CompTIA Security+ SY0-701 Security Automation and Orchestration Practice Test

 

Topic 20 focuses on Security Automation and Orchestration for the CompTIA Security+ certification and the SY0-701 exam, using practical cybersecurity scenarios aligned to the published Security+ objectives. For broader exam preparation, review the CompTIA Security+ SY0-701 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

Which term describes use of scripts, workflows, or identity systems to create accounts and access based on approved triggers?

1. Automated security-group management
2. Automated resource provisioning
3. Automated user provisioning
4. Automation complexity risk

Correct Answer: C

 

Correct Answer

Answer C is correct because Automated user provisioning means use of scripts, workflows, or identity systems to create accounts and access based on approved triggers.

Incorrect Answers

Answer A is incorrect because Automated security-group management represents a different security function. Automated security-group management refers to use of code or workflow to create and update network or cloud access rules consistently.

Answer B is incorrect because Automated resource provisioning addresses a different requirement. Automated resource provisioning refers to creation of infrastructure or services through code, templates, or workflow.

Answer D is incorrect because Automation complexity risk would fit a different scenario. Automation complexity risk refers to operational risk created when automated workflows become difficult to understand, test, or troubleshoot.

 

Question 2

To deploy repeatable resources with consistent security settings, which security approach should be selected?

1. Automation complexity risk
2. Automated resource provisioning
3. Single-point-of-failure risk
4. Automated ticket creation

Correct Answer: B

 

Correct Answer

Answer B is correct because Automated resource provisioning means creation of infrastructure or services through code, templates, or workflow.

Incorrect Answers

Answer A is incorrect because Automation complexity risk addresses a different requirement. Automation complexity risk refers to operational risk created when automated workflows become difficult to understand, test, or troubleshoot.

Answer C is incorrect because Single-point-of-failure risk would fit a different scenario. Single-point-of-failure risk refers to risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails.

Answer D is incorrect because Automated ticket creation addresses a different security requirement. Automated ticket creation refers to generation of service or incident records directly from monitoring or workflow events.

 

Question 3

Which automated policy constraint prevents or flags insecure configurations while still allowing approved self-service?

1. Reaction-time benefit
2. Automation complexity risk
3. Guardrail
4. Automated service disablement

Correct Answer: C

 

Correct Answer

Answer C is correct because Guardrail means an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service.

Incorrect Answers

Answer A is incorrect because Reaction-time benefit represents a different security function. Reaction-time benefit refers to reduction in delay between detection and a predefined response action.

Answer B is incorrect because Automation complexity risk would fit a different scenario. Automation complexity risk refers to operational risk created when automated workflows become difficult to understand, test, or troubleshoot.

Answer D is incorrect because Automated service disablement addresses a different requirement. Automated service disablement refers to workflow that disables accounts, services, or access when risk conditions are met.

 

Question 4

To apply approved connectivity policy at scale, which security approach should be selected?

1. Technical debt risk
2. Automated escalation
3. Automated security-group management
4. Automation complexity risk

Correct Answer: C

 

Correct Answer

Answer C is correct because Automated security-group management means use of code or workflow to create and update network or cloud access rules consistently.

Incorrect Answers

Answer A is incorrect because Technical debt risk addresses a different security requirement. Technical debt risk refers to future maintenance burden created by quick or poorly documented automation choices.

Answer B is incorrect because Automated escalation addresses a different requirement. Automated escalation refers to routing of alerts or tasks to higher-priority responders based on severity, time, or conditions.

Answer D is incorrect because Automation complexity risk would fit a different scenario. Automation complexity risk refers to operational risk created when automated workflows become difficult to understand, test, or troubleshoot.

 

Question 5

Which term describes generation of service or incident records directly from monitoring or workflow events?

1. Reaction-time benefit
2. Technical debt risk
3. Continuous integration security testing
4. Automated ticket creation

Correct Answer: D

 

Correct Answer

Answer D is correct because Automated ticket creation means generation of service or incident records directly from monitoring or workflow events.

Incorrect Answers

Answer A is incorrect because Reaction-time benefit would fit a different scenario. Reaction-time benefit refers to reduction in delay between detection and a predefined response action.

