Security Operations is the largest domain on CompTIA Security+ SY0-701, worth 28% of the exam. It covers the day-to-day work of a security team: responding to incidents, preserving evidence, managing vulnerabilities, monitoring and alerting, protecting email and endpoints, controlling privileged access, and centralizing logs.
This is the third set in our Security+ SY0-701 series (Questions 21-30). It follows SY0-701 Questions 11-20 on threats and mitigations. Every question is an original practice scenario, not a copy of a real exam item.
Many operations questions ask for the next step or the best tool, so read the scenario for where the team is in the process before you answer.
Question 21: The Host Is Isolated. What Next?
A security team confirms malware on a file server and disconnects the server from the network to stop it from spreading. Following the incident response process in the Security+ objectives, what is the next phase?
A) Preparation
B) Lessons learned
C) Detection
D) Eradication
👁 Reveal Answer
Correct Answer: D
Explanation: The Security+ incident response process runs preparation, detection, analysis, containment, eradication, recovery, and lessons learned. Disconnecting the server is containment, so the next phase is eradication: removing the malware and closing the way it got in. Recovery, which restores the server to normal service, comes after that. A happens before any incident. B comes at the end. C has already happened, because the malware was found and confirmed.
Reference: CompTIA Security+ SY0-701 exam objectives, 4.8 (incident response process)
Question 22: Evidence That Will Stand Up Later
An investigator collects a laptop and a disk image from a suspected insider. The company may take legal action. What must the investigator maintain so that the evidence can be shown to be unaltered and accounted for at every step?
A) A chain of custody record documenting who handled the evidence, when, and why
B) A copy of the company’s acceptable use policy
C) A list of open firewall ports
D) A backup of the laptop’s browser bookmarks
👁 Reveal Answer
Correct Answer: A
Explanation: Chain of custody documents every person who handled the evidence, when, and for what purpose, from collection to presentation. Together with hashing the disk image to prove it has not changed, it lets the organization show that the evidence was preserved properly. B may be relevant to the case but does not protect the evidence. C and D are not evidence-handling controls.
Reference: NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
Question 23: A Lawsuit Is Coming
The legal department warns that a former customer is likely to sue. It instructs IT to make sure emails and files related to that customer are not deleted by normal retention or cleanup jobs. What is this instruction called?
A) Data sanitization
B) Data minimization
C) A legal hold
D) A tabletop exercise
👁 Reveal Answer
Correct Answer: C
Explanation: A legal hold requires an organization to preserve all data that may be relevant to expected or ongoing litigation, suspending normal deletion. A is the opposite: securely destroying data. B means collecting and keeping only the data you need, which is good practice but does not override deletion for a lawsuit. D is a discussion-based exercise to practice incident response.
Reference: CompTIA Security+ SY0-701 exam objectives, 4.8 (digital forensics: legal hold)
Question 24: Two Critical Findings, One Patch Window
A vulnerability scan reports two vulnerabilities with the same critical CVSS base score. One is on an internet-facing web server that processes payments. The other is on an isolated lab server with no sensitive data. The team can patch only one tonight. What should it do?
A) Patch the lab server first, because it is easier
B) Patch the internet-facing payment server first, because exposure and asset criticality raise its real-world risk
C) Patch neither until the CVSS scores change
D) Patch whichever finding the scanner listed first
👁 Reveal Answer
Correct Answer: B
Explanation: CVSS base scores describe the severity of a vulnerability itself, but prioritization should also consider exposure, the criticality of the asset, and the environment. An internet-facing payment server is far more likely to be attacked and far more costly to lose than an isolated lab machine. A optimizes for convenience instead of risk. C ignores a known critical issue. D lets scanner order decide.
Reference: CompTIA Security+ SY0-701 exam objectives, 4.3 (vulnerability analysis and prioritization)
Question 25: The Scanner Says Vulnerable, the Vendor Says Patched
A scanner flags a Linux web server as vulnerable because of its web server version number. The Linux vendor confirms that the security fix was backported into that version, and the server has the fixed package installed. How should this finding be treated?
A) As a false positive; verify the fix, document the exception, and tune the scanner if possible
B) As a false negative; scan the server more often
C) As a true positive; take the server offline immediately
D) As a zero-day; report it to the vendor
👁 Reveal Answer
Correct Answer: A
Explanation: A false positive is a finding that reports a vulnerability that is not actually present. Version-based checks commonly cause this when vendors backport fixes without changing the version number. The right response is to confirm the fix is installed, document it, and adjust the scanner so the finding does not keep recurring. B describes a real vulnerability that the scanner misses, which is the opposite. C overreacts to a problem that does not exist. D is wrong because the issue is already known and fixed.
Reference: CompTIA Security+ SY0-701 exam objectives, 4.3 (false positives and false negatives)
Question 26: A Machine That Cannot Be Patched
A factory runs a control system on an old operating system that the equipment vendor will not let the factory patch. The system has a known vulnerability, but it must keep running. What is the best approach?
