SY0-701 Security Operations Practice Test 12 — 15 Questions

Question 1

A monthly scan finds a critical remote-code-execution issue on an internet-facing VPN appliance. The vendor has released a fix, but the appliance can only be rebooted during the weekend maintenance window in five days. What is the BEST immediate action to lower risk until patching can occur?

Accepted Answer

Apply a compensating control such as restricting access to trusted source IPs and disabling nonessential remote access features. Option A is correct because applying a compensating control—such as restricting access to trusted source IPs via an ACL and disabling nonessential remote access features like unused VPN protocols or administrative interfaces—immediately reduces the attack surface. This mitigates the risk of exploitation of the remote-code-execution vulnerability on the internet-facing VPN appliance until the vendor patch can be applied during the scheduled maintenance window. The key is to implement network-layer controls that block untrusted sources from reaching the vulnerable service, buying time without requiring a reboot.

Answer

Wait for the weekend because the exploit is not confirmed

Answer

Remove logging from the appliance to improve performance during the wait

Answer

Run another scan every hour and do nothing else

Question 2

A Linux host is patched, but the scanner still flags the package as vulnerable. The vendor advisory says the distribution backported the fix, so the package version did not change. What should the analyst do before closing the ticket?

Accepted Answer

Verify the vendor advisory and package metadata, then document evidence of the fixed build.. Option A is correct because when a vendor backports a security fix to an older package version without incrementing the version number, the vulnerability scanner may still flag the package based on its version string. The analyst must verify the vendor advisory and package metadata (e.g., using `rpm -q --changelog` or `dpkg --status`) to confirm the fix is present, then document this evidence to close the ticket with proper justification.

Answer

Close the ticket immediately because the patch was installed successfully.

Answer

Raise the severity of the finding because the scanner still reports it.

Answer

Disable the scanner until the next maintenance window to avoid repeated alerts.

Question 3

A file server is actively renaming documents and generating ransom notes. The server hosts a shared drive used by finance, and users are still online. What is the best immediate action?

Accepted Answer

Isolate the server from the network to contain the spread while preserving evidence.. Option B is correct because isolating the server from the network stops the ransomware from encrypting more files or spreading laterally, while preserving volatile evidence (e.g., running processes, memory contents) needed for forensic analysis. In a live incident, immediate disconnection (not shutdown) is the standard containment step per NIST SP 800-61 and SANS incident response guidelines, as it halts the attack without destroying data in memory or logs.

Answer

Shut the server down immediately to stop all activity as fast as possible.

Answer

Restore the file server from backup before checking whether the infection is still active.

Answer

Run a full antivirus scan and wait for the results before taking any other action.

Question 4

A SIEM alert shows a workstation making repeated outbound HTTPS connections every 15 minutes to the same cloud IP address. The host belongs to the patch-management group, and the security team suspects an approved agent may be responsible. Which two checks best validate whether this is a false positive? Select two.

Accepted Answer

Verify that the destination domain and IP match the vendor's documented update service.. Option A is correct because verifying that the destination domain and IP match the vendor's documented update service directly confirms whether the outbound HTTPS traffic is legitimate patch-management activity. This step uses threat intelligence or vendor documentation to correlate the observed destination with the expected update infrastructure, which is a standard validation technique for reducing false positives in SIEM alerts.

Answer

Immediately isolate the workstation from the network without reviewing any other evidence.

Answer

Suppress every future alert from that subnet permanently.

Answer

Assume the traffic is benign because it occurs at a regular interval.

Question 5

A branch office uses a NAS for nightly backups, but the NAS is joined to the same domain as the production servers. After ransomware encrypted both production data and backups, management wants the most effective change to reduce the chance of backup tampering without a major redesign. Which control should be implemented?

Accepted Answer

Keep one backup copy offline or immutable and outside the production domain.. Option C is correct because keeping one backup copy offline or immutable and outside the production domain ensures that even if ransomware compromises the domain, it cannot encrypt or tamper with that isolated copy. This breaks the chain of trust between the production environment and the backup storage, directly addressing the root cause of the incident.

