SY0-701 Security Operations — 100 Questions

Question 1

A security operations analyst is tuning a SIEM correlation rule designed to detect brute-force password attacks against domain user accounts. The current rule generates an alert when a single user account has more than 10 failed logon attempts within a 5-minute window. The SOC team is overwhelmed by thousands of alerts each day, the vast majority of which are triggered by legitimate users who accidentally mistype their passwords. Which of the following modifications to the rule would most effectively reduce false positives while still detecting actual brute-force attacks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the failed attempt threshold to 20 attempts within the same 5-minute window.. Increasing the failed attempt threshold to 20 attempts within the same 5-minute window reduces false positives from legitimate users while still detecting brute-force attacks, which typically produce many more failures in a short period. Option B would suppress all single-source brute-force attacks, creating significant false negatives.

Answer

Modify the rule to trigger only when the failed attempts originate from multiple distinct source IP addresses.

Answer

Modify the rule to trigger only when the failed attempts are against multiple distinct user accounts.

Answer

Add an exception to suppress alerts for any user account that has a valid password reset request within the same time period.

Question 2

A security analyst is reviewing the perimeter firewall logs. The analyst observes repeated TCP SYN packets from a single external IP address (203.0.113.50) to multiple internal IP addresses on TCP port 3389. The packets are sent with a consistent 50-millisecond interval. There are no subsequent SYN-ACK or RST packets from the internal hosts in the logs. The analyst suspects this is a reconnaissance scan. Which of the following additional log sources would provide the most definitive evidence to confirm this suspicion?

Accepted Answer

Intrusion detection system (IDS) logs from a network-based IDS placed behind the firewall. A network-based IDS placed behind the firewall can analyze traffic that passes through the firewall and detect patterns consistent with a SYN scan, such as multiple SYN packets from a single source to multiple destinations without corresponding SYN-ACK or RST responses. It correlates the consistent interval and targeting of port 3389 to provide strong evidence of reconnaissance. However, if the firewall drops the packets before they reach internal hosts, an IDS behind the firewall would not see them. Since the firewall logs show the SYNs, the packets may be forwarded, allowing the IDS to observe them. Among the options, the IDS is the most definitive source for confirming the scan.

Answer

DNS query logs from the internal DNS server

Answer

Web proxy logs from the corporate proxy server

Answer

VPN gateway authentication logs

Question 3

A digital forensics analyst is investigating a suspected insider threat. The analyst has acquired a laptop used by the suspect. The analyst needs to obtain a forensic image of the hard drive without altering any data. The laptop is running and logged into the suspect's user account. Which of the following is the most appropriate first step for the analyst to take?

Accepted Answer

Pull the power cord from the laptop to immediately shut down the system and prevent any further system writes.. To preserve the hard drive without alteration, the analyst must perform a true hard shutdown that removes all power sources (AC and battery) or forces a power-off (e.g., by holding the power button). Simply unplugging AC power on a laptop leaves it running on battery, so the system can continue writing to the disk. In this scenario, none of the listed options correctly describes the first step, as the proper action (remove battery/AC or forced power-off) is absent.

Answer

Boot the laptop from a forensic boot CD that loads a write-blocker driver and then create a forensic image.

Answer

Perform a live acquisition of the hard drive using a network forensic tool while the system is still running.

Answer

Ask the suspect to log off and shut down the laptop normally, then remove the hard drive and image it using a write-blocker.

Question 4

A firewall rule was added directly in production to allow a new vendor IP range, and an internal service stopped responding because the new rule was placed above an existing deny rule. Which two change-management practices would have reduced the risk? Select two.

Accepted Answer

Test the rule in a staging environment that mirrors production. Testing the rule in a staging environment that mirrors production allows you to verify the rule's behavior—specifically its placement relative to existing deny rules—without risking service disruption. In a firewall rulebase, rules are processed top-down, and a new permit rule placed above a deny rule can inadvertently match and permit traffic that was previously denied, or conversely, block traffic if the rule is misordered. Staging testing would have revealed that the new rule's position caused the internal service to stop responding, enabling adjustment before production deployment. Additionally, requiring peer review and approval with a documented rollback plan ensures that changes are independently checked for issues like rule ordering and provides a quick way to revert the change if something goes wrong, minimizing impact on the internal service.

