SY0-701 Security Operations Practice Test 11 — 15 Questions

Question 1

Based on the exhibit, what is the best immediate action for the SOC or IR team?

A finance workstation shows evidence of a macro-launched script, followed by file renaming and lateral SMB traffic to two other hosts. The team has not yet determined the full scope of the incident.

Accepted Answer

Isolate the host from the network and revoke its remote access to stop further spread.. The exhibit shows a macro-launched script, file renaming, and lateral SMB traffic to two other hosts, indicating active lateral movement. Isolating the host (e.g., via network access control or disabling the switch port) immediately stops the spread of the malware to other systems, preserving the ability to investigate without further compromise. This aligns with the first step in incident response: containment before eradication or recovery.

Answer

Restore the workstation from backup immediately before preserving any evidence.

Answer

Run a vulnerability scan against the subnet to see whether the malware exploited an unpatched service.

Answer

Notify users to ignore the issue until the next maintenance window because the incident is likely self-limiting.

Question 2

Based on the exhibit, what is the best eradication decision for the server compromise?

Accepted Answer

Rebuild the server from a trusted image and restore only known-good data after evidence is preserved.. A server compromise implies that the attacker may have achieved persistence through modified binaries, kernel modules, or rootkits that cannot be reliably removed by simple remediation steps. Rebuilding from a trusted image ensures that all malicious artifacts are eliminated, and restoring only known-good data from backups (after forensic preservation) prevents reintroduction of compromised files. This aligns with the CompTIA incident response process, where eradication must remove all traces of the threat, and rebuilding is the safest approach for a confirmed compromise.

Answer

Restart sshd and monitor the system for another login attempt.

Answer

Manually delete the cron entry and reverse the SSH change on the live server.

Answer

Increase the SIEM retention period and keep the current server online.

Question 3

A SOC analyst reviews email platform logs for a finance user account. At 08:12, the user successfully signs in from Denver. At 08:15, the same account signs in from a residential ISP in another state. At 08:16, the mailbox creates a new external forwarding rule and deletes the original alert message. The user says they did not set up forwarding. What is the best assessment?

Accepted Answer

True positive indicating likely account compromise and unauthorized mailbox abuse.. The rapid succession of logins from geographically distant locations (Denver and a different state via a residential ISP) within three minutes, followed immediately by creation of an external forwarding rule and deletion of the original alert message, is a classic indicator of account takeover. The user's denial of setting up forwarding confirms the activity is unauthorized. This pattern aligns with attacker behavior: after compromising credentials, they establish persistence (forwarding) and cover tracks (deleting alerts).

Answer

False positive caused by normal mailbox synchronization behavior across devices.

Answer

Benign activity because the user successfully authenticated with valid credentials and no malware was detected.

Answer

A denial-of-service event because the attacker is attempting to overwhelm the mail system.

Question 4

A scan keeps reporting the same medium-severity TLS configuration issue on a public web server. The application owner says the vendor software cannot be changed until next quarter, but they can place the service behind a reverse proxy that enforces stronger cipher settings. How should the issue be handled in the vulnerability management process?

Accepted Answer

Record an exception, document the compensating control, and set a review or remediation date. The vulnerability management process requires that when a vulnerability cannot be immediately remediated, compensating controls must be formally documented as an exception with a scheduled remediation date. In this scenario, the reverse proxy enforces stronger cipher settings, effectively mitigating the TLS misconfiguration at the network edge, which is a valid compensating control. Recording the exception ensures auditability and prevents the finding from being prematurely closed while the vendor software remains vulnerable.

Answer

Close the finding as fixed because the reverse proxy reduces the risk

Answer

Mark the finding as a false positive and remove it from future scans

Answer

Ignore the finding until the vendor releases a new version

Question 5

Based on the exhibit, what is the most likely explanation for the alert?

Accepted Answer

The workstation has been redirected to an approved corporate proxy, so the event is expected.. The alert indicates that the workstation's DNS traffic is being redirected to an internal proxy server (10.0.0.53), which is a common configuration in corporate environments for content filtering and security monitoring. Since the destination IP (10.0.0.53) is within the organization's private IP range and the proxy is explicitly approved, this behavior is expected and not malicious. The event is consistent with a transparent proxy or DNS-based proxy redirection, where the workstation's DNS queries are intercepted and forwarded to the corporate proxy.

