SY0-701 Question 309
Single answerMonitoring computing resources: Systems , Applications , InfrastructureA security administrator is investigating an intermittent outage affecting a public web application hosted on several virtual servers behind a load balancer. Users report slow response times followed by brief periods when the application is unavailable. Initial firewall and IDS reviews show no obvious external attack signatures. The administrator needs to improve monitoring so the team can quickly determine whether future incidents are caused by host resource exhaustion, application failures, or supporting infrastructure issues. Which of the following would provide the BEST visibility across systems, applications, and infrastructure for this purpose?
- A
Enable centralized monitoring that collects host performance metrics, application/service logs, and infrastructure telemetry from the load balancer and hypervisors into a SIEM/dashboard with alerting thresholds
- B
Increase the web servers' local log retention period from 7 days to 30 days and review the logs manually after the next outage
- C
Deploy a vulnerability scanner to run weekly credentialed scans against the web servers and compare the results over time
- D
Configure endpoint protection on each web server to automatically quarantine suspicious processes when CPU utilization exceeds 90%
Show answer and explanation
Correct answer: A
Explanation
The best answer is the centralized monitoring solution because the administrator needs correlated visibility across multiple resource domains: systems, applications, and infrastructure. In practice, security and operations teams monitor system metrics such as CPU, memory, disk I/O, and network throughput; application data such as web server logs, application errors, response times, and service health; and infrastructure signals such as load balancer health checks, virtual host contention, and network device telemetry. Centralizing these sources allows faster identification of whether an outage is caused by host resource exhaustion, application faults, or supporting platform issues. This approach is consistent with common guidance from NIST on log management and continuous monitoring, including NIST SP 800-92 for log management and NIST SP 800-137 for information security continuous monitoring. Security+ expects candidates to understand that effective monitoring is layered, centralized, and actionable through alerting and correlation rather than relying on a single host-based or point-in-time tool.
- A. Correct.
Correct. The scenario specifically requires visibility across three layers: systems, applications, and infrastructure. Centralized monitoring of host metrics such as CPU, memory, disk, and network usage helps identify system resource exhaustion; application and service logs help identify crashes, thread pool exhaustion, database connection failures, or timeout conditions; and infrastructure telemetry from the load balancer and hypervisors helps identify issues such as failed health checks, backend pool imbalance, packet drops, or host contention. Feeding these data sources into a SIEM or monitoring dashboard with thresholds and alerting aligns with Security+ monitoring objectives and real-world best practices for rapid detection and triage.
- B. Incorrect.
Incorrect. Longer retention may help with historical analysis, but it does not provide the best visibility for quickly determining the cause of future incidents. Manual review after an outage is reactive and slow, and this option does not address infrastructure telemetry or proactive alerting. A candidate might choose this because log retention is useful, but retention alone is not a complete monitoring strategy.
- C. Incorrect.
Incorrect. Vulnerability scanning is valuable for identifying missing patches, insecure configurations, and exposed services, but it is not designed to diagnose intermittent performance and availability events in real time. Weekly scans also do not provide operational telemetry across the system, application, and infrastructure layers. This distractor reflects the common misconception that all security tooling contributes equally to operational monitoring.
- D. Incorrect.
Incorrect. Endpoint protection can detect malware and suspicious behavior on hosts, but CPU spikes do not necessarily indicate malicious activity. Automatically quarantining processes based only on high utilization could disrupt legitimate application services and worsen availability. This option also fails to monitor the application and infrastructure layers comprehensively. Someone might choose it because high CPU can accompany attacks, but the requirement is visibility and diagnosis, not aggressive automated containment.