SY0-701 Security Operations Practice Test 10 — 15 Questions

Question 1

An ERP database is backed up nightly to a NAS that remains online and is managed with the same admin group as production servers. After a ransomware incident, management wants the most effective change to improve recovery assurance without redesigning the whole environment. What should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an offline or immutable backup copy and perform regular restore tests.. An offline or immutable backup copy ensures that ransomware cannot encrypt or delete the backup data, and regular restore tests verify that the backups are actually recoverable. This directly addresses the core requirement of improving recovery assurance without redesigning the environment, as it protects the backup from the same attack vector that compromised the production servers and the NAS managed by the same admin group.

Answer

Increase the NAS capacity so more backup jobs can be stored.

Answer

Add another full backup each night to create more copies on the same NAS.

Answer

Compress the backup files to reduce network usage during the nightly job.

Question 2

An internal finance application has an RTO of 2 hours and an RPO of 30 minutes. Current backups restore in about 6 hours because the team must rebuild the server from scratch. Which change best aligns the recovery design to the business requirement?

Accepted Answer

Add a warm standby or replicated recovery system that can be brought online within the RTO. The business requires an RTO of 2 hours and an RPO of 30 minutes, but current backups take 6 hours to restore because the server must be rebuilt from scratch. Adding a warm standby or replicated recovery system allows the application to be brought online within the RTO by maintaining a pre-configured, partially synchronized environment that can be activated quickly, reducing recovery time from hours to minutes. This aligns the recovery design with the business continuity requirements by meeting both the RTO and RPO targets.

Answer

Keep the same design and simply increase backup retention

Answer

Switch to weekly full backups only

Answer

Reduce logging on the application server to improve restore speed

Question 3

During morning SIEM review, an analyst sees 37 failed SSH logins followed by a successful login to a Linux server from a jump host. The account belongs to a configuration-management service account, and the activity occurred inside the normal maintenance window. What should the analyst do next to determine whether the alert is a true positive or a false positive?

Accepted Answer

Correlate the event with the approved maintenance ticket and automation job logs.. The analyst should correlate the failed SSH logins with the approved maintenance ticket and automation job logs to verify if the activity is expected. The failed logins followed by a successful login from a jump host during a maintenance window are consistent with a configuration-management tool (e.g., Ansible, Puppet) retrying authentication. This correlation confirms whether the alert is a true positive (unauthorized access) or a false positive (routine automation).

Answer

Immediately isolate the Linux server from the network and begin recovery.

Answer

Reset the service account password before reviewing any additional evidence.

Answer

Disable SSH on the server until the next patch cycle is complete.

Question 4

A monthly scan finds a critical remote-code-execution vulnerability on an internet-facing VPN appliance. The vendor has not released a patch for six weeks, but the service must stay online. Which short-term action is the best risk treatment?

Accepted Answer

Apply compensating controls such as strict access filtering, MFA, enhanced logging, and alerting.. When a patch is unavailable for a critical vulnerability, compensating controls reduce risk without taking the service offline. For an internet-facing VPN appliance, strict access filtering (e.g., limiting source IPs via ACLs), enforcing MFA, and enabling enhanced logging/alerting can mitigate exploitation attempts while maintaining availability. This aligns with the risk treatment strategy of risk reduction through controls rather than acceptance, avoidance, or transfer.

Answer

Accept the risk and wait for the next scheduled scan cycle.

Answer

Disable all logging so the appliance performs better under load.

Answer

Ignore the issue until the vendor confirms the vulnerability is being actively exploited.

Question 5

A billing application has an RTO of 2 hours and an RPO of 30 minutes. The current recovery method requires rebuilding the VM from scratch and then restoring last night's backup, which takes over six hours. Which solution best meets the stated recovery objectives?

Accepted Answer

Use a warm standby replica with frequent log shipping or near-continuous replication.. A warm standby replica with frequent log shipping or near-continuous replication can achieve an RPO of 30 minutes or less by minimizing data loss, and an RTO of 2 hours by allowing rapid failover to the replica. This directly addresses the current recovery method's failure to meet the RTO (6+ hours vs. 2 hours) and RPO (last night's backup vs. 30 minutes). Technologies like SQL Server log shipping or VMware vSphere replication provide near-continuous data synchronization, enabling recovery within the stated objectives.