Answer

Apply the change during peak business hours to notice problems quickly

Answer

Disable firewall logging during the change to reduce noise

Answer

Skip documentation because the rule only affects one vendor

Question 5

A privileged cloud administrator account shows two suspicious events: an API key was created from an unfamiliar IP address, and a mailbox forwarding rule was added five minutes later. The account is still active and may be in attacker control. Which two actions should the analyst take first to preserve evidence while limiting additional abuse? Select two.

Accepted Answer

Export the relevant identity and audit logs before making changes, so the original event trail is preserved.. Exporting identity and audit logs before making changes preserves the original event trail, which is critical for forensic analysis and chain of custody. Revoking the suspicious API key or active session token immediately stops the attacker's access without deleting or altering the logs, thus limiting additional abuse while preserving evidence. Deleting the forwarding rule or disabling email could destroy evidence and should not be performed before the logs are exported.

Answer

Delete the mailbox forwarding rule and empty the trash folder, so the attacker cannot read old messages.

Answer

Reimage the admin workstation immediately, because the issue must have started on the endpoint.

Answer

Disable all company email for every user until the account investigation is finished.

Question 6

A server is suspected of being used for lateral movement after the SOC notices dozens of failed SSH logons, then a successful login from a new source IP, followed by new outbound SMB connections to internal hosts. The system is still running. Which two items should be collected first before any reboot or remediation? Select two.

Accepted Answer

A current list of logged-in users and active sessions, because it shows who has access right now.. Capturing a current list of logged-in users and active sessions provides immediate visibility into which accounts are currently authenticated and potentially being used by an attacker for lateral movement. Additionally, capturing live network connection information reveals current remote targets and suspicious channels, such as the new outbound SMB connections to internal hosts. This data is volatile and would be lost upon reboot, making it critical to collect both before any remediation. The successful SSH login from a new source IP suggests an attacker may have established a foothold, so both active sessions and network connections help identify compromised accounts and ongoing access.

Answer

The server’s warranty status, because hardware replacement may be needed later.

Answer

A fresh operating system patch, because updating quickly reduces all risk.

Answer

A user satisfaction survey, because affected staff can describe what they noticed.

Question 7

An investigator receives a suspect laptop that may be needed in court. The goal is to create a forensic image without changing the original drive contents. Which three actions best support chain of custody and evidence integrity? Select three.

Accepted Answer

Use a hardware write blocker during acquisition so the original disk cannot be modified.. A hardware write blocker is essential because it physically prevents any write commands from reaching the suspect drive, ensuring the original disk's contents remain unaltered during acquisition. Recording cryptographic hash values for both the original media and the forensic image validates that the image is an exact copy and detects any changes, supporting evidence integrity. Documenting every transfer of the laptop, including who had custody, when, and why, establishes a clear chain of custody required for admissibility in court. Together, these three actions preserve original evidence and maintain its integrity.

Answer

Browse the original disk using the operating system file explorer to confirm the case folder is present.

Answer

Store the suspect drive and the forensic copy in the same unlocked folder to simplify access.

Question 8

A SIEM correlation rule fires for a Microsoft 365 executive mailbox. At 02:14, the account signs in from a new country. At 02:17, the mailbox gets a forwarding rule that sends all mail to an external address. The user says they did not travel and did not create any rules. Which two log sources should the analyst review first to confirm whether this is account takeover or token abuse? Select two.

