Free Monitoring, Logging, and SIEM practice questions
10 free SY0-801 questions on Monitoring, Logging, and SIEM, each with a full explanation — no account needed. This section sits in the Security Operations part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
The CIO wants a monthly summary of patch compliance, incident counts and mean time to respond, and has no interest in reading raw logs. Which monitoring activity meets this need?
Reporting summarizes what monitoring found for people who won't read raw logs, such as monthly metrics for managers and executives. Alerting notifies someone the moment a condition is met, log aggregation gathers logs into one place, and archiving keeps older logs for a retention period; none of them produces the summary the CIO wants.
A CRM's own audit log shows one sales account exporting 38,000 customer records in 20 minutes. Every request was authenticated and well formed, and the server's CPU and memory stayed normal. Which kind of monitoring surfaced this activity?
The evidence came from the application's own records, and a business-level anomaly such as one account exporting tens of thousands of records is an application monitoring signal even when every request looks valid. System monitoring watches host health and activity, which stayed normal here, infrastructure monitoring covers network devices and platforms, and file integrity monitoring watches for changes to critical files, not data exports.
A rule allowing inbound RDP from any address appeared on the perimeter firewall at 11:40 p.m., and no change ticket covers it. The security team wants to be alerted within minutes the next time this happens. What should it monitor?
Infrastructure monitoring includes configuration changes on network devices, and a firewall rule added at night with no change ticket deserves an alert as much as a malware detection does. A weekly vulnerability scan might eventually notice the open port, but not within minutes, and file integrity hashes and synthetic portal logins watch other things entirely.
Firewall and domain controller logs older than 90 days are archived for one year. The risk team worries that an attacker who gains domain admin rights could delete the archive along with everything else. Which control BEST addresses that worry?
Immutable, write-once storage can't be altered or deleted early, and credentials kept apart from the domain mean a domain admin can't reach the archive at all. Hashing proves whether files changed but does nothing to stop deletion, a legal hold suspends routine deletion for litigation rather than blocking an attacker, and retrieval tests show the archive is usable, not that it is protected.
A network management system discovers every switch, router and firewall, polls them on a schedule and backs up their configurations. Why should it be protected as carefully as a domain controller?
To poll devices and back up their configurations, an NMS holds credentials for nearly every network device, so an attacker inside it can reach the whole network, as the SolarWinds Orion compromise showed. Correlating security events is a SIEM's job, and an NMS neither keeps the only copy of security logs nor enforces firewall rules.
After a firmware update on the perimeter firewalls, the SIEM still receives their events, but three correlation rules built on those events have not fired in two weeks, and no errors appear in the analysts' console. What is the MOST likely cause?
When a firmware update changes a log format, events keep arriving but land unparsed, so every rule that depends on their fields stops firing without any error an analyst would notice. The events still arrive, which rules out a forwarding failure, new events sit in hot storage rather than the cold tier, and deduplication collapses identical events into one record with a count rather than hiding a whole source.
An attacker guesses a VPN account's password after 30 attempts and signs in, and the SIEM rule meant to catch exactly that pattern never fires. Which outcome does this represent?
Malicious activity with no alert is a false negative, the worst outcome because nothing signals that it happened. A false positive is the opposite error, an alert on benign activity, and a true negative is benign activity correctly left alone.
A SOC dashboard charts failed logons against their usual baseline. Overnight the chart showed a spike ten times normal, but nobody saw it until the morning shift arrived. What should the team add so it learns of such spikes as they happen?
Dashboards support awareness but don't replace alerts; a spike on a chart that nobody is watching detects nothing. An alert rule notifies a person the moment the condition is met. More widgets and a monthly report still depend on someone looking, and longer retention only keeps data longer.
An engineer raised the threshold on a noisy SIEM rule to cut false positives. The attack the rule exists to catch has never occurred in the company's log history. Which step BEST confirms that the changed rule still detects that attack?
A controlled attack simulation or purple team exercise generates the very activity the rule exists for, so it shows whether the rule still fires. Replaying history and running in monitor-only mode compare alert volumes, which checks the false positive reduction, but with no instance of the attack in the history they can't prove detection. Change management records the change; it doesn't test it.
A laptop synchronized to the company's NTP servers was offline from Friday night until Monday afternoon, when it uploaded its backlog to the SIEM. A search for its Saturday events returns nothing, but a search covering Monday afternoon shows them all. What is the MOST likely cause?
The events arrived on Monday but happened on Saturday, so a search keyed on ingestion time files them under Monday; rules and searches should use the time the event happened. Clock drift would shift events by minutes, not move them to the upload time, recent data stays in hot storage, and a normalization failure wouldn't explain why the same events appear under Monday afternoon.
Study this section
Every lesson that covers Monitoring, Logging, and SIEM on the SY0-801 exam.