FirstTry

Objective 4.4

SY0-701

Explain security alerting and monitoring concepts and tools

Objective 4.4 sits in Security Operations, which carries 28% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.

Objective title verbatim from the official objectives. CompTIA exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

4-4Security Operations

A monitoring platform records one entry per scanned host, and an analyst wants a single record carrying how many hosts each scan touched. Which processing step does this?

Log rotation, closing the current file and opening a fresh oneRotation manages file size and file lifecycle by closing one file and starting another. It never merges entries.
Event aggregation, consolidating similar entries into one entry with a countCorrect · your answerCorrect.
Log normalization, converting each field to one consistent data representationNormalization makes fields comparable across products, most often by storing every date and time in one shared format, and it leaves the entry count alone.
Log preservation, keeping records that would otherwise have been discardedPreservation keeps entries policy would delete, usually for an investigation.

Correct.

Checked against nvlpubs.nist.gov, September 2026

Concept

Log processing runs through several distinct stages, and each one solves a different problem. Some stages cut volume so a console stays readable, some make fields from different products comparable, and some govern where files live and how long they survive. Naming the stage correctly is what lets a team say which control to change when a queue is unreadable.

Why B

The consolidation described in the scenario is exactly what the log management guide calls event aggregation: a thousand entries that each record part of a scan become a single entry stating how many hosts were scanned.

Source

In event aggregation, similar entries are consolidated into a single entry containing a count of the number of occurrences of the event. For example, a thousand entries that each record part of a scan could be aggregated into a single entry that indicates how many hosts were scanned.

NIST SP 800-92: Guide to Computer Security Log Management, checked September 2026
#logging#aggregation#monitoring

Now you: objective 4.4 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

4-4Security Operations

A correlation rule fails because one firewall logs event times in twelve-hour form while another writes them in twenty-four-hour form. Which log management step resolves this before analysis?

Sample question 2 of 3

4-4Security Operations

An administrator needs each server's active log file closed and a fresh one opened whenever the file reaches ten megabytes. Which logging behavior does the administrator configure?

Sample question 3 of 3

4-4Security Operations

During an intrusion investigation, an analyst holds back a month of web server logs that the ninety-day deletion schedule would otherwise remove tomorrow. Which archival activity is this?

That’s 3 of the full Security+ bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Security Operations