Answer

A DNS cache poisoning attack is in progress and the workstation is now using a rogue gateway.

Answer

The endpoint is infected with malware that is hiding its traffic through encrypted tunnels.

Answer

The workstation is under a denial-of-service attack because it sent repeated DNS lookups.

Question 6

A SIEM rule flags a Linux server because it makes outbound HTTPS connections to the same cloud IP every 15 minutes. The server runs an approved patch agent that should check in on a regular schedule. Which two checks best validate whether the alert is a false positive? Select two.

Accepted Answer

Compare the process name, parent process, and digital signature to the approved agent baseline.. Comparing the process name, parent process, and digital signature against the approved agent baseline directly validates that the traffic originates from the legitimate patch agent and not from malware masquerading as the agent. This is a standard host-based validation technique to confirm the source process integrity before investigating network alerts.

Answer

Assume the traffic is benign because it happens on a fixed schedule.

Answer

Suppress all alerts from the host permanently after this one event.

Answer

Stop collecting logs from the server so the same alert does not recur.

Question 7

A legacy application server has a critical vulnerability, but the vendor will not release a fix for 30 days. Which two compensating controls are the best short-term risk reduction steps? Select two.

Accepted Answer

Restrict access to the server to known admin IPs or a jump host.. Restricting access to the server to known admin IPs or a jump host reduces the attack surface by limiting who can reach the vulnerable service. This network-layer control (e.g., using ACLs or firewall rules) prevents exploitation from untrusted sources while the vendor patch is pending. It is a classic compensating control that buys time without modifying the application itself.

Answer

Document the issue and wait for the vendor patch without making any changes.

Answer

Open the service to more networks so monitoring tools can see it better.

Answer

Disable logging to reduce the performance overhead caused by the vulnerability.

Question 8

An IDS raises an alert for a possible SQL injection attack against an internal reporting portal. The web server logs show the source IP belongs to the company's vulnerability scanner, and the requests match the scanner's normal test pattern. What is the most appropriate analyst action?

Accepted Answer

Mark the alert as a likely false positive after verifying the scanner schedule and source IP.. The IDS alert matches the known behavior of the company's vulnerability scanner, which is a legitimate and scheduled security tool. Verifying the scanner schedule and source IP confirms the traffic is authorized, making the alert a false positive. Analysts should correlate IDS alerts with asset inventories and change management records to avoid unnecessary incident response actions.

Answer

Treat the alert as a confirmed breach and begin password resets for all portal users.

Answer

Block the scanner IP permanently to prevent future alerts from the same host.

Answer

Quarantine the reporting server because IDS alerts always indicate active exploitation.

Question 9

A SIEM alert shows a workstation connecting to the same unknown internet address every 15 minutes, even after business hours. The device belongs to an employee who is on vacation. What is the best next step for the analyst?

Accepted Answer

Treat the alert as potentially malicious and check endpoint and proxy logs for more context.. The alert describes a persistent outbound connection to an unknown external IP address at regular intervals, which is a classic indicator of beaconing behavior often associated with malware command-and-control (C2) traffic. The fact that the connection occurs after business hours and the workstation's user is on vacation increases suspicion, as legitimate scheduled tasks or updates would typically not run under those conditions. Checking endpoint and proxy logs provides the necessary context to determine if the traffic is benign (e.g., a misconfigured service) or malicious (e.g., C2 communication).

Answer

Dismiss the alert because periodic connections are always normal for workstations.

Answer

Immediately delete the workstation account from the directory service.

Answer

Shut down the entire office network until the analyst can review the alert.

Question 10

An EDR alert shows winword.exe launching powershell.exe with an encoded command after a user opened an invoice attachment. No new executable file was written to disk, and the host is still online. Which two actions should the SOC analyst take first to validate the alert and collect usable evidence? Select two.

Accepted Answer

Review the parent-child process chain and the full PowerShell command line in EDR.. Reviewing the parent-child process chain (winword.exe → powershell.exe) and the full PowerShell command line in the EDR allows the analyst to immediately validate whether the alert is a true positive by confirming the process lineage and decoding the encoded command. This step is critical for understanding the attacker's intent without relying on disk artifacts, as the attack is fileless and memory-resident.

Answer

Compare the endpoint's outbound connections with its normal baseline and approved destinations.

