Home › Certifications › CompTIA Security+ › Security Operations — Monitoring, Detection and Response
36 multiple-choice questions and 45 flashcards on Security Operations — Monitoring, Detection and Response, about 12% of the CompTIA Security+ bank. Every one carries a written rationale.
Security Operations — Monitoring, Detection and Response is one of 6 chapters in CoStudy's CompTIA Security+ bank, and it holds 36 of the bank's 300 multiple-choice questions — roughly 12% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.
Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.
9 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.
Which log source is MOST useful for proving that an account performed a specific privileged action?
Answer: B — Privileged session recordings with correlated authentication logs
B) PAM session recording bound to time-correlated auth and audit events ties a specific action to a specific identity. A) DHCP only links a lease to a MAC address. C) Web logs miss operating-system administrative activity. D) Email metadata is unrelated to privileged actions.
Which framework maps adversary tactics?
Answer: C — MITRE ATT&CK, a catalog of adversary TTPs
MITRE ATT&CK catalogs adversary tactics, techniques, and procedures across the attack lifecycle and is what SOC teams map detections against. ISO 27001 (A) certifies a management system, NIST SP 800-53 (B) is a control catalog, and PCI DSS (D) is a payment-industry requirement set; none of them model attacker behavior.
An organization wants to run an exercise where teams discuss their response to a simulated breach without touching production. This is a:
Answer: D — Tabletop exercise
D) Tabletop = discussion-based walkthrough. A) Red-team actually attempts intrusion. C) Failover tests cut over to DR systems. B) Pen tests technically exploit systems.
Incident response phases (NIST SP 800-61):
Answer: E — Preparation, detection and analysis, containment and recovery, then review
NIST SP 800-61 defines preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity, run as a cycle so lessons learned feed back into preparation. A denies the defined sequence, and B, C, and D each drop preparation or the post-incident review that drives improvement.
Which control would BEST detect that a privileged account was used at 3 AM from a country the admin has never traveled to?
Answer: D — User and Entity Behavior Analytics tied to identity telemetry
D) UEBA baselines each account's normal behavior and flags anomalies such as impossible travel and off-hours privileged use. A) An annual review would surface this months late. B) Encryption protects data at rest, not logon patterns. C) Anti-virus looks for malware, not anomalous identity use.
In digital forensics, chain of custody refers to:
Answer: B — The documented record of who collected, handled, and analyzed evidence
(B) Chain of custody is the unbroken chronological documentation that makes evidence admissible. (A) protects confidentiality but proves nothing about handling. (C) is a backup policy. (D) is media disposal.
A SIEM (Security Information and Event Management) system:
Answer: C — Aggregating and correlating logs across the environment to raise alerts
(C) A SIEM ingests logs from many sources, correlates them into events, and supports investigation and compliance reporting. (A) is plain log storage without correlation. (B) is a preventive control a SIEM does not replace. (D) is an offensive testing activity.
Indicators of Compromise (IoCs) are MOST useful for:
Answer: B — Searching SIEM and EDR for known-bad hashes, IPs, domains, and paths
B) IoCs are concrete artifacts that drive retrospective hunts and ongoing detection content. A) Backup encryption is a data protection control. C) IoCs have no bearing on authentication design. D) RTO targets come from business impact analysis.
An IDS issues an alert for unusual traffic. Which tool's job is to actively block it inline?
Answer: D — IPS
D) IPS sits inline and can drop/reset matched traffic. A) SIEM correlates logs and alerts but does not block traffic itself. C) DLP focuses on data egress. B) HIDS monitors a host but typically alerts rather than blocks inline network traffic.
4 cards from the 45 in this chapter.
What is CVSS?
Common Vulnerability Scoring System — rates vulnerability severity 0-10. Base, temporal, and environmental metrics. Critical: 9.0-10.0.
What is the incident response lifecycle?
Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident (Lessons Learned). NIST framework.
What is a credentialed vs. non-credentialed scan?
Credentialed: scanner authenticates to the target with valid credentials, providing deeper visibility into configurations. Non-credentialed: external scan only, sees what an attacker would see.
What is eradication in incident response?
Completely removing the threat: deleting malware, closing backdoors, patching vulnerabilities, and rebuilding compromised systems.
These are a sample. The full Security Operations — Monitoring, Detection and Response chapter runs 81 items with per-chapter progress tracking, on the web and in the iOS app.
Open CompTIA Security+ in CoStudy →