A) Ignore the vulnerability because patching is not possible
B) Install the patch anyway and void the vendor’s support
C) Connect the system directly to the internet so the vendor can monitor it
D) Apply compensating controls, such as network segmentation and strict access rules, and record a formal exception
👁 Reveal Answer
Correct Answer: D
Explanation: When a vulnerability cannot be remediated by patching, the Security+ objectives point to responses such as segmentation, compensating controls, and documented exceptions. Isolating the system on its own network segment and limiting who and what can reach it reduces the chance of exploitation, and the exception records the accepted risk for review. A leaves the risk unmanaged. B may break a critical system and its support agreement. C increases exposure dramatically.
Reference: CompTIA Security+ SY0-701 exam objectives, 4.3 (vulnerability response and remediation)
Question 27: Telling Other Servers to Reject Spoofed Mail
Criminals keep sending phishing emails that appear to come from a bank’s domain. The bank already publishes SPF and signs mail with DKIM. What should it add so that receiving mail servers know to reject messages that fail those checks, and so the bank receives reports?
A) A web application firewall
B) An MX record for a backup mail server
C) A DMARC record with a policy of reject
D) A longer TLS certificate key
👁 Reveal Answer
Correct Answer: C
Explanation: SPF lists the servers allowed to send mail for a domain, and DKIM signs messages so receivers can verify them. DMARC builds on both: the domain owner publishes a policy (none, quarantine, or reject) that tells receivers what to do with mail that fails, and asks them to send reports. A protects web applications. B adds mail delivery capacity. D strengthens encryption in transit but does not stop spoofed senders.
Reference: CompTIA Security+ SY0-701 exam objectives, 4.5 (email security: DMARC, DKIM, SPF); RFC 7489 (DMARC)
Question 28: Seeing What Happened on the Endpoint
Signature-based antivirus did not detect a fileless attack that used built-in scripting tools on several laptops. The security team wants to record endpoint behavior, detect suspicious activity, and isolate a device remotely during an investigation. What should it deploy?
A) Endpoint detection and response (EDR)
B) A stronger Wi-Fi encryption protocol
C) A larger hard drive in each laptop
D) Data loss prevention for email only
👁 Reveal Answer
Correct Answer: A
Explanation: EDR continuously records activity on endpoints, uses behavioral analysis to detect suspicious actions (including fileless techniques that do not match a known signature), and lets responders investigate and take actions such as isolating a device. Extended detection and response (XDR) widens this across email, identity, and cloud. B protects wireless traffic. C changes storage. D protects data in email, not endpoint behavior.
Reference: CompTIA Security+ SY0-701 exam objectives, 4.5 (EDR/XDR)
Question 29: Administrators Who Are Always Administrators
An audit finds that 40 IT staff have permanent domain administrator rights and share passwords for several service accounts in a spreadsheet. Which solution addresses both problems?
A) A web filter
B) A privileged access management (PAM) tool with just-in-time access and password vaulting
C) A screen lock policy
D) A new password complexity rule
👁 Reveal Answer
Correct Answer: B
Explanation: PAM tools manage privileged accounts. Just-in-time permissions give administrators elevated rights only when they need them and for a limited time. Password vaulting stores privileged credentials securely, checks them out to approved users, and can rotate them, which replaces the spreadsheet. Ephemeral credentials are another PAM feature. A controls web browsing. C protects unattended screens. D does nothing about standing privilege or shared passwords.
Reference: CompTIA Security+ SY0-701 exam objectives, 4.6 (privileged access management tools)
Question 30: Correlating Logs From Everywhere
A company has logs on firewalls, domain controllers, cloud services, and web servers, each viewed in a separate console. Analysts miss attacks that only become visible when events from several systems are combined. What should the company implement?
A) A file integrity monitoring tool on one server
B) A network access control system
C) A security information and event management (SIEM) system that aggregates and correlates logs and raises alerts
D) More local storage on each device for logs
👁 Reveal Answer
Correct Answer: C
Explanation: A SIEM collects logs from many sources in one place, normalizes them, correlates related events, and alerts on suspicious patterns, so an attack that spans several systems becomes visible. A security orchestration, automation, and response (SOAR) platform can then automate parts of the response. A watches for changes to files on one system. B controls which devices can join the network. D keeps logs longer but still in separate places.
Study Tips for Security Operations
- Memorize the incident response order. Preparation, detection, analysis, containment, eradication, recovery, lessons learned.
- Forensics is about proof. Chain of custody, hashing, and legal holds protect evidence and data for legal use.
- Risk beats raw scores. Prioritize vulnerabilities using exposure and asset value, not CVSS alone.
- Know the false results. A false positive reports a problem that is not there. A false negative misses a real one.
- Email trio. SPF says who can send, DKIM proves the message was not altered, and DMARC sets the policy and reporting.
Keep Practicing for Security+
Go back to SY0-701 Questions 11-20 for threats and mitigations, or Questions 1-10 for cloud security architecture.