SY0-701 General Security Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  File integrity monitoring on critical system files

  Why this is correct

  File integrity monitoring (FIM) on critical system files is a detective control that establishes a cryptographic baseline (e.g., SHA-256 hashes) for protected files and configuration artifacts. On a periodic or real-time basis, FIM agents recalculate hashes and compare them against that baseline, flagging any deviation that could indicate unauthorized tampering. For example, changes to /etc/shadow, Windows registry keys, or web server configuration files immediately generate an alert, satisfying the requirement to detect unauthorized changes even though it does so after the fact.

• ✓

  Centralized alerting on configuration-change events from the SIEM

  Why this is correct

  Centralized alerting on configuration-change events from the SIEM leverages log aggregation and correlation to identify suspicious administrative activity. The SIEM ingests event logs such as Windows 4688 (process creation), 4657 (registry value modification), and Unix auditd or sudo logs, then applies correlation rules that flag changes occurring outside maintenance windows, from unexpected IP addresses, or in high-risk repositories. This provides situational awareness and near-real-time notifications, but its effectiveness depends on complete and trustworthy log sources, making it a strong yet complementary detection method to file hash comparisons.

• ✗

  Full-disk encryption on the server volumes

  Why it's wrong here

  Full-disk encryption (e.g., BitLocker or LUKS) protects the confidentiality of data at rest by requiring a decryption key before the operating system can access the storage. While it mitigates data exposure if a server is physically stolen, it has no mechanism to monitor or alert on file or configuration modifications while the server is running. A user with legitimate access can still alter critical files, and the encryption layer remains completely oblivious to the change, so it does not fulfill the detection requirement.

• ✗

  Multifactor authentication for remote administrators

  Why it's wrong here

  Multifactor authentication for remote administrators is a preventive access control that reduces the likelihood of unauthorized login by requiring two or more credentials. However, it does not provide any post-authentication auditing or detection of configuration tampering; once a user is authenticated, MFA neither inspects file integrity nor logs changes to system settings. Even if an attacker bypasses or compromises a legitimate session, MFA offers no visibility into the modification of production server configurations, so it fails the detection objective.

• ✗

  Network segmentation between user VLANs and server VLANs

  Why it's wrong here

  Network segmentation using VLANs, firewalls, and access control lists limits lateral movement and reduces the attack surface by isolating user traffic from production server subnets. While this can slow an attacker and prevent direct network pathing, it is a preventive architectural control that does not observe, hash, or report changes to server file content or configuration state. An attacker who reaches an allowed host or compromises an internal service can alter files without any segmentation feature generating a change alert, so it does not meet the need for detecting unauthorized modifications.