Answer

Keep the current backup schedule and shorten the documentation for the restore procedure.

Answer

Switch to weekly full backups and manually verify them after business hours.

Answer

Store backups on the same production host so restores are faster.

Question 6

During a restore test, a technician brings back a file server successfully, but the application team discovers that the database is missing the last 12 hours of transactions. Management says the business can tolerate only one hour of data loss. What should be changed first?

Accepted Answer

Implement application-consistent backups or transaction log backups more frequently.. The core issue is that the database is missing 12 hours of transactions, which exceeds the business's tolerance of one hour of data loss. This indicates that the Recovery Point Objective (RPO) is not being met. Implementing application-consistent backups or more frequent transaction log backups ensures that the database state can be recovered to a point within the acceptable loss window, directly addressing the RPO gap.

Answer

Reduce the restore point objective by storing more copies of the same backup.

Answer

Extend the retention period so the full backup is kept for 90 days.

Answer

Shorten the recovery time objective by using faster storage for the server.

Question 7

A help desk ticket confirms that a user entered corporate credentials into a fake sign-in page. Minutes later, the security team finds a new mailbox forwarding rule and evidence that the attacker added backup MFA codes. After disabling the account, what should the team do next to support containment and recovery?

Accepted Answer

Revoke active sessions and reset the compromised credentials.. After disabling a compromised account, the immediate next step is to revoke all active sessions and reset the credentials. This ensures the attacker cannot maintain access via existing tokens or session cookies, and the new password invalidates any cached or stolen credentials. This aligns with the NIST SP 800-61 incident response containment phase, which prioritizes cutting off active attacker access before further investigation.

Answer

Wait for the user to confirm the behavior before taking any further steps.

Answer

Reimage the user's laptop before reviewing the account activity.

Answer

Close the ticket because MFA was enabled and should have prevented access.

Question 8

Based on the exhibit, which temporary control best reduces risk until the patch is released?

Accepted Answer

Place the service behind a reverse proxy or WAF and restrict access with source IP allow lists.. Placing the service behind a reverse proxy or Web Application Firewall (WAF) with source IP allow lists provides a temporary compensating control that reduces the attack surface until the vendor releases a patch. The reverse proxy or WAF can inspect and filter malicious traffic, while IP allow lists restrict access to trusted sources only, mitigating the risk of exploitation without removing the service entirely.

Answer

Increase scan frequency to daily and leave the service exposed.

Answer

Disable TLS so the traffic can be inspected more easily.

Answer

Move administrative access to the same 443 listener as user traffic.

Question 9

Based on the exhibit, which change best moves the ERP recovery design toward meeting both recovery targets?

Accepted Answer

Add a warm standby database with 15-minute log shipping and scheduled failover tests.. Adding a warm standby database with 15-minute log shipping significantly reduces the recovery point objective (RPO) to near-zero and, combined with scheduled failover tests, ensures the recovery time objective (RTO) is met. This directly addresses the gap between the current backup-only approach and the required recovery targets, as log shipping provides near-continuous data protection and failover testing validates the recovery process.

Answer

Increase the full backup frequency to every night and keep the same recovery process.

Answer

Move backup media to the same server to reduce transfer time.

Answer

Eliminate differential backups and rely only on weekly full backups.

Question 10

The SOC has contained a mailbox compromise by resetting the password and revoking active sessions. Investigation shows the attacker created an automatic forwarding rule and added an OAuth consent grant. What should happen next to eradicate the threat?

Accepted Answer

Remove the malicious forwarding rule and review or revoke suspicious OAuth app grants.. The immediate next step after containment is to remove the attacker's persistence mechanisms. The malicious forwarding rule (which exfiltrates emails via SMTP) and the OAuth consent grant (which provides persistent API access) must be removed to fully eradicate the threat. Simply resetting the password and revoking sessions does not remove these backdoors, as OAuth grants persist independently of user credentials.

Answer

Notify all employees to be more careful with email before taking any technical steps.

Answer

Delete the mailbox and create a new account for the user immediately.

Answer

Restore the user's messages from backup and reopen access without further review.

Question 11

Based on the exhibit, which change best helps the company meet its recovery objectives after a ransomware event?

