CompTIA SY0-701: Security Operations, Monitoring & Detection — Study Guide
Part of the CompTIA Security+ SY0-701 — Complete Study Guide. Practice with verified answers in the CompTIA exam hub, or take timed practice tests on ExamRoll.io.
Modern security operations depend on the ability to observe, correlate, and act on signals emerging from every corner of the enterprise — endpoints, network devices, identity providers, cloud workloads, and applications. A mature detection program is not a single product but an ecosystem of telemetry pipelines, analytics engines, human analysts, and automated response workflows engineered to compress the time between compromise and containment.
SIEM and Centralized Log Aggregation
A Security Information and Event Management platform is the connective tissue of the security operations center. It ingests logs from disparate sources — Windows Event Logs, Linux syslog, firewall flow data, DNS resolvers, Active Directory, endpoint agents, SaaS audit trails — normalizes them into a common schema, and applies correlation rules across the aggregated stream. The value is not merely storage; it is the ability to correlate a failed VPN authentication in one log source with a successful privileged logon and lateral SMB access in another, producing a single high-fidelity alert where three isolated events would have been noise.
Common platforms include Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security, and Chronicle. In cloud environments, native tools such as AWS CloudTrail combined with CloudWatch and GuardDuty, or Azure Monitor with Log Analytics workspaces, serve as the logging backbone and often feed upstream into a SIEM.
A typical Splunk correlation search illustrating cross-source logic:
index=wineventlog EventCode=4625
| stats count by src_ip, user
| where count > 10
| join user [search index=vpn action=success]
| table _time, user, src_ip, count
The trap here is subtle: an organization can deploy a SIEM, ingest terabytes of data, and still miss intrusions because critical log sources are absent. If endpoint process-creation events (Windows Event ID 4688 or Sysmon Event ID 1) are not forwarded, or firewall deny logs are truncated, entire attack phases become invisible. Log source coverage — mapped explicitly against a framework like MITRE ATT&CK — is a prerequisite to meaningful detection.
Endpoint Detection and Response
EDR extends visibility to the host, where most attacker activity ultimately manifests. Unlike traditional antivirus, which matches file hashes and signatures, EDR platforms such as CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, and Carbon Black record continuous telemetry: process trees, command-line arguments, registry modifications, network connections, and DLL loads. This data enables both real-time behavioral detection and retrospective threat hunting.
A common misconception is treating EDR as a preventive control equivalent to a firewall. EDR primarily detects and assists response — it may block known malicious behavior, but its greater value lies in providing the forensic trail that lets an analyst determine what a compromised process did, which credentials it accessed, and where it moved laterally. Response actions such as host isolation, process termination, and file quarantine are typically initiated by an analyst or a SOAR playbook, not by the EDR alone.
IDS/IPS, Signatures, and Baseline Enforcement
Network-based intrusion detection and prevention systems inspect traffic against signatures and behavioral models. An IDS (such as Snort or Suricata in monitoring mode) alerts on suspicious patterns; an IPS sits inline and drops matching traffic. A Snort rule for detecting a specific exploit pattern demonstrates signature-based logic:
alert tcp any any -> $HOME_NET 445 (
msg:"SMB Exploit Attempt";
content:"|ff|SMB"; offset:4; depth:4;
content:"|72 00|"; distance:0;
sid:9000001; rev:1;
)
Anomaly-based detection establishes a behavioral baseline and alerts on deviations — a workstation that suddenly begins making DNS queries at 10× its normal rate, or a server that opens outbound connections on port 4444 for the first time, both warrant investigation regardless of whether a signature matches.
Threat Intelligence and Indicator Management
Threat intelligence transforms raw data into actionable knowledge about adversary tactics, techniques, and procedures (TTPs). STIX (Structured Threat Information eXpression) is the standard format for representing threat intelligence objects — indicators, campaigns, threat actors, attack patterns — while TAXII (Trusted Automated eXchange of Indicator Information) is the transport protocol for sharing them. Commercial and open-source feeds (VirusTotal, AlienVault OTX, MISP, Recorded Future) provide IP reputation, domain blocklists, file hashes, and YARA rules that can be ingested directly into SIEM and firewall platforms.
Indicators of Compromise (IoCs) — malicious IP addresses, file hashes, domain names, registry keys — are the most immediately actionable intelligence but also the most ephemeral; attackers rotate infrastructure rapidly. Indicators of Attack (IoAs) focus on behaviors rather than artifacts: a process spawning a child shell, an encoded PowerShell command, or a service created with a random name. IoA-based detection is harder to evade because it targets the technique, not the specific tool.
Practical Scenario: Detection Gap from Missing Log Sources
A financial services firm deployed a SIEM and ingested perimeter firewall logs, Windows Security event logs, and email gateway logs. During a red team exercise, the team gained initial access via a phishing email (detected), but then used WMI for lateral movement and PowerShell remoting for command execution — neither of which generated Windows Security events in the default configuration. The red team reached the treasury workstation and exfiltrated a simulated wire transfer file without triggering a single SIEM alert after the initial phishing detection. The gap: Sysmon was not deployed, PowerShell script block logging was not enabled, and WMI activity logging required additional configuration. The exercise demonstrated that SIEM coverage is only as good as the log sources feeding it — a lesson that must be validated through purple team exercises, not assumed from vendor documentation.
← Network Security · All domains · Incident Response →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →