What is the primary purpose of application performance monitoring (APM) tools?

To track the behavior and performance of software applications

To manage user access permissions

To block malicious network traffic

A security analyst wants to monitor a single critical server for unauthorized file modifications and suspicious process activity. Which type of host monitoring tool is most appropriate?

Host-based intrusion detection system (HIDS)

Network-based intrusion detection system (NIDS)

A company has deployed an intrusion prevention system (IPS) in inline mode on its internet boundary. The security team is concerned about legitimate traffic being blocked due to false positives. Which configuration change would BEST address this concern while maintaining security?

Increase the sensitivity of the IPS to catch more threats.

Disable the IPS signatures that are causing false positives.

Tune the IPS signatures and thresholds based on baseline traffic analysis.

Switch the IPS to monitor mode and only log alerts without blocking.

A security administrator has deployed an IDS in monitor mode on the internal network. The IDS generates an alert for a known exploit signature, but the alert is triggered by a legitimate internal application that uses similar traffic patterns. The administrator needs to reduce false positives without losing detection capability. Which action should the administrator take?

Increase the sensitivity of the IDS to catch more threats.

Switch the IDS to inline mode to block the traffic.

Create a rule to suppress alerts from the legitimate application's IP address.

Disable the signature that is causing the false positive.

CompTIASecurity+

Domain 4Objective 4

Alerting and Monitoring SY0-701 Practice Questions (Page 2)

Part of the Security operations domain, which accounts for 28% of the SY0-701 exam. CompTIA does not publish an official question count, but from its 90-minute exam (~35–60 total, ~10–17 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

9concepts

28%of the exam

Questions 6–10

6foundation · easy
A user who typically logs in during business hours from a specific location suddenly logs in at 3:00 AM from a foreign country. Which monitoring concept would flag this as a potential security issue?
Select an answer first
7foundation · easy
What is the primary purpose of application performance monitoring (APM) tools?
Select an answer first
8foundation · easy
A security analyst wants to monitor a single critical server for unauthorized file modifications and suspicious process activity. Which type of host monitoring tool is most appropriate?
Select an answer first
9application · medium
A company has deployed an intrusion prevention system (IPS) in inline mode on its internet boundary. The security team is concerned about legitimate traffic being blocked due to false positives. Which configuration change would BEST address this concern while maintaining security?
Select an answer first
10expert · hard
A security administrator has deployed an IDS in monitor mode on the internal network. The IDS generates an alert for a known exploit signature, but the alert is triggered by a legitimate internal application that uses similar traffic patterns. The administrator needs to reduce false positives without losing detection capability. Which action should the administrator take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SY0-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “SY0-701” is a trademark of its owner, used for identification only.

Alerting and Monitoring SY0-701 Practice Questions (Page 2)

Questions 6–10

A user who typically logs in during business hours from a specific location suddenly logs in at 3:00 AM from a foreign country. Which monitoring concept would flag this as a potential security issue?

What is the primary purpose of application performance monitoring (APM) tools?

A security analyst wants to monitor a single critical server for unauthorized file modifications and suspicious process activity. Which type of host monitoring tool is most appropriate?

A company has deployed an intrusion prevention system (IPS) in inline mode on its internet boundary. The security team is concerned about legitimate traffic being blocked due to false positives. Which configuration change would BEST address this concern while maintaining security?

Keep studying — Security operations