Which Security Control Prevents Modification of Sensitive PII Data?

SY0-701 By islever Editorial Last updated

Short answer

C File integrity monitoring

Question

A bank set up a new server that contains customers' PII. Which of the following should the bank use to make sure the sensitive data is not modified?
  1. Full disk encryption
  2. Network access control
  3. File integrity monitoring Correct Answer
  4. User behavior analytics

Key Takeaways

The question tests the difference between confidentiality controls (encryption, NAC) and integrity controls (FIM); the trap is assuming any security tool works for all data protections.

For protecting sensitive PII on a new server, File Integrity Monitoring (FIM) is the consensus choice because it detects unauthorized file modifications, unlike encryption or access controls which address different goals.

Common mistake: Choosing Full Disk Encryption (A) is common because encryption is often associated with protecting sensitive data, but encryption protects confidentiality (reading) not integrity (modifying).

Expert Analysis

Why the Answer Is Correct

File Integrity Monitoring (FIM) is designed to detect unauthorized changes to files by comparing current file states against a known, good baseline. Since the requirement is specifically to ensure sensitive data is not modified, FIM directly addresses data integrity. As comment [2] notes, FIM validates integrity using verification methods between current and baseline states. Community comments uniformly support answer C, with comment [1] highlighting that FIM identifies and alerts on any changes to files containing PII.

Why the Other Options Are Wrong

Full disk encryption (A) protects data at rest from being read by unauthorized parties but does not prevent authorized or malicious modification once the system is running. Network access control (B) regulates who can connect to the network but does not monitor file alterations after access is granted. User behavior analytics (D) detects anomalous user activities but is not specifically designed to validate file integrity or detect modifications to data files. Each option addresses a different security goal—confidentiality, access control, and behavioral detection—rather than integrity.

Community Comment Notes

All three commenters agree that C is correct. Comment [1] explicitly says FIM's purpose is to monitor and detect unauthorized modifications. Comment [2] provides a formal definition of FIM as an internal control that validates integrity against a baseline. No dissenting views are present in the comments. The unanimous consensus reinforces that integrity monitoring is the distinct control needed in this scenario.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

For CompTIA Security+ questions, map the security goal to the control: confidentiality (encryption), integrity (FIM/hashing), availability (redundancy). Read the keyword 'not modified' as a direct indicator of integrity, and eliminate options that address other goals even if they sound protective.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. dbrowndiver 👍 4 Answered C
    File Integrity Monitoring is the correct answer because it specifically addresses the need to monitor and detect unauthorized modifications to sensitive data. FIM ensures that any changes to files containing PII are identified and alerted, maintaining data integrity and protecting against unauthorized alterations.
  2. Dlove 👍 2 Answered C
    C. File Integrity Monitoring File integrity monitoring is an internal control or process that performs the act of validating the integrity of operating system and application software files using a verification method between the current file state and a known, good baseline.
  3. Shaman73 👍 2 Answered C
    C. File integrity monitoring

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide