4.9 Given a scenario, use data sources to support an investigation
Objective 4.9 sits in Security Operations, which carries 28% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.
Objective title verbatim from the official objectives. CompTIA exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A SOC analyst notices repeated failed logins for one account originating from several different IP addresses within a short window. Which category of application event must be logged to support detecting this pattern?
The concept
Certain event categories are always recommended for logging because they support early detection of credential-based attacks.
Why this answer
Authentication successes and failures are always logged, since repeated failures across accounts or IP addresses are early indicators of brute-force or credential-stuffing activity.
- AUseful for availability and tamper detection. A service restart tells you nothing about who tried to sign in.
- Correct: authentication events are the category tied to detecting this attack pattern.
- CRight answer for tracking bulk exfiltration through the application's own export feature.
- DA privacy and regulatory record. It has no bearing on repeated failures against one account.
Now you: objective 4.9 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A developer builds an application that writes its security event logs to a database using an account limited to inserting rows into log tables only, with no other database privileges. What logging practice does this reflect?
Sample question 2 of 3
An analyst charts failed login attempts over time and wants each source IP address to appear as its own line so trends per attacker can be compared visually. Which chart view option should the analyst configure?
Sample question 3 of 3
A responder compares web server logs against custom application logs during an investigation and finds the application logs contain far more context about the affected user. What explains this difference?
That’s 3 of the full Security+ bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.
More objectives in Security Operations
- 4.1 4.1 Given a scenario, apply common security techniques to computing resources
- 4.2 4.2 Explain the security implications of proper hardware, software, and data asset management
- 4.3 4.3 Explain various activities associated with vulnerability management
- 4.6 4.6 Given a scenario, implement and maintain identity and access management
- 4.7 4.7 Explain the importance of automation and orchestration related to secure operations
- 4.8 4.8 Explain appropriate incident response activities