Accepted Answer

Identity provider sign-in logs, because they show source IP, MFA status, and session creation details.. Identity provider sign-in logs (e.g., Azure AD sign-in logs) capture the source IP address, MFA status, and session details. In this scenario, reviewing these logs can reveal whether the sign-in at 02:14 came from an unusual IP or lacked MFA, indicating an account takeover rather than token abuse. Mailbox audit logs are also necessary because they record the creation of the forwarding rule at 02:17 and can correlate it with the session, confirming whether the rule was created by the attacker within that session or by a separate token-abuse process. Together, these two log sources allow the analyst to distinguish between an account takeover (attacker using valid credentials) and token abuse (attacker using a stolen token without re-authentication).

Answer

DHCP lease logs, because they identify the internal workstation that first received the suspicious email.

Answer

Print server logs, because mailbox forwarding often causes documents to be printed unexpectedly.

Answer

Physical badge-access logs, because they prove whether the user was in the office when the login occurred.

Question 9

EDR on a finance workstation shows Outlook launching mshta.exe, followed by a scheduled task named UpdateSvc_91 and repeated HTTPS beacons to a newly registered domain. The user is still working and has not rebooted. Which two telemetry sources would best help the analyst confirm the initial execution path and determine whether the host has communicated with other suspicious infrastructure? Select two.

Accepted Answer

EDR process tree and parent-child execution telemetry, because it reveals the original application that launched the script host.. EDR process tree and parent-child execution telemetry directly reveal the initial execution path, showing that Outlook launched mshta.exe. This allows the analyst to trace the attack back to the original vector (e.g., a malicious email attachment or link) and understand how the script host was invoked, which is critical for identifying the root cause of the compromise. In addition, proxy or secure web gateway logs are essential for determining whether the host has communicated with other suspicious infrastructure, as they record all outbound requests, destinations, categories, and repeated beaconing patterns. Together, these two telemetry sources give a complete picture of the initial infection and subsequent command-and-control activity.

Answer

Spooler service logs, because mshta.exe commonly prints documents before starting network activity.

Answer

RAID controller logs, because they show whether the workstation’s storage hardware is failing.

Answer

NTP synchronization logs, because time drift is the most likely cause of the alert.

Question 10

A SIEM alert shows a successful sign-in to a cloud admin portal from an unusual country, followed by mailbox forwarding-rule changes four minutes later. Which two log sources should the analyst review first to confirm whether the account was abused? Select two.

Accepted Answer

Identity provider and MFA authentication logs for the account session. The identity provider (IdP) and MFA authentication logs are critical to verify whether the sign-in was performed with valid credentials and a successful second factor, revealing if the session itself was legitimate or the result of account takeover. The cloud application audit logs are equally important because they directly record mailbox and forwarding-rule changes, showing the actions taken during the session. Together, these two log sources provide the earliest and most direct evidence of account abuse—one confirms the authentication event, and the other confirms the suspicious activity. Network-level logs such as DHCP, printer spooler, or USB logs would not capture these cloud-based events.

Answer

Printer spooler logs from the user’s workstation

Answer

DHCP lease logs for the office network

Answer

USB device connection logs from the user’s laptop

Question 11

An investigator needs to make a forensic image of a suspect laptop without changing the original drive contents. Which two practices should be used? Select two.

Accepted Answer

Use a hardware or software write blocker during acquisition. A hardware or software write blocker is essential because it intercepts and blocks any write commands from the operating system to the suspect drive, ensuring that no data is altered during acquisition. This preserves the original drive's contents in a forensically sound state, which is a fundamental requirement for evidence admissibility. Additionally, recording SHA-256 hashes of both the source drive and the forensic image allows the investigator to verify that the image is an exact bit-for-bit copy. Comparing the hashes confirms data integrity after acquisition, ensuring that the image has not been altered or corrupted. Together, these practices protect the original evidence and prove the image's authenticity.

Answer

Mount the drive read/write so hidden files are easier to access

Answer

Defragment the drive first to improve imaging speed

Answer

Install triage tools directly on the suspect laptop

Question 12

A Windows laptop is believed to be involved in a credential-theft incident. It is still powered on, connected to Wi-Fi, and the user reports that the screen recently locked by itself. The SOC can reach the device remotely through EDR. Which two actions should be taken before the laptop is shut down? Select two.

