SY0-701 Security Operations Practice Test 12 — 15 Questions

Question 1

A user reports that a shared department drive is rapidly renaming files and creating ransom notes on a Windows file server. The SOC confirms suspicious activity is still occurring on that server. What should the incident responder do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the server from the network while keeping it powered on if possible.. The immediate priority is to contain the ransomware outbreak by isolating the server from the network, which stops the malicious activity from spreading to other systems while preserving volatile evidence (e.g., running processes, memory contents) for forensic analysis. Powering off the server (Option A) would destroy this critical evidence and may not stop the encryption process if it is already in memory. Isolation via network disconnection (e.g., disabling the NIC or unplugging the cable) is the standard first step in incident response for active ransomware.

Answer

Shut down the server immediately to stop all malicious activity.

Answer

Restore the drive from backup before collecting any evidence.

Answer

Inform users to continue working until the forensic team arrives.

Question 2

Based on the exhibit, what is the most important next IR action?

Accepted Answer

Revoke active sessions and OAuth consent grants for the account.. The exhibit shows a compromised account with a suspicious inbox rule forwarding emails externally. The most critical next step is to revoke active sessions and OAuth consent grants to immediately terminate the attacker's access and prevent further data exfiltration, as changing the password alone does not invalidate existing OAuth tokens or active sessions.

Answer

Change the password again and monitor the mailbox for a few days.

Answer

Restore the deleted inbox rule from backup to preserve evidence.

Answer

Close the incident because the forwarding rule was removed.

Question 3

A SOC analyst receives an alert that a domain admin account authenticated to a file server at 02:14 from a jump host that is normally used only by the infrastructure team. The Windows logs also show a scheduled task launching a backup script at the same time, and the backup team says the task was created during yesterday's change window. What is the best next step to determine whether this is a false positive?

Accepted Answer

Correlate the authentication event with the change ticket and the scheduled task details.. The alert involves a domain admin authentication from a jump host at an unusual time, but the scheduled task was created during a change window. Correlating the authentication event with the change ticket and the scheduled task details allows the SOC analyst to verify if the activity was authorized, preventing unnecessary incident response. This step aligns with the incident response process of validating alerts before taking action.

Answer

Disable the domain admin account immediately and wait for the backup team to respond.

Answer

Escalate the alert as confirmed compromise because the login occurred after hours.

Answer

Delete the scheduled task so it cannot be used again.

Question 4

A branch office stores nightly backups on a NAS that is joined to the same Active Directory domain as the production servers. After a ransomware incident, management wants a backup design that is much harder for attackers to encrypt or delete. Which approach is the best improvement?

Accepted Answer

Maintain an offline or immutable backup copy in a separate administrative boundary.. Maintaining an offline or immutable backup copy in a separate administrative boundary ensures that attackers cannot encrypt or delete the backups, even if they compromise the Active Directory domain. An offline backup (e.g., tape or disconnected disk) is physically isolated, while immutable backups (e.g., using S3 Object Lock or a NAS with WORM capabilities) prevent modification or deletion for a defined retention period. This design breaks the attacker's ability to propagate ransomware to the backup repository, addressing the core requirement of making backups much harder to encrypt or delete.

Answer

Increase the backup frequency to every hour while keeping the same NAS design.

Answer

Store all backups on the same network segment for faster restore access.

Answer

Use only snapshots on the production storage array because they are instant to restore.

Question 5

An IDS generates an alert for possible SQL injection against an internal reporting portal at 02:00. The web logs show the source IP belongs to the company's approved vulnerability scanner, the request path matches the scheduled test window, and the WAF blocked the request. What is the most appropriate analyst conclusion?

Accepted Answer

Close it as expected activity after validating the scanner schedule and source IP.. The alert matches expected, authorized activity: the source IP belongs to the approved vulnerability scanner, the request occurred during the scheduled test window, and the WAF blocked the malicious payload. This is a classic false positive triggered by legitimate security testing, not an actual intrusion. The analyst should validate the scanner schedule and source IP, then close the alert as expected activity.

Answer

Treat it as a confirmed intrusion and immediately take the portal offline.

