Objective 4.7
SY0-701Explain the importance of automation and orchestration related to secure operations
Objective 4.7 sits in Security Operations, which carries 28% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.
Objective title verbatim from the official objectives. CompTIA exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
Which practice tracks and manages changes to infrastructure as code scripts, allowing a team to revert a deployment that introduces an error?
Correct.
Checked against cheatsheetseries.owasp.org, July 2026Concept
Pipeline practices are distinguished by what each one preserves. Signing preserves the identity of a build output. Secret stores preserve confidentiality of credentials. Scanners preserve a quality bar at a point in time. Only one of them preserves history: an ordered record of every prior state of the definition, with who changed what and why, which is the precondition for putting the system back the way it was before a bad deployment.
Why A
Version control records every change to IaC scripts alongside the feature it supports, so a bad deployment can be reverted to a known-good state.
Source
OWASP IaC Security Cheat Sheet, checked July 2026Version control - Version control is the practice of tracking and managing changes to software code. Ensure all the changes to the IaC are tracked with the right set of information that helps in any revert operation.
Now you: objective 4.7 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A pipeline uses immutable infrastructure and automated resource tagging, but its service account holds administrative rights across every cloud resource rather than scoped permissions per script. What security gap remains?
Sample question 2 of 3
A team certifies infrastructure as code scripts as secure using only static analysis integrated into its pipeline, skipping dynamic analysis and runtime monitoring entirely. Which risk does this approach fail to address?
Sample question 3 of 3
In an automated CI/CD pipeline, which activity examines infrastructure as code in isolation to flag misconfigurations before any resources are deployed?
That’s 3 of the full Security+ bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.
More objectives in Security Operations
- 4.1 Given a scenario, apply common security techniques to computing resources
- 4.2 Explain the security implications of proper hardware, software, and data asset management
- 4.3 Explain various activities associated with vulnerability management
- 4.4 Explain security alerting and monitoring concepts and tools
- 4.5 Given a scenario, modify enterprise capabilities to enhance security
- 4.6 Given a scenario, implement and maintain identity and access management
- 4.8 Explain appropriate incident response activities
- 4.9 Given a scenario, use data sources to support an investigation