Answer

Increase the retention period so deleted files can be recovered for longer.

Answer

Move backups to a larger NAS with more available storage capacity.

Answer

Run backups more frequently to the same NAS so newer files are captured sooner.

Question 6

After containment and eradication of malware on several laptops, the team restores the devices from known-good images and verifies that users can authenticate and access email. Which action should occur NEXT to complete the incident response lifecycle and reduce future impact?

Accepted Answer

Perform a lessons-learned review and update playbooks, controls, or detections based on the incident. Option B is correct because the incident response lifecycle includes a post-incident activity phase where the team conducts a lessons-learned review to identify gaps in security controls, update playbooks, and improve detection signatures. This step ensures that the organization reduces the likelihood and impact of similar incidents in the future, completing the lifecycle beyond just restoring operations.

Answer

Close the ticket immediately because the systems are working again

Answer

Reimage the laptops again even though they were already restored and tested

Answer

Disable all email access for the organization until the next quarterly meeting

Question 7

A SOC analyst confirms that a user entered corporate credentials into a fake sign-in page. Mailbox logs now show a new forwarding rule sending messages to an external address, and the attacker may still have an active session. Which two actions should the analyst take first to contain the account compromise? Select two.

Accepted Answer

Reset the user's password and require a fresh authentication challenge.. Resetting the user's password (Option A) immediately invalidates the credentials the attacker phished, preventing further authentication with those stolen credentials. This is a foundational first step in account containment per NIST SP 800-61 incident response guidelines.

Answer

Delete the mailbox and create a new user account.

Answer

Disable all external email delivery for the entire organization.

Answer

Wait for the user to confirm whether the message was legitimate before acting.

Question 8

A critical vulnerability is discovered on an internet-facing VPN appliance that cannot be patched for six weeks because the vendor has not released a fix. The VPN service must remain available. What is the best operational response?

Accepted Answer

Apply compensating controls such as restricting source IPs and increasing monitoring.. Option B is correct because when a vulnerability cannot be patched immediately, compensating controls such as restricting source IPs via ACLs and increasing monitoring (e.g., enabling detailed logging and alerting on anomalous traffic) reduce the attack surface and improve detection of exploitation attempts. This approach maintains service availability while mitigating risk until the vendor releases a fix.

Answer

Leave the appliance unchanged until the vendor releases a patch.

Answer

Disable all logging so the appliance performs better under load.

Answer

Replace the VPN with a less secure remote access method to avoid the vulnerability.

Question 9

A systems administrator says the backup software reports success every night, but no one has restored a server from backup in over a year. The business wants confidence that a file server can be recovered within the agreed recovery window. What is the best next action?

Accepted Answer

Perform a scheduled restore test in an isolated environment and measure the recovery time.. Option B is correct because the only way to validate that backups are both restorable and meet the recovery time objective (RTO) is to perform a scheduled restore test in an isolated environment. Backup success logs only confirm that data was copied, not that the data is intact or that the restoration process completes within the agreed window. This aligns with the 3-2-1 backup rule and the principle of 'trust but verify' in backup validation.

Answer

Trust the success status because completed jobs prove the backups are usable.

Answer

Delete older backups so that only the most recent set remains.

Answer

Extend retention indefinitely to avoid ever losing a recoverable copy.

Question 10

A user reports that their laptop is suddenly encrypting files and showing a ransom note. What should the incident response team do first?

Accepted Answer

Isolate the laptop from the network to limit spread and preserve evidence.. When a laptop suddenly encrypts files and displays a ransom note, it indicates an active ransomware infection. The incident response team's first priority is to isolate the laptop from the network to prevent the ransomware from spreading laterally to other systems and to preserve volatile evidence (e.g., memory contents, running processes) that could be lost if the system is powered off or reconnected. This aligns with the NIST SP 800-61 incident response guidelines, which emphasize containment before eradication or recovery.