Answer

Reimage the workstation immediately to eliminate any possible persistence.

Answer

Ask the user to delete the suspicious email and clear the recycle bin.

Question 11

At 10:15, a file server begins renaming documents and creating payment notes. The SOC confirms the server is also making SMB connections to other internal hosts, but users can still access shared folders. What should the incident handler do FIRST?

Accepted Answer

Disconnect the server from the network or isolate it through EDR containment while preserving power. The correct first step is to contain the incident by disconnecting the server from the network or using EDR containment while preserving power. This stops the spread of malicious SMB connections and prevents further damage, while keeping the system powered on to preserve volatile evidence (e.g., memory, running processes) for forensic analysis. Immediate containment aligns with the NIST incident response framework's containment phase, prioritizing isolation over eradication or recovery.

Answer

Shut down the server immediately to stop all malicious activity

Answer

Restore the server from backup before taking any other action

Answer

Wait for users to report more symptoms before responding

Question 12

Based on the exhibit, which issue should be remediated first by the operations team?

A small company has limited maintenance windows and can address only one of several findings this week.

Accepted Answer

vpn-gw01, because it is internet-facing, exploitable now, and a fix is available.. Vpn-gw01 is internet-facing, has an active exploit (CVSS score indicating current exploitation), and a vendor patch is available. In risk management, the highest priority is given to assets that are exposed to the internet, currently exploitable, and have a known fix, as this combination presents the most urgent threat to the organization's security posture.

Answer

db-lab02, because high-severity findings always outrank medium and critical findings.

Answer

printsrv03, because it is internet-facing and has no vendor patch available.

Answer

None of these, because the team should wait for the next quarterly review before changing anything.

Question 13

A vulnerability dashboard shows four new findings. Which one should be remediated first by the operations team?

- A low-severity issue on an offline lab VM
- A medium-severity issue on a payroll server with no known exploit
- A critical issue on an internet-facing web server with an available exploit
- A high-severity issue on a test workstation that is not domain joined

Accepted Answer

The critical issue on the internet-facing web server with an available exploit.. The critical issue on the internet-facing web server with an available exploit should be remediated first because it combines the highest severity (critical) with an active, exploitable vulnerability on an asset exposed to the public internet. In vulnerability management, remediation priority is determined by risk, which is a function of severity, exploitability, and asset exposure. An internet-facing web server with a known exploit represents an immediate threat that can be remotely compromised, unlike the other findings which are on isolated or less critical systems.

Answer

The low-severity issue on the offline lab VM.

Answer

The medium-severity issue on the payroll server with no known exploit.

Answer

The high-severity issue on the test workstation that is not domain joined.

Question 14

Based on the exhibit, what is the best eradication decision after containment?

A quarantined endpoint was found to have a malicious startup item and a scheduled task. The team has already isolated it from the network and preserved memory for analysis.

Accepted Answer

Remove persistence artifacts and rebuild the endpoint from a known-good image before returning it to service.. After containment (network isolation and memory preservation), the best eradication step is to remove all persistence mechanisms (startup item and scheduled task) and rebuild the endpoint from a known-good image. This ensures that any undetected malware remnants, rootkits, or hidden artifacts are eliminated, preventing reinfection. Simply deleting files or changing DNS does not guarantee the system is clean, and reconnecting without a full rebuild risks lateral movement or data exfiltration.

Answer

Delete only the update.exe file and reconnect the host once the user confirms it is working.

Answer

Restore network connectivity now because no encryption was observed.

Answer

Change the DNS servers for the entire enterprise to block the malware domain.

Question 15

Based on the exhibit, which finding is the best candidate for immediate remediation or emergency mitigation?

Accepted Answer

VPN-EDGE01, because a critical internet-facing RCE with public exploit code has the highest risk.. VPN-EDGE01 is an internet-facing device with a critical remote code execution (RCE) vulnerability that has public exploit code available. This combination of high severity, network exposure, and weaponized exploit makes it the highest risk and most urgent for immediate remediation or emergency mitigation.

Answer

FILE-02, because file servers often affect many users and should always come before perimeter systems.

Answer

TEST-VM-17, because any high-severity issue deserves the fastest response regardless of exposure.

Answer

PRINTER-3F, because default credentials are the easiest issue to exploit and therefore the most dangerous.