SY0-701 Security Operations Practice Test 10 — 15 Questions

Question 1

A SIEM alert shows a payroll administrator account signed in at 02:10 from a country the employee has never visited. The employee says they are on vacation at home and did not travel. What should the analyst do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify the login context with the user or manager and review recent authentication history.. The first step in incident response is to verify the alert's validity and gather context before taking action. The analyst should review the SIEM logs for authentication details (e.g., source IP, geolocation, timestamp) and confirm with the user or manager whether the login was expected. This aligns with the NIST SP 800-61 incident response process, which emphasizes triage and validation before containment.

Answer

Immediately disable the account and wait for the employee to return.

Answer

Close the alert as a false positive because the user is on vacation.

Answer

Reimage the user’s workstation before checking any logs.

Question 2

Based on the exhibit, which improvement best aligns the current backup design with the stated recovery targets?

Accepted Answer

Switch to frequent incremental or snapshot backups stored in a separate, immutable location with routine restore tests.. The current backup design lacks off-site, immutable storage and routine restore testing, which are critical to meet recovery point and time objectives (RPO/RTO). Frequent incremental or snapshot backups in a separate, immutable location protect against ransomware and ensure data integrity, while routine restore tests verify that backups are actually recoverable when needed.

Answer

Keep the same design but extend backup retention from 30 days to 90 days.

Answer

Share the backup administrator password in a team chat so any engineer can restore data during an outage.

Answer

Remove backup encryption so restores run faster during an emergency.

Question 3

Based on the exhibit, what is the most likely SOC conclusion and next action?

A scheduled alert fired on a server that repeatedly connects to a vendor update site at fixed intervals. The security team wants to know whether the alert represents a real threat or a harmless operational pattern.

Accepted Answer

Classify the alert as a likely false positive, verify it against the maintenance record, and tune the rule.. The scheduled alert firing at fixed intervals to a known vendor update site strongly suggests a legitimate update or heartbeat mechanism, not malicious C2 traffic. Option B correctly directs the analyst to verify against maintenance records (confirming the pattern is expected) and then tune the rule to reduce future false positives, which is the standard SOC workflow for benign scheduled activity.

Answer

Treat the activity as confirmed command-and-control traffic and isolate the server immediately.

Answer

Assume DNS poisoning is occurring and immediately flush the DNS cache on every endpoint.

Answer

Open a credential theft incident and reset all administrator passwords across the environment.

Question 4

An ERP database is backed up nightly to a NAS that remains online and is managed with the same admin group as production servers. After a ransomware incident, management wants the most effective change to improve recovery assurance without redesigning the whole environment. What should be implemented?

Accepted Answer

Use an offline or immutable backup copy and perform regular restore tests.. An offline or immutable backup copy ensures that ransomware cannot encrypt or delete the backup data, and regular restore tests verify that the backups are actually recoverable. This directly addresses the core requirement of improving recovery assurance without redesigning the environment, as it protects the backup from the same attack vector that compromised the production servers and the NAS managed by the same admin group.

Answer

Increase the NAS capacity so more backup jobs can be stored.

Answer

Add another full backup each night to create more copies on the same NAS.

Answer

Compress the backup files to reduce network usage during the nightly job.

Question 5

An internal finance application has an RTO of 2 hours and an RPO of 30 minutes. Current backups restore in about 6 hours because the team must rebuild the server from scratch. Which change best aligns the recovery design to the business requirement?

Accepted Answer

Add a warm standby or replicated recovery system that can be brought online within the RTO. The business requires an RTO of 2 hours and an RPO of 30 minutes, but current backups take 6 hours to restore because the server must be rebuilt from scratch. Adding a warm standby or replicated recovery system allows the application to be brought online within the RTO by maintaining a pre-configured, partially synchronized environment that can be activated quickly, reducing recovery time from hours to minutes. This aligns the recovery design with the business continuity requirements by meeting both the RTO and RPO targets.

Answer

Keep the same design and simply increase backup retention

Answer

Switch to weekly full backups only

Answer

Reduce logging on the application server to improve restore speed

Question 6

During morning SIEM review, an analyst sees 37 failed SSH logins followed by a successful login to a Linux server from a jump host. The account belongs to a configuration-management service account, and the activity occurred inside the normal maintenance window. What should the analyst do next to determine whether the alert is a true positive or a false positive?

Accepted Answer

Correlate the event with the approved maintenance ticket and automation job logs.. The analyst should correlate the failed SSH logins with the approved maintenance ticket and automation job logs to verify if the activity is expected. The failed logins followed by a successful login from a jump host during a maintenance window are consistent with a configuration-management tool (e.g., Ansible, Puppet) retrying authentication. This correlation confirms whether the alert is a true positive (unauthorized access) or a false positive (routine automation).

Answer

Immediately isolate the Linux server from the network and begin recovery.

Answer

Reset the service account password before reviewing any additional evidence.

Answer

Disable SSH on the server until the next patch cycle is complete.

Question 7

A monthly scan finds a critical remote-code-execution vulnerability on an internet-facing VPN appliance. The vendor has not released a patch for six weeks, but the service must stay online. Which short-term action is the best risk treatment?

Accepted Answer

Apply compensating controls such as strict access filtering, MFA, enhanced logging, and alerting.. When a patch is unavailable for a critical vulnerability, compensating controls reduce risk without taking the service offline. For an internet-facing VPN appliance, strict access filtering (e.g., limiting source IPs via ACLs), enforcing MFA, and enabling enhanced logging/alerting can mitigate exploitation attempts while maintaining availability. This aligns with the risk treatment strategy of risk reduction through controls rather than acceptance, avoidance, or transfer.

Answer

Accept the risk and wait for the next scheduled scan cycle.

Answer

Disable all logging so the appliance performs better under load.

Answer

Ignore the issue until the vendor confirms the vulnerability is being actively exploited.

Question 8

A billing application has an RTO of 2 hours and an RPO of 30 minutes. The current recovery method requires rebuilding the VM from scratch and then restoring last night's backup, which takes over six hours. Which solution best meets the stated recovery objectives?

Accepted Answer

Use a warm standby replica with frequent log shipping or near-continuous replication.. A warm standby replica with frequent log shipping or near-continuous replication can achieve an RPO of 30 minutes or less by minimizing data loss, and an RTO of 2 hours by allowing rapid failover to the replica. This directly addresses the current recovery method's failure to meet the RTO (6+ hours vs. 2 hours) and RPO (last night's backup vs. 30 minutes). Technologies like SQL Server log shipping or VMware vSphere replication provide near-continuous data synchronization, enabling recovery within the stated objectives.

Answer

Keep the current backup schedule and shorten the documentation for the restore procedure.

Answer

Switch to weekly full backups and manually verify them after business hours.

Answer

Store backups on the same production host so restores are faster.

Question 9

During a restore test, a technician brings back a file server successfully, but the application team discovers that the database is missing the last 12 hours of transactions. Management says the business can tolerate only one hour of data loss. What should be changed first?

Accepted Answer

Implement application-consistent backups or transaction log backups more frequently.. The core issue is that the database is missing 12 hours of transactions, which exceeds the business's tolerance of one hour of data loss. This indicates that the Recovery Point Objective (RPO) is not being met. Implementing application-consistent backups or more frequent transaction log backups ensures that the database state can be recovered to a point within the acceptable loss window, directly addressing the RPO gap.

Answer

Reduce the restore point objective by storing more copies of the same backup.

Answer

Extend the retention period so the full backup is kept for 90 days.

Answer

Shorten the recovery time objective by using faster storage for the server.

Question 10

A help desk ticket confirms that a user entered corporate credentials into a fake sign-in page. Minutes later, the security team finds a new mailbox forwarding rule and evidence that the attacker added backup MFA codes. After disabling the account, what should the team do next to support containment and recovery?

Accepted Answer

Revoke active sessions and reset the compromised credentials.. After disabling a compromised account, the immediate next step is to revoke all active sessions and reset the credentials. This ensures the attacker cannot maintain access via existing tokens or session cookies, and the new password invalidates any cached or stolen credentials. This aligns with the NIST SP 800-61 incident response containment phase, which prioritizes cutting off active attacker access before further investigation.

