SY0-701 Security Operations Practice Test 11 — 15 Questions

Question 1

A scan keeps reporting the same medium-severity TLS configuration issue on a public web server. The application owner says the vendor software cannot be changed until next quarter, but they can place the service behind a reverse proxy that enforces stronger cipher settings. How should the issue be handled in the vulnerability management process?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Record an exception, document the compensating control, and set a review or remediation date. The vulnerability management process requires that when a vulnerability cannot be immediately remediated, compensating controls must be formally documented as an exception with a scheduled remediation date. In this scenario, the reverse proxy enforces stronger cipher settings, effectively mitigating the TLS misconfiguration at the network edge, which is a valid compensating control. Recording the exception ensures auditability and prevents the finding from being prematurely closed while the vendor software remains vulnerable.

Answer

Close the finding as fixed because the reverse proxy reduces the risk

Answer

Mark the finding as a false positive and remove it from future scans

Answer

Ignore the finding until the vendor releases a new version

Question 2

Based on the exhibit, what is the most likely explanation for the alert?

Accepted Answer

The workstation has been redirected to an approved corporate proxy, so the event is expected.. The alert indicates that the workstation's DNS traffic is being redirected to an internal proxy server (10.0.0.53), which is a common configuration in corporate environments for content filtering and security monitoring. Since the destination IP (10.0.0.53) is within the organization's private IP range and the proxy is explicitly approved, this behavior is expected and not malicious. The event is consistent with a transparent proxy or DNS-based proxy redirection, where the workstation's DNS queries are intercepted and forwarded to the corporate proxy.

Answer

A DNS cache poisoning attack is in progress and the workstation is now using a rogue gateway.

Answer

The endpoint is infected with malware that is hiding its traffic through encrypted tunnels.

Answer

The workstation is under a denial-of-service attack because it sent repeated DNS lookups.

Question 3

A SIEM rule flags a Linux server because it makes outbound HTTPS connections to the same cloud IP every 15 minutes. The server runs an approved patch agent that should check in on a regular schedule. Which two checks best validate whether the alert is a false positive? Select two.

Accepted Answer

Compare the process name, parent process, and digital signature to the approved agent baseline.. Comparing the process name, parent process, and digital signature against the approved agent baseline directly validates that the traffic originates from the legitimate patch agent and not from malware masquerading as the agent. This is a standard host-based validation technique to confirm the source process integrity before investigating network alerts.

Answer

Assume the traffic is benign because it happens on a fixed schedule.

Answer

Suppress all alerts from the host permanently after this one event.

Answer

Stop collecting logs from the server so the same alert does not recur.

Question 4

A legacy application server has a critical vulnerability, but the vendor will not release a fix for 30 days. Which two compensating controls are the best short-term risk reduction steps? Select two.

Accepted Answer

Restrict access to the server to known admin IPs or a jump host.. Restricting access to the server to known admin IPs or a jump host reduces the attack surface by limiting who can reach the vulnerable service. This network-layer control (e.g., using ACLs or firewall rules) prevents exploitation from untrusted sources while the vendor patch is pending. It is a classic compensating control that buys time without modifying the application itself.

Answer

Document the issue and wait for the vendor patch without making any changes.

Answer

Open the service to more networks so monitoring tools can see it better.

Answer

Disable logging to reduce the performance overhead caused by the vulnerability.

Question 5

An IDS raises an alert for a possible SQL injection attack against an internal reporting portal. The web server logs show the source IP belongs to the company's vulnerability scanner, and the requests match the scanner's normal test pattern. What is the most appropriate analyst action?

Accepted Answer

Mark the alert as a likely false positive after verifying the scanner schedule and source IP.. The IDS alert matches the known behavior of the company's vulnerability scanner, which is a legitimate and scheduled security tool. Verifying the scanner schedule and source IP confirms the traffic is authorized, making the alert a false positive. Analysts should correlate IDS alerts with asset inventories and change management records to avoid unnecessary incident response actions.

Answer

Treat the alert as a confirmed breach and begin password resets for all portal users.

Answer

Block the scanner IP permanently to prevent future alerts from the same host.

Answer

Quarantine the reporting server because IDS alerts always indicate active exploitation.

Question 6

A SIEM alert shows a workstation connecting to the same unknown internet address every 15 minutes, even after business hours. The device belongs to an employee who is on vacation. What is the best next step for the analyst?

Accepted Answer

Treat the alert as potentially malicious and check endpoint and proxy logs for more context.. The alert describes a persistent outbound connection to an unknown external IP address at regular intervals, which is a classic indicator of beaconing behavior often associated with malware command-and-control (C2) traffic. The fact that the connection occurs after business hours and the workstation's user is on vacation increases suspicion, as legitimate scheduled tasks or updates would typically not run under those conditions. Checking endpoint and proxy logs provides the necessary context to determine if the traffic is benign (e.g., a misconfigured service) or malicious (e.g., C2 communication).

Answer

Dismiss the alert because periodic connections are always normal for workstations.

Answer

Immediately delete the workstation account from the directory service.

Answer

Shut down the entire office network until the analyst can review the alert.

Question 7

An EDR alert shows winword.exe launching powershell.exe with an encoded command after a user opened an invoice attachment. No new executable file was written to disk, and the host is still online. Which two actions should the SOC analyst take first to validate the alert and collect usable evidence? Select two.

Accepted Answer

Review the parent-child process chain and the full PowerShell command line in EDR.. Reviewing the parent-child process chain (winword.exe → powershell.exe) and the full PowerShell command line in the EDR allows the analyst to immediately validate whether the alert is a true positive by confirming the process lineage and decoding the encoded command. This step is critical for understanding the attacker's intent without relying on disk artifacts, as the attack is fileless and memory-resident.

Answer

Compare the endpoint's outbound connections with its normal baseline and approved destinations.

Answer

Reimage the workstation immediately to eliminate any possible persistence.

Answer

Ask the user to delete the suspicious email and clear the recycle bin.

Question 8

At 10:15, a file server begins renaming documents and creating payment notes. The SOC confirms the server is also making SMB connections to other internal hosts, but users can still access shared folders. What should the incident handler do FIRST?

Accepted Answer

Disconnect the server from the network or isolate it through EDR containment while preserving power. The correct first step is to contain the incident by disconnecting the server from the network or using EDR containment while preserving power. This stops the spread of malicious SMB connections and prevents further damage, while keeping the system powered on to preserve volatile evidence (e.g., memory, running processes) for forensic analysis. Immediate containment aligns with the NIST incident response framework's containment phase, prioritizing isolation over eradication or recovery.

Answer

Shut down the server immediately to stop all malicious activity

Answer

Restore the server from backup before taking any other action

Answer

Wait for users to report more symptoms before responding

Question 9

Based on the exhibit, which issue should be remediated first by the operations team?

A small company has limited maintenance windows and can address only one of several findings this week.

Accepted Answer

vpn-gw01, because it is internet-facing, exploitable now, and a fix is available.. Vpn-gw01 is internet-facing, has an active exploit (CVSS score indicating current exploitation), and a vendor patch is available. In risk management, the highest priority is given to assets that are exposed to the internet, currently exploitable, and have a known fix, as this combination presents the most urgent threat to the organization's security posture.

Answer

db-lab02, because high-severity findings always outrank medium and critical findings.

Answer

printsrv03, because it is internet-facing and has no vendor patch available.

Answer

None of these, because the team should wait for the next quarterly review before changing anything.

Question 10

A vulnerability dashboard shows four new findings. Which one should be remediated first by the operations team?

- A low-severity issue on an offline lab VM
- A medium-severity issue on a payroll server with no known exploit
- A critical issue on an internet-facing web server with an available exploit
- A high-severity issue on a test workstation that is not domain joined

Accepted Answer

The critical issue on the internet-facing web server with an available exploit.. The critical issue on the internet-facing web server with an available exploit should be remediated first because it combines the highest severity (critical) with an active, exploitable vulnerability on an asset exposed to the public internet. In vulnerability management, remediation priority is determined by risk, which is a function of severity, exploitability, and asset exposure. An internet-facing web server with a known exploit represents an immediate threat that can be remotely compromised, unlike the other findings which are on isolated or less critical systems.

Answer

The low-severity issue on the offline lab VM.

Answer

The medium-severity issue on the payroll server with no known exploit.

Answer

The high-severity issue on the test workstation that is not domain joined.

Question 11

Based on the exhibit, what is the best eradication decision after containment?

A quarantined endpoint was found to have a malicious startup item and a scheduled task. The team has already isolated it from the network and preserved memory for analysis.

Accepted Answer

Remove persistence artifacts and rebuild the endpoint from a known-good image before returning it to service.. After containment (network isolation and memory preservation), the best eradication step is to remove all persistence mechanisms (startup item and scheduled task) and rebuild the endpoint from a known-good image. This ensures that any undetected malware remnants, rootkits, or hidden artifacts are eliminated, preventing reinfection. Simply deleting files or changing DNS does not guarantee the system is clean, and reconnecting without a full rebuild risks lateral movement or data exfiltration.

Answer

Delete only the update.exe file and reconnect the host once the user confirms it is working.

Answer

Restore network connectivity now because no encryption was observed.

Answer

Change the DNS servers for the entire enterprise to block the malware domain.

Question 12

Based on the exhibit, which finding is the best candidate for immediate remediation or emergency mitigation?

Accepted Answer

VPN-EDGE01, because a critical internet-facing RCE with public exploit code has the highest risk.. VPN-EDGE01 is an internet-facing device with a critical remote code execution (RCE) vulnerability that has public exploit code available. This combination of high severity, network exposure, and weaponized exploit makes it the highest risk and most urgent for immediate remediation or emergency mitigation.

Answer

FILE-02, because file servers often affect many users and should always come before perimeter systems.

Answer

TEST-VM-17, because any high-severity issue deserves the fastest response regardless of exposure.

Answer

PRINTER-3F, because default credentials are the easiest issue to exploit and therefore the most dangerous.

Question 13

A user reports that a shared department drive is rapidly renaming files and creating ransom notes on a Windows file server. The SOC confirms suspicious activity is still occurring on that server. What should the incident responder do first?

Accepted Answer

Isolate the server from the network while keeping it powered on if possible.. The immediate priority is to contain the ransomware outbreak by isolating the server from the network, which stops the malicious activity from spreading to other systems while preserving volatile evidence (e.g., running processes, memory contents) for forensic analysis. Powering off the server (Option A) would destroy this critical evidence and may not stop the encryption process if it is already in memory. Isolation via network disconnection (e.g., disabling the NIC or unplugging the cable) is the standard first step in incident response for active ransomware.

Answer

Shut down the server immediately to stop all malicious activity.

Answer

Restore the drive from backup before collecting any evidence.

Answer

Inform users to continue working until the forensic team arrives.

Question 14

Based on the exhibit, what is the most important next IR action?

Accepted Answer

Revoke active sessions and OAuth consent grants for the account.. The exhibit shows a compromised account with a suspicious inbox rule forwarding emails externally. The most critical next step is to revoke active sessions and OAuth consent grants to immediately terminate the attacker's access and prevent further data exfiltration, as changing the password alone does not invalidate existing OAuth tokens or active sessions.

Answer

Change the password again and monitor the mailbox for a few days.

Answer

Restore the deleted inbox rule from backup to preserve evidence.

Answer

Close the incident because the forwarding rule was removed.

Question 15

A SOC analyst receives an alert that a domain admin account authenticated to a file server at 02:14 from a jump host that is normally used only by the infrastructure team. The Windows logs also show a scheduled task launching a backup script at the same time, and the backup team says the task was created during yesterday's change window. What is the best next step to determine whether this is a false positive?

Accepted Answer

Correlate the authentication event with the change ticket and the scheduled task details.. The alert involves a domain admin authentication from a jump host at an unusual time, but the scheduled task was created during a change window. Correlating the authentication event with the change ticket and the scheduled task details allows the SOC analyst to verify if the activity was authorized, preventing unnecessary incident response. This step aligns with the incident response process of validating alerts before taking action.

Answer

Disable the domain admin account immediately and wait for the backup team to respond.

Answer

Escalate the alert as confirmed compromise because the login occurred after hours.

Answer

Delete the scheduled task so it cannot be used again.