Answer

Classify it as malware because the blocked payload proves the scanner is infected.

Answer

Disable the WAF rule so the scanner can complete without generating more alerts.

Question 6

An engineering firm backs up its file server every night to a NAS that is always mounted to the production domain. After a ransomware event, management asks for the most effective improvement to reduce the chance that backups are encrypted along with production data. What should be recommended?

Accepted Answer

Keep an offline or immutable backup copy that is not continuously reachable from production. An offline or immutable backup copy that is not continuously reachable from the production domain prevents ransomware from encrypting it. Since the NAS is always mounted to the production domain, it is vulnerable to lateral movement and encryption by ransomware. An offline backup (e.g., tape or disconnected disk) or an immutable backup (e.g., using S3 Object Lock or a write-once file system) ensures that even if production data is compromised, the backup remains intact and recoverable.

Answer

Increase the backup frequency but leave the NAS always online

Answer

Store backups in the same server room for faster restore times

Answer

Use only local snapshots on the file server because they are simpler to manage

Question 7

A monthly vulnerability scan identifies a critical vulnerability on a public-facing VPN appliance, but the vendor says no patch is available yet. The service must remain online for remote workers. What is the best compensating control to reduce risk right away?

Accepted Answer

Apply virtual patching or traffic filtering to block exploit attempts until remediation is possible.. Virtual patching or traffic filtering (e.g., via an IPS or WAF) provides immediate, compensating protection by inspecting and blocking exploit traffic targeting the vulnerability, without requiring the vendor to release a patch. This allows the VPN appliance to remain online for remote workers while reducing the risk of exploitation until a permanent fix is available.

Answer

Ignore the finding until the next quarterly review because there is no patch available.

Answer

Move the appliance to a less critical VLAN and leave all access rules unchanged.

Answer

Disable logging so that attackers cannot learn the appliance version from log data.

Question 8

After a phishing account compromise has been contained and the attacker’s mailbox forwarding rule was removed, what should the team do next?

Accepted Answer

Reset credentials and verify there are no other persistence methods before recovery.. After removing a mailbox forwarding rule, the team must reset the compromised account's credentials and verify that no other persistence mechanisms (e.g., additional forwarding rules, OAuth app grants, or mailbox delegation) remain. This ensures the attacker cannot regain access using cached credentials or alternate backdoors, which is critical before returning the account to production.

Answer

Stop the investigation because the forwarding rule was deleted.

Answer

Close the ticket and tell the user to be more careful next time.

Answer

Wait one week before taking any action so the attacker does not notice.

Question 9

A SOC analyst receives a SIEM alert for a possible brute-force attack against a remote access portal. The alert shows 240 failed logins from the same source IP over 4 minutes, followed by one successful login. Before escalating as an incident, what is the BEST evidence to check to determine whether the alert is a false positive caused by approved activity?

Accepted Answer

Whether there is a change ticket or test plan for the access portal and the activity matches the approved maintenance window. A change ticket or test plan that matches the observed activity (240 failed logins followed by a successful login during an approved maintenance window) would indicate that the alert is a false positive caused by authorized testing or maintenance, not a malicious brute-force attack. This is the best evidence because it directly ties the SIEM alert to approved, scheduled activity, which is a standard operational control for change management.

Answer

Whether the source IP belongs to the company help desk

Answer

Whether the user account has MFA enabled

Answer

Whether the firewall is in inline mode

Question 10

Based on the exhibit, which change best improves both recovery time and recovery point for the ERP database?

A mid-sized company has a two-hour RTO and a 30-minute RPO, but its current backup design cannot meet either objective during restore testing.

Accepted Answer

Implement frequent transaction log backups and a pre-staged standby or automated recovery image.. Implementing frequent transaction log backups (e.g., every 5–10 minutes) allows point-in-time recovery, reducing the recovery point objective (RPO) to minutes. A pre-staged standby or automated recovery image reduces recovery time objective (RTO) by eliminating the need to restore from scratch, enabling near-instant failover. This directly addresses the company's inability to meet its 30-minute RPO and 2-hour RTO during restore testing.

Answer

Add a second nightly full backup at 23:30 to the same NAS device.