Answer B is incorrect because Technical debt risk addresses a different requirement. Technical debt risk refers to future maintenance burden created by quick or poorly documented automation choices.

Answer C is incorrect because Continuous integration security testing represents a different security function. Continuous integration security testing refers to automated security checks integrated into software build and delivery pipelines.

 

Question 6

To reduce delay when an event exceeds normal handling thresholds, which security approach should be selected?

1. Automated ticket creation
2. Baseline enforcement benefit
3. Guardrail
4. Automated escalation

Correct Answer: D

 

Correct Answer

Answer D is correct because Automated escalation means routing of alerts or tasks to higher-priority responders based on severity, time, or conditions.

Incorrect Answers

Answer A is incorrect because Automated ticket creation would fit a different scenario. Automated ticket creation refers to generation of service or incident records directly from monitoring or workflow events.

Answer B is incorrect because Baseline enforcement benefit addresses a different requirement. Baseline enforcement benefit refers to automation that repeatedly applies approved configurations and detects or corrects drift.

Answer C is incorrect because Guardrail addresses a different security requirement. Guardrail refers to an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service.

 

Question 7

Which term describes workflow that disables accounts, services, or access when risk conditions are met?

1. Automated user provisioning
2. Automated ticket creation
3. Automated service disablement
4. Automated escalation

Correct Answer: C

 

Correct Answer

Answer C is correct because Automated service disablement means workflow that disables accounts, services, or access when risk conditions are met.

Incorrect Answers

Answer A is incorrect because Automated user provisioning would fit a different scenario. Automated user provisioning refers to use of scripts, workflows, or identity systems to create accounts and access based on approved triggers.

Answer B is incorrect because Automated ticket creation addresses a different requirement. Automated ticket creation refers to generation of service or incident records directly from monitoring or workflow events.

Answer D is incorrect because Automated escalation represents a different security function. Automated escalation refers to routing of alerts or tasks to higher-priority responders based on severity, time, or conditions.

 

Question 8

To identify insecure code or dependencies before release, which security approach should be selected?

1. Continuous integration security testing
2. Baseline enforcement benefit
3. Automated escalation
4. Automated user provisioning

Correct Answer: A

 

Correct Answer

Answer A is correct because Continuous integration security testing means automated security checks integrated into software build and delivery pipelines.

Incorrect Answers

Answer B is incorrect because Baseline enforcement benefit would fit a different scenario. Baseline enforcement benefit refers to automation that repeatedly applies approved configurations and detects or corrects drift.

Answer C is incorrect because Automated escalation addresses a different security requirement. Automated escalation refers to routing of alerts or tasks to higher-priority responders based on severity, time, or conditions.

Answer D is incorrect because Automated user provisioning addresses a different requirement. Automated user provisioning refers to use of scripts, workflows, or identity systems to create accounts and access based on approved triggers.

 

Question 9

Which term describes programmatic connection between security tools so one system can query or trigger actions in another?

1. API integration
2. Automated security-group management
3. Guardrail
4. Workforce-multiplier benefit

Correct Answer: A

 

Correct Answer

Answer A is correct because API integration means programmatic connection between security tools so one system can query or trigger actions in another.

Incorrect Answers

Answer B is incorrect because Automated security-group management represents a different security function. Automated security-group management refers to use of code or workflow to create and update network or cloud access rules consistently.

Answer C is incorrect because Guardrail addresses a different requirement. Guardrail refers to an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service.

Answer D is incorrect because Workforce-multiplier benefit would fit a different scenario. Workforce-multiplier benefit refers to use of automation to handle repeatable tasks so analysts can focus on higher-value decisions.

 

Question 10

To improve consistency across large environments, which security approach should be selected?

1. Automated security-group management
2. Baseline enforcement benefit
3. Automation complexity risk
4. API integration

Correct Answer: B

 

Correct Answer

Answer B is correct because Baseline enforcement benefit means automation that repeatedly applies approved configurations and detects or corrects drift.

Incorrect Answers

Answer A is incorrect because Automated security-group management addresses a different requirement. Automated security-group management refers to use of code or workflow to create and update network or cloud access rules consistently.

Answer C is incorrect because Automation complexity risk would fit a different scenario. Automation complexity risk refers to operational risk created when automated workflows become difficult to understand, test, or troubleshoot.

