ExamworthyExamworthy
Open the appStart free

SY0-701 - Security Operations - Section 4.4

Explain security alerting and monitoring concepts and tools.

Describe how a SIEM centralises log aggregation and correlation to generate security alerts, and explain how SNMP and scanning tools contribute to continuous visibility across the environment. Distinguish between reactive alerting on known signatures and proactive monitoring approaches, recognising that effective alerting requires tuning to reduce false positives without suppressing genuine threats.

SIEMlog aggregationSNMPalertingscanning tools

Practice question for this objective

Free sampleSecurity Operationsmedium

Which option best contrasts log aggregation with log correlation as activities supported by a modern monitoring platform?

  • AAggregation rewrites raw log records so that sensitive fields are redacted before storage, while correlation forwards the redacted records to analysts over encrypted channels.
  • BAggregation signs each log entry with the source's private key, while correlation verifies those signatures before any rule evaluation can run on the platform.
  • CAggregation runs only on the originating endpoint and ships compressed archives nightly, while correlation runs only inside cloud SaaS platforms over the same archives.
  • DAggregation collects and centralises log records from many sources into a common store, while correlation analyses relationships between those records to identify patterns of interest. Correct
Distinguish log aggregation, which centralises records, from log correlation, which analyses relationships between records to find patterns. Aggregation answers the question of where the data goes by collecting events from heterogeneous producers into a single platform with a common schema and retention policy. Correlation answers the question of what the data means by running rules, queries, or models across those events to spot multi-source patterns such as a brute force followed by a successful login from a new country. Both activities are needed for useful monitoring, but they address different problems in the pipeline.

Why A is wrong: Field redaction is a data protection or tokenisation concern, not the definition of aggregation. Correlation is not a forwarding activity, so the contrast misrepresents both terms.

Why B is wrong: Digital signing of log entries is a log integrity concern handled by specific transport or storage features, not the defining work of aggregation. Correlation does not depend on signature verification.

Why C is wrong: Aggregation routinely uses near real-time collectors, not nightly archives, and correlation is not restricted to SaaS environments. The geography described is not part of either definition.

Why D is correct: This is the standard contrast: aggregation is the collection and centralisation step, and correlation is the analytical step that links related events across sources and time to detect meaningful activity.

See more SY0-701 practice questions, answers explained.

More in this domain

Back to all Security Operations objectives, or the SY0-701 cert hub.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.