Answer

Immediately restore the laptop from backup before collecting any information.

Answer

Return the laptop to the user and monitor for additional alerts.

Answer

Apply all pending software updates to the laptop while it remains online.

Question 11

Based on the exhibit, what should the team do next after the account has been contained?

Accepted Answer

Remove mailbox persistence, revoke all tokens and app consent, then monitor for reentry.. Option B is correct because after containing a compromised account (e.g., disabling it or resetting its password), the attacker may still have established persistence mechanisms such as mailbox forwarding rules, OAuth app consent grants, or session tokens that survive a password reset. Removing these artifacts and revoking all tokens and app consents ensures the attacker cannot regain access via delegated permissions or persistent mailbox rules. Monitoring for reentry is critical to detect any residual access or new compromise attempts.

Answer

Close the incident because the password reset removed the attacker from the environment.

Answer

Reimage the user's laptop before reviewing mailbox settings.

Answer

Restore the mailbox from backup to remove the forwarding rule and keep the user productive.

Question 12

Management wants to ensure a file server backed up every night can actually be restored within a 4-hour recovery time objective after an incident. Which two actions best improve recovery confidence? Select two.

Accepted Answer

Perform scheduled restore tests to an isolated environment.. Option A is correct because performing scheduled restore tests to an isolated environment validates that the backup data is both readable and usable without risking corruption of the production environment. This directly confirms the ability to meet the 4-hour RTO by measuring actual restore times and identifying any issues with the backup process or media before a real incident occurs.

Answer

Increase retention to keep backups for two years without changing restore testing.

Answer

Move the backup repository onto the same always-mounted file share as production data.

Answer

Reduce the number of user permissions on the file server without changing backup design.

Question 13

A Linux administrator must run a weekly maintenance script on 40 servers without giving technicians interactive root access. Which two practices best support secure administration? Select two.

Accepted Answer

Use a dedicated service account with only the required commands.. Option A is correct because a dedicated service account with only the required commands implements the principle of least privilege. By using sudo or RBAC to restrict the account to exactly the commands needed for the maintenance script, the administrator avoids granting full root access while still allowing the script to execute with elevated privileges. This minimizes the attack surface and prevents unauthorized actions.

Answer

Share one root password across the whole team.

Answer

Embed the account password directly in the script.

Answer

Disable logging so the maintenance job runs faster.

Question 14

After a suspicious laptop is imaged with a write blocker, the original drive is sealed and stored. Before a second analyst examines the image, what is the most important next step to preserve admissibility?

Accepted Answer

Document the transfer in the chain-of-custody log and verify the image hash still matches the acquisition value.. Option C is correct because before a second analyst accesses the image, the most critical step is to update the chain-of-custody log to document the transfer of custody and to verify the integrity of the image by comparing its current hash value against the original acquisition hash. This ensures that the evidence has not been altered or corrupted since it was first imaged, which is essential for maintaining admissibility in legal proceedings under rules such as the Federal Rules of Evidence.

Answer

Mount the image read/write so the analyst can browse faster.

Answer

Copy the image to a USB drive for easier transport.

Answer

Rename the evidence file to match the case number.

Question 15

A server room is located next to a chilled-water pipe, and facilities staff want the earliest possible warning if moisture starts leaking under the raised floor. Which control is the best fit?

Accepted Answer

Install water leak sensors tied into the environmental monitoring system.. Water leak sensors are specifically designed to detect the presence of moisture, and when integrated into an environmental monitoring system, they provide immediate alerts (e.g., SNMP traps or email notifications) at the earliest sign of a leak. This allows facilities staff to respond before water damages server equipment under the raised floor, meeting the requirement for earliest possible warning.

Answer

Replace the badge reader with a biometric lock.

Answer

Add a security camera pointing at the server racks.

Answer

Move the servers onto a separate VLAN.