Accepted Answer

Capture volatile data such as running processes and active network connections while the system is still live.. Capturing volatile data (e.g., running processes, active network connections, memory contents) is critical because it is lost when the system is powered off, so it must be collected while the laptop is still live to preserve evidence of the attacker's current activities. Additionally, placing the endpoint into network isolation through the EDR console stops further attacker communication and prevents additional data loss or lateral movement, and it does not destroy volatile evidence. Running a full antivirus scan, rebooting into Safe Mode, or powering off would destroy critical volatile evidence or alter the system state, so they must be avoided.

Answer

Run a full antivirus scan immediately, because the scan report will serve as the primary evidence.

Answer

Reboot the laptop into Safe Mode so the attacker’s code will not load.

Answer

Power off the laptop immediately to prevent the incident from spreading further.

Question 13

A company-owned laptop is suspected in an insider theft case and legal says the evidence may be used in court. Which two actions best support evidence admissibility during transport to the evidence locker? Select two.

Accepted Answer

Document the chain of custody with the collector, date, time, device condition, and transfer history.. Both actions protect the integrity and evidentiary value of the laptop. Chain-of-custody documentation creates a continuous, verifiable record of every transfer, showing who had control and that the device was not altered. Sealing the laptop in a tamper-evident bag and recording the seal number physically prevents or indicates tampering during transport and ties the evidence to the documented custody transfer. Together, they establish authenticity and integrity for admissibility.

Answer

Browse the user’s files to confirm whether the laptop contains stolen documents.

Answer

Remove the hard drive and place it in an unmarked box for convenience.

Answer

Let the employee continue using the laptop until legal staff are available.

Question 14

A new SIEM rule generates hundreds of alerts from a scheduled backup job that is known to be legitimate. Which two tuning changes are the best ways to reduce noise without losing visibility into real abuse? Select two.

Accepted Answer

Add a targeted exception for the known backup account, host, or signed process.. Adding a targeted exception for the known backup account, host, or signed process suppresses alerts for legitimate backup activity while still monitoring for anomalies. Additionally, baselining the backup job's expected schedule and source systems and alerting only on deviations (e.g., unusual timing or unexpected host) reduces noise while preserving detection of potentially abused credentials or compromised systems. These tuning changes reduce false positives without losing visibility into real abuse.

Answer

Disable the SIEM rule entirely because backup jobs are normal.

Answer

Mark every backup-related alert as harmless without review.

Answer

Stop logging backup systems so they no longer create noise.

Question 15

After isolating an infected endpoint and collecting volatile memory, the team identifies a malicious browser extension and a scheduled task used for persistence. Which two actions belong in the eradication phase before returning the system to service? Select two.

Accepted Answer

Remove the malicious extension and delete the persistence mechanism.. The eradication phase focuses on completely removing the threat from the system. This includes deleting malicious artifacts such as the browser extension and scheduled task, as well as taking stronger measures such as reimaging the host from a trusted gold image to ensure no malware remains. After eradication, recovery actions like restoring user data from backups and reconnecting the system to the network can be performed.

Answer

Restore user files from the most recent backup and reconnect the host immediately.

Answer

Announce the incident to users without changing the host configuration.

Answer

Leave the browser extension in place and only change the user password.

Question 16

A weekly vulnerability scan returns five findings across different systems. Which three should be remediated first? Select three.

Accepted Answer

A critical remote-code-execution flaw on an internet-facing VPN appliance with active exploitation reported.. The three findings to remediate first are A, C, and D. A is a critical RCE on an internet-facing VPN appliance with active exploitation, representing immediate operational risk. C uses default administrator credentials on an internet-facing management portal, allowing trivial unauthorized access. D is a high-severity RCE on a public customer portal storing account records, combining internet exposure with sensitive data impact. In contrast, B is on an offline lab VM with no connectivity, and E is a low-severity TLS warning on a site without sensitive data, making both lower priority.

