SY0-701 General Security Concepts Practice Question
Exhibit
File Integrity Monitor alert: Host: WEB-03 Path: /etc/ssh/sshd_config Time: 02:18:44 Old SHA-256: 7f2a9c8d2b0f9c7e6a0c... New SHA-256: 91cd1f3b84d7e2a7f44b... Action taken: alert sent to SOC; no rollback or automatic block occurred SOC note: An unauthorized change was detected during the overnight review.
Based on the exhibit, what control type is the file integrity monitor providing?
⚠ Common exam trap
Candidates often confuse the alerting mechanism of a detective control with the action of a preventive or corrective control, mistakenly thinking that because the tool 'monitors' it must be preventing or fixing changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Detective control, because the tool identifies the unauthorized change and alerts the SOC.
A file integrity monitor (FIM) operates by comparing current file hashes against a known good baseline. When it detects a hash mismatch, it generates an alert to the Security Operations Center (SOC). This is a detective control because it identifies and reports the unauthorized change after it has occurred, rather than preventing or automatically correcting it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Preventive control, because the file monitor stopped the change from occurring.
Why it's wrong here
A preventive control would have blocked or stopped the unauthorized change before it completed. In the exhibit, the system did not prevent the modification; it detected the change afterward and sent an alert. Because no rollback or blocking occurred, the monitor is not functioning primarily as a preventive control.
- ✓
Detective control, because the tool identifies the unauthorized change and alerts the SOC.
Why this is correct
Detective control is correct because the tool notices that a protected file changed and notifies the security team. It does not stop the change or restore the original configuration automatically. That means its role is to discover suspicious activity so analysts can investigate and respond. The recorded hashes and alert timing clearly show post-event detection.
- ✗
Corrective control, because the monitor automatically fixed the configuration after the change.
Why it's wrong here
Corrective controls repair or restore something after a problem is found. In the exhibit, there is no automatic fix, rollback, or restoration. The system only raised an alert to the SOC. Since the configuration remains changed until a person responds, this is not a corrective mechanism.
- ✗
Directive control, because the alert tells administrators what they should review next.
Why it's wrong here
Directive controls guide behavior through policy, standards, or instructions. An alert can influence response, but the technical purpose of this tool is to identify configuration drift. The function shown in the exhibit is event detection, not policy guidance. The existence of an alert does not turn the control into a directive one.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.