CompTIA Security+ Practice Test of the Day 072625

Welcome to today’s CompTIA Security+ practice test!

This practice test uses our new UI!

Today’s practice test is based on Subdomain 4.4 (Explain security alerting and monitoring concepts and tools) from the CompTIA Security+ SY0-701 objectives.

This beginner-level practice test is inspired by the CompTIA Security+ (SY0-701) exam and is designed to help you reinforce key cybersecurity concepts on a daily basis.

These questions are not official exam questions, nor are they brain dumps, but they reflect topics and scenarios relevant to the Security+ certification. Use them to test your knowledge, identify areas for improvement, and build daily cybersecurity habits.

Note: CompTIA and Security+ are registered trademarks of CompTIA. This content is not affiliated with or endorsed by CompTIA.

To choose CompTIA Security+ practice tests based on specific domains/subdomains, click that link.

CompTIA Security+ Practice Test of the Day 072625

10 questions • Single best answer

Question 1

A SOC team's SIEM generates over 10,000 alerts per day, but analysts can only meaningfully investigate a fraction of them. A senior analyst reviews the alert rules and finds that a rule designed to flag brute-force attempts is triggering on a legitimate batch authentication job that runs every morning. Which activity should the analyst perform to reduce noise without disabling the rule entirely?

A. Quarantine the batch job server B. Disable the brute-force detection rule C. Alert tuning D. Increase log archiving frequency

Question 2

An analyst in a SOC reviews network flow data showing the volume of traffic, source and destination IPs, ports, and protocols for every connection on the enterprise network over the past 30 days. The analyst does not have access to the actual packet contents. Which monitoring data source is being used?

A. Packet capture B. SNMP traps C. NetFlow D. SIEM event logs

Question 3

A network device sends an unsolicited message to a centralized management system notifying it that a temperature threshold has been exceeded and the fan has failed. The management system logs the event and pages the on-call engineer. Which monitoring mechanism generated the notification?

A. NetFlow B. SIEM correlation rule C. SNMP trap D. Agentless scan

Question 4

After a malware alert fires on an endpoint, an analyst confirms the system is infected and immediately isolates it from the network by applying a policy through the endpoint management console while preserving its forensic state. Which alert response action is this?

A. Alert tuning B. Log aggregation C. Archiving D. Quarantine

Question 5

A financial institution deploys a tool that monitors all outbound email for keywords, account numbers, and file attachments matching sensitive data patterns. When a match is found, the message is blocked and the security team is notified. Which monitoring tool is this?

A. SIEM B. Antivirus C. Data loss prevention (DLP) D. NetFlow analyzer

Question 6

A security team deploys monitoring software on each server that locally collects system logs, performance metrics, and security events and forwards them to a central platform for analysis. A newly added server in a DMZ cannot run this software due to OS restrictions. Which monitoring approach is the team using for most servers, and what alternative applies to the DMZ server?

A. Agentless for most servers; agent-based for the DMZ server B. Agent-based for most servers; agentless for the DMZ server C. SNMP-based for most servers; NetFlow for the DMZ server D. SIEM-direct for most servers; syslog for the DMZ server

Question 7

A security engineer uses a framework that provides standardized machine-readable formats for expressing security content, including vulnerability definitions, configuration checklists, and assessment results, so that different tools can share and process the data automatically. Which tool or protocol does this describe?

A. SIEM B. NetFlow C. Security Content Automation Protocol (SCAP) D. Benchmarks

Question 8

A SOC manager notices that security event logs from 47 different systems, including firewalls, endpoints, and authentication servers, are being forwarded to a central platform that normalizes the data and correlates events across sources to identify multi-stage attack patterns. Which tool is performing this function?

A. Vulnerability scanner B. DLP C. SNMP manager D. SIEM

Question 9

An organization stores 18 months of compressed security logs in a read-only storage tier that can only be accessed by authorized analysts for compliance and investigation purposes. Which monitoring activity does this BEST represent?

A. Log aggregation B. Archiving C. Alerting D. Scanning

Question 10

An organization publishes a configuration guide that defines the approved security settings for all Linux servers, including required kernel parameters, disabled services, and file permission standards. Each deployed server is measured against this guide during compliance scans. Which monitoring concept does the guide represent?

A. SCAP B. Benchmark C. Vulnerability scan profile D. SIEM correlation rule

Tired of Googling acronyms while practicing/studying?
Keep them all under your keyboard.

📋 GET_THE_DESK_MAT

Take more CompTIA Security+ practice tests

CompTIA Security+ Practice Test of the Day 072625

Related Posts

Leave a Comment Cancel Reply