Objective 4.9
SY0-701Given a scenario, use data sources to support an investigation
Objective 4.9 sits in Security Operations, which carries 28% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.
Objective title verbatim from the official objectives. CompTIA exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A SOC analyst notices repeated failed logins for one account originating from several different IP addresses within a short window. Which category of application event must be logged to support detecting this pattern?
Correct.
Checked against learn.microsoft.com, July 2026Concept
Certain event categories are always recommended for logging because they support early detection of credential-based attacks.
Why B
Authentication successes and failures are always logged, since repeated failures across accounts or IP addresses are early indicators of brute-force or credential-stuffing activity.
Source
OWASP Logging Cheat Sheet, checked July 2026Authentication successes and failures Failed authentication attempts provide critical early indicators of credential‑based attacks such as brute‑force, credential‑stuffing, and password‑spraying. Monitoring repeated failures for the same account, failures from multiple IP addresses, or rapid bursts of login attempts helps detect account takeover attempts before they succeed.
Now you: objective 4.9 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A developer builds an application that writes its security event logs to a database using an account limited to inserting rows into log tables only, with no other database privileges. What logging practice does this reflect?
Sample question 2 of 3
An analyst charts failed login attempts over time and wants each source IP address to appear as its own line so trends per attacker can be compared visually. Which chart view option should the analyst configure?
Sample question 3 of 3
A responder compares web server logs against custom application logs during an investigation and finds the application logs contain far more context about the affected user. What explains this difference?
That’s 3 of the full Security+ bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.
More objectives in Security Operations
- 4.1 Given a scenario, apply common security techniques to computing resources
- 4.2 Explain the security implications of proper hardware, software, and data asset management
- 4.3 Explain various activities associated with vulnerability management
- 4.4 Explain security alerting and monitoring concepts and tools
- 4.5 Given a scenario, modify enterprise capabilities to enhance security
- 4.6 Given a scenario, implement and maintain identity and access management
- 4.7 Explain the importance of automation and orchestration related to secure operations
- 4.8 Explain appropriate incident response activities