Answer

A medium-severity missing patch on an offline lab VM with no network connectivity.

Answer

A low-severity TLS configuration warning on a public site that does not handle sensitive information.

Question 17

A ransomware incident encrypted a file share and the attached NAS backups because the NAS stayed mounted to production and was reachable over SMB. Which two design changes would have reduced the blast radius most effectively? Select two.

Accepted Answer

Keep at least one backup copy offline or immutable.. Keeping at least one backup copy offline or immutable ensures that even if the primary storage and network-attached backups are compromised, the offline or immutable copy remains intact and recoverable. In this scenario, the NAS was mounted and reachable over SMB, allowing ransomware to encrypt both the production share and the backup target. An immutable backup (e.g., using WORM storage or object lock) cannot be modified or deleted by the ransomware, breaking the encryption chain and preserving a clean recovery point. Option B is also correct because using a separate backup account and a restricted backup network segment limits the ability of ransomware to reach backup systems using compromised production credentials or lateral movement. By isolating backup management and access, the blast radius is reduced even if the production network is fully compromised.

Answer

Mount the backup share permanently so restores are always faster.

Answer

Join the NAS to the same administrative group used by production servers.

Answer

Disable restore testing to avoid risking the backup environment.

Question 18

A SIEM alert shows a workstation making repeated outbound HTTPS connections every 15 minutes to the same cloud IP address. The host belongs to the patch-management group, and the security team suspects an approved agent may be responsible. Which two checks best validate whether this is a false positive? Select two.

Accepted Answer

Verify that the destination domain and IP match the vendor's documented update service.. Verifying that the destination domain and IP match the vendor's documented update service (A) directly confirms whether the outbound HTTPS traffic is legitimate patch-management activity. Additionally, comparing the running process, parent process, and digital signature to the approved agent baseline (B) validates that the traffic originates from the approved software and not from a malicious process masquerading as the agent. Together, these two checks confirm both the destination and the source application, reducing false positives in SIEM alerts.

Answer

Immediately isolate the workstation from the network without reviewing any other evidence.

Answer

Suppress every future alert from that subnet permanently.

Answer

Assume the traffic is benign because it occurs at a regular interval.

Question 19

A SOC analyst confirms that a user entered corporate credentials into a fake sign-in page. Mailbox logs now show a new forwarding rule sending messages to an external address, and the attacker may still have an active session. Which two actions should the analyst take first to contain the account compromise? Select two.

Accepted Answer

Reset the user's password and require a fresh authentication challenge.. Resetting the user's password (Option A) immediately invalidates the credentials the attacker phished, preventing further authentication with those stolen credentials. Additionally, revoking active sessions and invalidating refresh tokens (Option B) is necessary because password reset alone does not terminate existing authenticated sessions or refresh tokens, which would otherwise allow the attacker to continue accessing the account. Together, these two actions provide immediate containment per NIST SP 800-61 incident response guidelines.

Answer

Delete the mailbox and create a new user account.

Answer

Disable all external email delivery for the entire organization.

Answer

Wait for the user to confirm whether the message was legitimate before acting.

Question 20

A Linux administrator must run a weekly maintenance script on 40 servers without giving technicians interactive root access. Which two practices best support secure administration? Select two.

Accepted Answer

Use a dedicated service account with only the required commands.. A dedicated service account with only the required commands implements the principle of least privilege. By using sudo or RBAC to restrict the account to exactly the commands needed for the maintenance script, the administrator avoids granting full root access while still allowing the script to execute with elevated privileges. This minimizes the attack surface and prevents unauthorized actions. Additionally, running the job through a scheduler or automation tool (option B) eliminates the need for interactive logins, ensuring the maintenance runs consistently and automatically without exposing root credentials. Automated execution can also be logged and audited, further improving security and accountability.

Answer

Share one root password across the whole team.

Answer

Embed the account password directly in the script.

Answer

Disable logging so the maintenance job runs faster.