Answer D is incorrect because API integration addresses a different security requirement. API integration refers to programmatic connection between security tools so one system can query or trigger actions in another.

 

Question 11

Which term describes reduction in delay between detection and a predefined response action?

1. Single-point-of-failure risk
2. Workforce-multiplier benefit
3. Reaction-time benefit
4. Technical debt risk

Correct Answer: C

 

Correct Answer

Answer C is correct because Reaction-time benefit means reduction in delay between detection and a predefined response action.

Incorrect Answers

Answer A is incorrect because Single-point-of-failure risk would fit a different scenario. Single-point-of-failure risk refers to risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails.

Answer B is incorrect because Workforce-multiplier benefit represents a different security function. Workforce-multiplier benefit refers to use of automation to handle repeatable tasks so analysts can focus on higher-value decisions.

Answer D is incorrect because Technical debt risk addresses a different requirement. Technical debt risk refers to future maintenance burden created by quick or poorly documented automation choices.

 

Question 12

To increase operational capacity without linearly increasing staff, which security approach should be selected?

1. Automation complexity risk
2. Guardrail
3. Technical debt risk
4. Workforce-multiplier benefit

Correct Answer: D

 

Correct Answer

Answer D is correct because Workforce-multiplier benefit means use of automation to handle repeatable tasks so analysts can focus on higher-value decisions.

Incorrect Answers

Answer A is incorrect because Automation complexity risk would fit a different scenario. Automation complexity risk refers to operational risk created when automated workflows become difficult to understand, test, or troubleshoot.

Answer B is incorrect because Guardrail addresses a different requirement. Guardrail refers to an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service.

Answer C is incorrect because Technical debt risk addresses a different security requirement. Technical debt risk refers to future maintenance burden created by quick or poorly documented automation choices.

 

Question 13

Which term describes operational risk created when automated workflows become difficult to understand, test, or troubleshoot?

1. Automation complexity risk
2. Automated ticket creation
3. Guardrail
4. Continuous integration security testing

Correct Answer: A

 

Correct Answer

Answer A is correct because Automation complexity risk means operational risk created when automated workflows become difficult to understand, test, or troubleshoot.

Incorrect Answers

Answer B is incorrect because Automated ticket creation addresses a different requirement. Automated ticket creation refers to generation of service or incident records directly from monitoring or workflow events.

Answer C is incorrect because Guardrail would fit a different scenario. Guardrail refers to an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service.

Answer D is incorrect because Continuous integration security testing represents a different security function. Continuous integration security testing refers to automated security checks integrated into software build and delivery pipelines.

 

Question 14

To design redundancy and safe failure modes for central automation components, which security approach should be selected?

1. Workforce-multiplier benefit
2. Automation complexity risk
3. API integration
4. Single-point-of-failure risk

Correct Answer: D

 

Correct Answer

Answer D is correct because Single-point-of-failure risk means risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails.

Incorrect Answers

Answer A is incorrect because Workforce-multiplier benefit would fit a different scenario. Workforce-multiplier benefit refers to use of automation to handle repeatable tasks so analysts can focus on higher-value decisions.

Answer B is incorrect because Automation complexity risk addresses a different security requirement. Automation complexity risk refers to operational risk created when automated workflows become difficult to understand, test, or troubleshoot.

Answer C is incorrect because API integration addresses a different requirement. API integration refers to programmatic connection between security tools so one system can query or trigger actions in another.

 

Question 15

Which term describes future maintenance burden created by quick or poorly documented automation choices?

1. Reaction-time benefit
2. Technical debt risk
3. Automated user provisioning
4. Automated service disablement

Correct Answer: B

 

Correct Answer

Answer B is correct because Technical debt risk means future maintenance burden created by quick or poorly documented automation choices.

Incorrect Answers

Answer A is incorrect because Reaction-time benefit addresses a different requirement. Reaction-time benefit refers to reduction in delay between detection and a predefined response action.

Answer C is incorrect because Automated user provisioning represents a different security function. Automated user provisioning refers to use of scripts, workflows, or identity systems to create accounts and access based on approved triggers.

