Question 206 of 1,013
SY0-701 Security Architecture Practice Question
Exhibit
2026-04-25 09:14:03 iam:AttachRolePolicy user=alice 2026-04-25 09:15:10 ec2:AuthorizeSecurityGroupIngress user=alice 2026-04-25 09:16:22 s3:PutBucketPolicy user=alice Requirement: Security wants to track management-plane API calls and configuration changes across cloud resources.
Based on the exhibit, which logging capability should be enabled first to create an audit trail for cloud administration changes?
Exhibit: 2026-04-25 09:14:03 iam:AttachRolePolicy user=alice 2026-04-25 09:15:10 ec2:AuthorizeSecurityGroupIngress user=alice 2026-04-25 09:16:22 s3:PutBucketPolicy user=alice
Requirement: Security wants to track management-plane API calls and configuration changes across cloud resources.
⚠ Common exam trap
It's easy for candidates to confuse data-plane logging (e.g., VPC Flow Logs or DNS logs) with management-plane logging, or assume manual processes are sufficient, when the exhibit clearly shows API-level events that only a control-plane audit service can capture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable cloud control-plane audit logging such as CloudTrail or the provider equivalent.
Cloud control-plane audit logging (e.g., AWS CloudTrail, Azure Monitor, or GCP Cloud Audit Logs) captures all management-plane API calls—such as IAM role attachments, security group rule changes, and bucket policy modifications—as shown in the exhibit. This directly meets the requirement to track configuration changes across cloud resources, providing a tamper-proof audit trail for security and compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable cloud control-plane audit logging such as CloudTrail or the provider equivalent.
Why this is correct
This is the best choice because the exhibit shows API-level changes to identity, networking, and storage policies. Control-plane audit logging records who made those changes, what action was taken, and when it occurred. That creates the most useful evidence for investigations, change tracking, and compliance in a cloud environment.
- ✗
Install a rootkit detector on each workload and ignore management-plane activity.
Why it's wrong here
Host-based rootkit detectors inspect the operating system's memory, kernel modules, and file system for signs of infection on a single instance, but they are blind to cloud control-plane events such as IAM role modifications, security group rule changes, or storage bucket permission updates that occur through provider APIs. Ignoring management-plane activity means losing the authoritative record of who changed infrastructure and when, leaving investigators with only fragmented endpoint artifacts rather than a complete audit trail.
- ✗
Capture only DNS traffic, because it reveals all admin changes indirectly.
Why it's wrong here
DNS logs can reveal which hostnames workloads query, but they contain no correlation with the cloud provider's administrative API calls. An attacker who alters a policy or deletes a network ACL often performs the action over HTTPS to an endpoint whose DNS resolution is cached, unrelated to the change, or bypassed entirely. Thus, DNS traffic is far too indirect to identify the identity, action, or exact time of control-plane modifications, which is exactly what an audit log must capture.
- ✗
Rely on manual change tickets in a spreadsheet because cloud platforms do not record useful logs.
Why it's wrong here
Spreadsheet-based change tickets are a procedural control, not a security audit log; they rely on humans to remember and correctly record every change and lack any tamper-evident linkage to actual cloud API requests. Cloud platforms such as AWS CloudTrail generate authoritative, immutable records of all management events, including the principal ARN, source IP, and request parameters in near real time. Relying on manual tickets would leave the organization without the deterministic, automated evidence required for incident response and compliance reporting.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.