SY0-701 General Security Concepts Practice Question
A company wants to detect unauthorized changes to production server configurations before users notice an outage. Which two controls best fit this goal? Select two.
⚠ Common exam trap
A common mix-up: candidates confuse preventive controls (like encryption or MFA) with detective controls (like FIM and SIEM alerting), leading them to select options that prevent access but do not detect changes after they happen.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
File integrity monitoring on critical system files
File integrity monitoring (FIM) on critical system files is correct because it detects unauthorized changes by comparing current file hashes against a known-good baseline. When a change occurs, FIM generates an alert, enabling the security team to investigate before users notice an outage. This directly addresses the goal of detecting configuration tampering proactively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
File integrity monitoring on critical system files
Why this is correct
File integrity monitoring (FIM) on critical system files is a detective control that establishes a cryptographic baseline (e.g., SHA-256 hashes) for protected files and configuration artifacts. On a periodic or real-time basis, FIM agents recalculate hashes and compare them against that baseline, flagging any deviation that could indicate unauthorized tampering. For example, changes to /etc/shadow, Windows registry keys, or web server configuration files immediately generate an alert, satisfying the requirement to detect unauthorized changes even though it does so after the fact.
- ✓
Centralized alerting on configuration-change events from the SIEM
Why this is correct
Centralized alerting on configuration-change events from the SIEM leverages log aggregation and correlation to identify suspicious administrative activity. The SIEM ingests event logs such as Windows 4688 (process creation), 4657 (registry value modification), and Unix auditd or sudo logs, then applies correlation rules that flag changes occurring outside maintenance windows, from unexpected IP addresses, or in high-risk repositories. This provides situational awareness and near-real-time notifications, but its effectiveness depends on complete and trustworthy log sources, making it a strong yet complementary detection method to file hash comparisons.
- ✗
Full-disk encryption on the server volumes
Why it's wrong here
Full-disk encryption (e.g., BitLocker or LUKS) protects the confidentiality of data at rest by requiring a decryption key before the operating system can access the storage. While it mitigates data exposure if a server is physically stolen, it has no mechanism to monitor or alert on file or configuration modifications while the server is running. A user with legitimate access can still alter critical files, and the encryption layer remains completely oblivious to the change, so it does not fulfill the detection requirement.
- ✗
Multifactor authentication for remote administrators
Why it's wrong here
Multifactor authentication for remote administrators is a preventive access control that reduces the likelihood of unauthorized login by requiring two or more credentials. However, it does not provide any post-authentication auditing or detection of configuration tampering; once a user is authenticated, MFA neither inspects file integrity nor logs changes to system settings. Even if an attacker bypasses or compromises a legitimate session, MFA offers no visibility into the modification of production server configurations, so it fails the detection objective.
- ✗
Network segmentation between user VLANs and server VLANs
Why it's wrong here
Network segmentation using VLANs, firewalls, and access control lists limits lateral movement and reduces the attack surface by isolating user traffic from production server subnets. While this can slow an attacker and prevent direct network pathing, it is a preventive architectural control that does not observe, hash, or report changes to server file content or configuration state. An attacker who reaches an allowed host or compromises an internal service can alter files without any segmentation feature generating a change alert, so it does not meet the need for detecting unauthorized modifications.
Go deeper
Related to this question
Learn chapter
Change Management in Security
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,030 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.