What is the primary difference between an intrusion detection system (IDS) and an intrusion prevention system (IPS)?

An IDS passively monitors and alerts, while an IPS actively blocks or prevents detected threats.

An IDS monitors network traffic, while an IPS monitors host activity.

An IDS is deployed on a host, while an IPS is deployed on a network.

An IDS is signature-based, while an IPS is behavior-based.

A system administrator is monitoring a database server and notices that disk I/O is consistently at 90% utilization during peak hours, while CPU and memory usage are normal. The administrator needs to improve performance without adding new hardware. Which action should the administrator take FIRST?

Increase the server's memory allocation.

Optimize the database queries to reduce disk I/O.

Move the database to a different server with faster disks.

Reboot the server to clear the disk I/O.

A security analyst is establishing a baseline for a server's network traffic. The analyst collects data for one week and finds that the server's traffic peaks at 100 Mbps on weekdays and drops to 10 Mbps on weekends. Which action should the analyst take to create an accurate baseline?

Collect data for a longer period before creating a baseline.

Use the peak traffic value as the baseline.

Use the average traffic across the entire week as the baseline.

Create separate baselines for weekday and weekend traffic.

An alert is configured to trigger when CPU usage exceeds 90% for more than 5 minutes. What is the purpose of the '5 minutes' condition?

To reduce false positives from temporary spikes

To increase the alert's severity

To block the CPU from reaching 100%

CompTIASecurity+

Domain 4Objective 4

Alerting and Monitoring SY0-701 Practice Questions (Page 1)

Part of the Security operations domain, which accounts for 28% of the SY0-701 exam. CompTIA does not publish an official question count, but from its 90-minute exam (~35–60 total, ~10–17 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

9concepts

28%of the exam

Questions 1–5

1foundation · easy
What is the primary difference between an intrusion detection system (IDS) and an intrusion prevention system (IPS)?
Select an answer first
2expert · hard
A system administrator is monitoring a database server and notices that disk I/O is consistently at 90% utilization during peak hours, while CPU and memory usage are normal. The administrator needs to improve performance without adding new hardware. Which action should the administrator take FIRST?
Select an answer first
3expert · hard
A security analyst is establishing a baseline for a server's network traffic. The analyst collects data for one week and finds that the server's traffic peaks at 100 Mbps on weekdays and drops to 10 Mbps on weekends. Which action should the analyst take to create an accurate baseline?
Select an answer first
4foundation · easy
A security operations center (SOC) receives alerts from multiple different security tools. Which SIEM capability helps reduce alert fatigue by grouping related alerts into a single incident?
Select an answer first
5foundation · easy
An alert is configured to trigger when CPU usage exceeds 90% for more than 5 minutes. What is the purpose of the '5 minutes' condition?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SY0-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “SY0-701” is a trademark of its owner, used for identification only.