Answer

Move the NAS to a different VLAN but keep the backup schedule unchanged.

Answer

Increase backup retention from one month to one year.

Question 11

A vulnerability scan finds a critical flaw on a public-facing server and a medium flaw on a lab system that is not connected to the production network. Which issue should be fixed first?

Accepted Answer

The critical flaw on the public-facing server, because it has higher business risk.. The critical flaw on the public-facing server should be fixed first because it presents a higher business risk. A public-facing server is directly accessible from the internet, making it a prime target for attackers. Exploiting a critical vulnerability could lead to data breaches, service disruption, or unauthorized access, with immediate and severe business impact. In contrast, the medium flaw on an isolated lab system poses no direct threat to production operations or sensitive data.

Answer

The medium flaw on the isolated lab system, because all vulnerabilities should be fixed in alphabetical order.

Answer

Both systems can wait until the next quarterly patch cycle.

Answer

The lab system, because internal systems always outrank external systems.

Question 12

An EDR console reports possible beaconing from a workstation because it makes outbound HTTPS connections to the same cloud IP every 15 minutes. The workstation belongs to the patch-management team, and the destination resolves to a vendor update service. Which evidence best supports closing the alert as a false positive?

Accepted Answer

Process lineage and signed agent logs show the patch client initiated the traffic on schedule.. It provides verifiable evidence that the outbound HTTPS connections are legitimate: the process lineage and signed agent logs confirm the patch-management client initiated the traffic on its scheduled update cycle. This aligns with the expected behavior of a patch-management tool, which often uses HTTPS to a vendor update service at regular intervals. The EDR's beaconing detection is a false positive because the traffic is not malicious but rather a routine, authorized activity.

Answer

The workstation user says the activity looks normal and no files were encrypted.

Answer

The source IP appears on a blocklist, so the alert must be malicious.

Answer

The workstation has antivirus installed, which means outbound beaconing is impossible.

Question 13

A technician restores a file server from backup, but the business wants confidence that the recovery process will work during an outage. What should the team do most often to validate the backups?

Accepted Answer

Perform regular restore tests using sample files or systems.. The only way to gain confidence that backups can be successfully restored during an actual outage is to perform regular, documented restore tests. This validates the integrity of the backup media, the correctness of the restoration procedure, and the recoverability of data within the required recovery time objective (RTO). Without testing, assumptions about backup reliability remain unverified, which can lead to catastrophic data loss when a real disaster occurs.

Answer

Review the backup vendor brochure for proof that recovery will work.

Answer

Increase the backup retention period without testing restores.

Answer

Change the backup password every day and skip verification.

Question 14

Based on the exhibit, what is the best-supported conclusion for the SOC analyst?

Accepted Answer

The host is likely using DNS tunneling or DNS-based command and control.. The exhibit shows a high volume of DNS queries to multiple unusual domains with long subdomain strings, which is a classic indicator of DNS tunneling or DNS-based command and control (C2). DNS tunneling encodes data in DNS queries and responses, allowing attackers to exfiltrate data or communicate with a C2 server while bypassing traditional network controls. The SOC analyst should recognize this pattern as anomalous DNS activity rather than normal web browsing.

Answer

The traffic is normal web browsing to a content delivery network.

Answer

The issue is most likely ARP spoofing on the local switch port.

Answer

The evidence most strongly indicates a password spraying campaign.

Question 15

A file server in the accounting department begins renaming documents and dropping ransom notes. The SOC confirms encryption is still in progress, and the server hosts a share used by several finance teams. What should the incident response team do first?

Accepted Answer

Disconnect the server from the network to contain the spread.. Disconnecting the server from the network is the immediate containment step to prevent the ransomware from encrypting additional files on the share or spreading laterally to other systems. Since encryption is still in progress, isolating the server stops the attacker's process from accessing more files and blocks any command-and-control (C2) communication. This aligns with the NIST incident response framework's containment phase, prioritizing stopping the spread over recovery or notification.

Answer

Restore the file share from backup immediately while the server is still connected.

Answer

Power off the server immediately without any other action.

Answer

Notify users to change their passwords before any technical action is taken.