Answer D is incorrect because Automated service disablement would fit a different scenario. Automated service disablement refers to workflow that disables accounts, services, or access when risk conditions are met.

 

Question 16

To reduce manual errors and speed controlled onboarding, which security approach should be selected?

1. Automated user provisioning
2. Continuous integration security testing
3. Baseline enforcement benefit
4. Automated security-group management

Correct Answer: A

 

Correct Answer

Answer A is correct because Automated user provisioning means use of scripts, workflows, or identity systems to create accounts and access based on approved triggers.

Incorrect Answers

Answer B is incorrect because Continuous integration security testing addresses a different requirement. Continuous integration security testing refers to automated security checks integrated into software build and delivery pipelines.

Answer C is incorrect because Baseline enforcement benefit would fit a different scenario. Baseline enforcement benefit refers to automation that repeatedly applies approved configurations and detects or corrects drift.

Answer D is incorrect because Automated security-group management represents a different security function. Automated security-group management refers to use of code or workflow to create and update network or cloud access rules consistently.

 

Question 17

Which term describes creation of infrastructure or services through code, templates, or workflow?

1. Automated resource provisioning
2. Automated security-group management
3. Automated service disablement
4. Automated user provisioning

Correct Answer: A

 

Correct Answer

Answer A is correct because Automated resource provisioning means creation of infrastructure or services through code, templates, or workflow.

Incorrect Answers

Answer B is incorrect because Automated security-group management would fit a different scenario. Automated security-group management refers to use of code or workflow to create and update network or cloud access rules consistently.

Answer C is incorrect because Automated service disablement addresses a different requirement. Automated service disablement refers to workflow that disables accounts, services, or access when risk conditions are met.

Answer D is incorrect because Automated user provisioning addresses a different security requirement. Automated user provisioning refers to use of scripts, workflows, or identity systems to create accounts and access based on approved triggers.

 

Question 18

To keep teams within defined security boundaries without requiring every action to be manual, which security approach should be selected?

1. Single-point-of-failure risk
2. Automated resource provisioning
3. Automated ticket creation
4. Guardrail

Correct Answer: D

 

Correct Answer

Answer D is correct because Guardrail means an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service.

Incorrect Answers

Answer A is incorrect because Single-point-of-failure risk represents a different security function. Single-point-of-failure risk refers to risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails.

Answer B is incorrect because Automated resource provisioning addresses a different requirement. Automated resource provisioning refers to creation of infrastructure or services through code, templates, or workflow.

Answer C is incorrect because Automated ticket creation would fit a different scenario. Automated ticket creation refers to generation of service or incident records directly from monitoring or workflow events.

 

Question 19

Which term describes use of code or workflow to create and update network or cloud access rules consistently?

1. Automated resource provisioning
2. Single-point-of-failure risk
3. Automated security-group management
4. API integration

Correct Answer: C

 

Correct Answer

Answer C is correct because Automated security-group management means use of code or workflow to create and update network or cloud access rules consistently.

Incorrect Answers

Answer A is incorrect because Automated resource provisioning addresses a different security requirement. Automated resource provisioning refers to creation of infrastructure or services through code, templates, or workflow.

Answer B is incorrect because Single-point-of-failure risk addresses a different requirement. Single-point-of-failure risk refers to risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails.

Answer D is incorrect because API integration would fit a different scenario. API integration refers to programmatic connection between security tools so one system can query or trigger actions in another.

 

Question 20

To ensure detected issues enter a trackable response process, which security approach should be selected?

1. API integration
2. Automated ticket creation
3. Automation complexity risk
4. Technical debt risk

Correct Answer: B

 

Correct Answer

Answer B is correct because Automated ticket creation means generation of service or incident records directly from monitoring or workflow events.

Incorrect Answers

Answer A is incorrect because API integration would fit a different scenario. API integration refers to programmatic connection between security tools so one system can query or trigger actions in another.

Answer C is incorrect because Automation complexity risk addresses a different requirement. Automation complexity risk refers to operational risk created when automated workflows become difficult to understand, test, or troubleshoot.

Answer D is incorrect because Technical debt risk represents a different security function. Technical debt risk refers to future maintenance burden created by quick or poorly documented automation choices.

