The answer is detective control because a file integrity monitor, or FIM, identifies unauthorized changes after they have occurred and alerts the SOC. It works by comparing current file hashes against a known good baseline; when a hash mismatch is detected, the tool reports the change rather than blocking or reversing it. On the Security+ SY0-701 exam, this concept tests your ability to distinguish control types by their timing—detective controls find incidents post-facto, while preventive controls stop them beforehand. A common trap is confusing FIM with a preventive tool like an access control list, but remember that FIM only detects, not prevents. For a quick memory tip: think “FIM finds the fingerprint after the fact,” linking the hash comparison to its detective role.
SY0-701 General Security Concepts Practice Question
This SY0-701 practice question tests your understanding of general security concepts. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
File Integrity Monitor alert:
Host: WEB-03
Path: /etc/ssh/sshd_config
Time: 02:18:44
Old SHA-256: 7f2a9c8d2b0f9c7e6a0c...
New SHA-256: 91cd1f3b84d7e2a7f44b...
Action taken: alert sent to SOC; no rollback or automatic block occurred
SOC note:
An unauthorized change was detected during the overnight review.
Based on the exhibit, what control type is the file integrity monitor providing?
File Integrity Monitor alert:
Host: WEB-03
Path: /etc/ssh/sshd_config
Time: 02:18:44
Old SHA-256: 7f2a9c8d2b0f9c7e6a0c...
New SHA-256: 91cd1f3b84d7e2a7f44b...
Action taken: alert sent to SOC; no rollback or automatic block occurred
SOC note:
An unauthorized change was detected during the overnight review.
A
Preventive control, because the file monitor stopped the change from occurring.
Why wrong: A preventive control would have blocked or stopped the unauthorized change before it completed. In the exhibit, the system did not prevent the modification; it detected the change afterward and sent an alert. Because no rollback or blocking occurred, the monitor is not functioning primarily as a preventive control.
B
Detective control, because the tool identifies the unauthorized change and alerts the SOC.
Detective control is correct because the tool notices that a protected file changed and notifies the security team. It does not stop the change or restore the original configuration automatically. That means its role is to discover suspicious activity so analysts can investigate and respond. The recorded hashes and alert timing clearly show post-event detection.
C
Corrective control, because the monitor automatically fixed the configuration after the change.
Why wrong: Corrective controls repair or restore something after a problem is found. In the exhibit, there is no automatic fix, rollback, or restoration. The system only raised an alert to the SOC. Since the configuration remains changed until a person responds, this is not a corrective mechanism.
D
Directive control, because the alert tells administrators what they should review next.
Why wrong: Directive controls guide behavior through policy, standards, or instructions. An alert can influence response, but the technical purpose of this tool is to identify configuration drift. The function shown in the exhibit is event detection, not policy guidance. The existence of an alert does not turn the control into a directive one.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Detective control, because the tool identifies the unauthorized change and alerts the SOC.
A file integrity monitor (FIM) operates by comparing current file hashes against a known good baseline. When it detects a hash mismatch, it generates an alert to the Security Operations Center (SOC). This is a detective control because it identifies and reports the unauthorized change after it has occurred, rather than preventing or automatically correcting it.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Preventive control, because the file monitor stopped the change from occurring.
Why it's wrong here
A preventive control would have blocked or stopped the unauthorized change before it completed. In the exhibit, the system did not prevent the modification; it detected the change afterward and sent an alert. Because no rollback or blocking occurred, the monitor is not functioning primarily as a preventive control.
✓
Detective control, because the tool identifies the unauthorized change and alerts the SOC.
Why this is correct
Detective control is correct because the tool notices that a protected file changed and notifies the security team. It does not stop the change or restore the original configuration automatically. That means its role is to discover suspicious activity so analysts can investigate and respond. The recorded hashes and alert timing clearly show post-event detection.
Related concept
Read the scenario before looking for a memorised answer.
✗
Corrective control, because the monitor automatically fixed the configuration after the change.
Why it's wrong here
Corrective controls repair or restore something after a problem is found. In the exhibit, there is no automatic fix, rollback, or restoration. The system only raised an alert to the SOC. Since the configuration remains changed until a person responds, this is not a corrective mechanism.
✗
Directive control, because the alert tells administrators what they should review next.
Why it's wrong here
Directive controls guide behavior through policy, standards, or instructions. An alert can influence response, but the technical purpose of this tool is to identify configuration drift. The function shown in the exhibit is event detection, not policy guidance. The existence of an alert does not turn the control into a directive one.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse the alerting mechanism of a detective control with the action of a preventive or corrective control, mistakenly thinking that because the tool 'monitors' it must be preventing or fixing changes.
Trap categories for this question
Command / output trap
Directive controls guide behavior through policy, standards, or instructions. An alert can influence response, but the technical purpose of this tool is to identify configuration drift. The function shown in the exhibit is event detection, not policy guidance. The existence of an alert does not turn the control into a directive one.
Detailed technical explanation
How to think about this question
File integrity monitoring tools typically use cryptographic hashing algorithms such as SHA-256 or SHA-512 to compute a baseline hash of critical files. On subsequent scans, the tool recalculates the hash and compares it to the baseline; any mismatch triggers an alert. In real-world scenarios, FIM is often used to monitor system binaries, configuration files, and registry keys for signs of compromise, but it cannot prevent the initial write operation because the file system allows writes by default unless additional access controls are enforced.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
General Security Concepts — This question tests General Security Concepts — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Detective control, because the tool identifies the unauthorized change and alerts the SOC. — A file integrity monitor (FIM) operates by comparing current file hashes against a known good baseline. When it detects a hash mismatch, it generates an alert to the Security Operations Center (SOC). This is a detective control because it identifies and reports the unauthorized change after it has occurred, rather than preventing or automatically correcting it.
What should I do if I get this SY0-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.