduce transport integrity and create a weaker configuration without improving detection. The question asks for the best fit to detect abnormal bulk access, which is auditing plus SIEM alerting.
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Sign in to join the discussion.