Accepted Answer

Move backups to an immutable, offline or logically isolated repository and test restores regularly.. Ransomware often encrypts or deletes accessible backups. An immutable, offline, or logically isolated repository prevents attackers from modifying or deleting backup data, ensuring a clean recovery point. Regularly testing restores validates that the backups are functional and meet recovery objectives (RTO/RPO). This aligns with the 3-2-1 backup rule and NIST SP 800-184 guidance for ransomware recovery.

Answer

Increase the retention period on the existing NAS backups to one year.

Answer

Store the backup administrator password in a shared team spreadsheet so more staff can restore data quickly.

Answer

Replace the nightly full backup with a longer full backup window to capture more data each day.

Question 12

Based on the exhibit, what is the most likely conclusion after correlating the logs?

A configuration-management task ran from a jump host and generated repeated login alerts on target servers. The SOC wants to determine whether this is malicious activity or approved automation.

Accepted Answer

This is a likely false positive caused by approved automation, so the alert should be correlated with the change window.. The logs show repeated login attempts from a jump host, which is a common pattern for configuration-management tools (e.g., Ansible, Puppet) that execute tasks across multiple servers. The SOC should correlate these events with the approved change window to confirm they are part of legitimate automation, not malicious activity. Failed logins alone do not indicate a brute-force attack, as automation scripts may retry connections or use cached credentials that occasionally fail due to network latency or credential rotation.

Answer

This is a true brute-force attack because any failed login must be malicious.

Answer

This indicates DNS poisoning because both servers were contacted from the same source IP.

Answer

This is proof of ransomware spreading laterally over SMB.

Question 13

Based on the exhibit, what is the best immediate action for the SOC or IR team?

A finance workstation shows evidence of a macro-launched script, followed by file renaming and lateral SMB traffic to two other hosts. The team has not yet determined the full scope of the incident.

Accepted Answer

Isolate the host from the network and revoke its remote access to stop further spread.. The exhibit shows a macro-launched script, file renaming, and lateral SMB traffic to two other hosts, indicating active lateral movement. Isolating the host (e.g., via network access control or disabling the switch port) immediately stops the spread of the malware to other systems, preserving the ability to investigate without further compromise. This aligns with the first step in incident response: containment before eradication or recovery.

Answer

Restore the workstation from backup immediately before preserving any evidence.

Answer

Run a vulnerability scan against the subnet to see whether the malware exploited an unpatched service.

Answer

Notify users to ignore the issue until the next maintenance window because the incident is likely self-limiting.

Question 14

Based on the exhibit, what is the best eradication decision for the server compromise?

Accepted Answer

Rebuild the server from a trusted image and restore only known-good data after evidence is preserved.. A server compromise implies that the attacker may have achieved persistence through modified binaries, kernel modules, or rootkits that cannot be reliably removed by simple remediation steps. Rebuilding from a trusted image ensures that all malicious artifacts are eliminated, and restoring only known-good data from backups (after forensic preservation) prevents reintroduction of compromised files. This aligns with the CompTIA incident response process, where eradication must remove all traces of the threat, and rebuilding is the safest approach for a confirmed compromise.

Answer

Restart sshd and monitor the system for another login attempt.

Answer

Manually delete the cron entry and reverse the SSH change on the live server.

Answer

Increase the SIEM retention period and keep the current server online.

Question 15

A SOC analyst reviews email platform logs for a finance user account. At 08:12, the user successfully signs in from Denver. At 08:15, the same account signs in from a residential ISP in another state. At 08:16, the mailbox creates a new external forwarding rule and deletes the original alert message. The user says they did not set up forwarding. What is the best assessment?

Accepted Answer

True positive indicating likely account compromise and unauthorized mailbox abuse.. The rapid succession of logins from geographically distant locations (Denver and a different state via a residential ISP) within three minutes, followed immediately by creation of an external forwarding rule and deletion of the original alert message, is a classic indicator of account takeover. The user's denial of setting up forwarding confirms the activity is unauthorized. This pattern aligns with attacker behavior: after compromising credentials, they establish persistence (forwarding) and cover tracks (deleting alerts).

Answer

False positive caused by normal mailbox synchronization behavior across devices.

Answer

Benign activity because the user successfully authenticated with valid credentials and no malware was detected.

Answer

A denial-of-service event because the attacker is attempting to overwhelm the mail system.