 

Question 21

Which term describes routing of alerts or tasks to higher-priority responders based on severity, time, or conditions?

1. Automated escalation
2. Guardrail
3. Single-point-of-failure risk
4. Automated user provisioning

Correct Answer: A

 

Correct Answer

Answer A is correct because Automated escalation means routing of alerts or tasks to higher-priority responders based on severity, time, or conditions.

Incorrect Answers

Answer B is incorrect because Guardrail would fit a different scenario. Guardrail refers to an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service.

Answer C is incorrect because Single-point-of-failure risk addresses a different security requirement. Single-point-of-failure risk refers to risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails.

Answer D is incorrect because Automated user provisioning addresses a different requirement. Automated user provisioning refers to use of scripts, workflows, or identity systems to create accounts and access based on approved triggers.

 

Question 22

To contain compromise quickly while preserving auditable decision logic, which security approach should be selected?

1. Workforce-multiplier benefit
2. Technical debt risk
3. Continuous integration security testing
4. Automated service disablement

Correct Answer: D

 

Correct Answer

Answer D is correct because Automated service disablement means workflow that disables accounts, services, or access when risk conditions are met.

Incorrect Answers

Answer A is incorrect because Workforce-multiplier benefit would fit a different scenario. Workforce-multiplier benefit refers to use of automation to handle repeatable tasks so analysts can focus on higher-value decisions.

Answer B is incorrect because Technical debt risk represents a different security function. Technical debt risk refers to future maintenance burden created by quick or poorly documented automation choices.

Answer C is incorrect because Continuous integration security testing addresses a different requirement. Continuous integration security testing refers to automated security checks integrated into software build and delivery pipelines.

 

Question 23

Which term describes automated security checks integrated into software build and delivery pipelines?

1. Single-point-of-failure risk
2. Continuous integration security testing
3. Workforce-multiplier benefit
4. Technical debt risk

Correct Answer: B

 

Correct Answer

Answer B is correct because Continuous integration security testing means automated security checks integrated into software build and delivery pipelines.

Incorrect Answers

Answer A is incorrect because Single-point-of-failure risk would fit a different scenario. Single-point-of-failure risk refers to risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails.

Answer C is incorrect because Workforce-multiplier benefit addresses a different requirement. Workforce-multiplier benefit refers to use of automation to handle repeatable tasks so analysts can focus on higher-value decisions.

Answer D is incorrect because Technical debt risk addresses a different security requirement. Technical debt risk refers to future maintenance burden created by quick or poorly documented automation choices.

 

Question 24

To orchestrate security workflows across multiple platforms, which security approach should be selected?

1. API integration
2. Workforce-multiplier benefit
3. Single-point-of-failure risk
4. Automation complexity risk

Correct Answer: A

 

Correct Answer

Answer A is correct because API integration means programmatic connection between security tools so one system can query or trigger actions in another.

Incorrect Answers

Answer B is incorrect because Workforce-multiplier benefit addresses a different requirement. Workforce-multiplier benefit refers to use of automation to handle repeatable tasks so analysts can focus on higher-value decisions.

Answer C is incorrect because Single-point-of-failure risk represents a different security function. Single-point-of-failure risk refers to risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails.

Answer D is incorrect because Automation complexity risk would fit a different scenario. Automation complexity risk refers to operational risk created when automated workflows become difficult to understand, test, or troubleshoot.

 

Question 25

Which term describes automation that repeatedly applies approved configurations and detects or corrects drift?

1. API integration
2. Baseline enforcement benefit
3. Automated service disablement
4. Automated security-group management

Correct Answer: B

 

Correct Answer

Answer B is correct because Baseline enforcement benefit means automation that repeatedly applies approved configurations and detects or corrects drift.

Incorrect Answers

Answer A is incorrect because API integration addresses a different security requirement. API integration refers to programmatic connection between security tools so one system can query or trigger actions in another.

Answer C is incorrect because Automated service disablement would fit a different scenario. Automated service disablement refers to workflow that disables accounts, services, or access when risk conditions are met.

Answer D is incorrect because Automated security-group management addresses a different requirement. Automated security-group management refers to use of code or workflow to create and update network or cloud access rules consistently.