Answer

Wait for the user to confirm the behavior before taking any further steps.

Answer

Reimage the user's laptop before reviewing the account activity.

Answer

Close the ticket because MFA was enabled and should have prevented access.

Question 11

Based on the exhibit, which temporary control best reduces risk until the patch is released?

Accepted Answer

Place the service behind a reverse proxy or WAF and restrict access with source IP allow lists.. Placing the service behind a reverse proxy or Web Application Firewall (WAF) with source IP allow lists provides a temporary compensating control that reduces the attack surface until the vendor releases a patch. The reverse proxy or WAF can inspect and filter malicious traffic, while IP allow lists restrict access to trusted sources only, mitigating the risk of exploitation without removing the service entirely.

Answer

Increase scan frequency to daily and leave the service exposed.

Answer

Disable TLS so the traffic can be inspected more easily.

Answer

Move administrative access to the same 443 listener as user traffic.

Question 12

Based on the exhibit, which change best moves the ERP recovery design toward meeting both recovery targets?

Accepted Answer

Add a warm standby database with 15-minute log shipping and scheduled failover tests.. Adding a warm standby database with 15-minute log shipping significantly reduces the recovery point objective (RPO) to near-zero and, combined with scheduled failover tests, ensures the recovery time objective (RTO) is met. This directly addresses the gap between the current backup-only approach and the required recovery targets, as log shipping provides near-continuous data protection and failover testing validates the recovery process.

Answer

Increase the full backup frequency to every night and keep the same recovery process.

Answer

Move backup media to the same server to reduce transfer time.

Answer

Eliminate differential backups and rely only on weekly full backups.

Question 13

The SOC has contained a mailbox compromise by resetting the password and revoking active sessions. Investigation shows the attacker created an automatic forwarding rule and added an OAuth consent grant. What should happen next to eradicate the threat?

Accepted Answer

Remove the malicious forwarding rule and review or revoke suspicious OAuth app grants.. The immediate next step after containment is to remove the attacker's persistence mechanisms. The malicious forwarding rule (which exfiltrates emails via SMTP) and the OAuth consent grant (which provides persistent API access) must be removed to fully eradicate the threat. Simply resetting the password and revoking sessions does not remove these backdoors, as OAuth grants persist independently of user credentials.

Answer

Notify all employees to be more careful with email before taking any technical steps.

Answer

Delete the mailbox and create a new account for the user immediately.

Answer

Restore the user's messages from backup and reopen access without further review.

Question 14

Based on the exhibit, which change best helps the company meet its recovery objectives after a ransomware event?

Accepted Answer

Move backups to an immutable, offline or logically isolated repository and test restores regularly.. Ransomware often encrypts or deletes accessible backups. An immutable, offline, or logically isolated repository prevents attackers from modifying or deleting backup data, ensuring a clean recovery point. Regularly testing restores validates that the backups are functional and meet recovery objectives (RTO/RPO). This aligns with the 3-2-1 backup rule and NIST SP 800-184 guidance for ransomware recovery.

Answer

Increase the retention period on the existing NAS backups to one year.

Answer

Store the backup administrator password in a shared team spreadsheet so more staff can restore data quickly.

Answer

Replace the nightly full backup with a longer full backup window to capture more data each day.

Question 15

Based on the exhibit, what is the most likely conclusion after correlating the logs?

A configuration-management task ran from a jump host and generated repeated login alerts on target servers. The SOC wants to determine whether this is malicious activity or approved automation.

Accepted Answer

This is a likely false positive caused by approved automation, so the alert should be correlated with the change window.. The logs show repeated login attempts from a jump host, which is a common pattern for configuration-management tools (e.g., Ansible, Puppet) that execute tasks across multiple servers. The SOC should correlate these events with the approved change window to confirm they are part of legitimate automation, not malicious activity. Failed logins alone do not indicate a brute-force attack, as automation scripts may retry connections or use cached credentials that occasionally fail due to network latency or credential rotation.

Answer

This is a true brute-force attack because any failed login must be malicious.

Answer

This indicates DNS poisoning because both servers were contacted from the same source IP.

Answer

This is proof of ransomware spreading laterally over SMB.