SY0-701 Security Operations Practice Test 12 — 15 Questions

Question 1

A branch office stores nightly backups on a NAS that is joined to the same Active Directory domain as the production servers. After a ransomware incident, management wants a backup design that is much harder for attackers to encrypt or delete. Which approach is the best improvement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Maintain an offline or immutable backup copy in a separate administrative boundary.. Maintaining an offline or immutable backup copy in a separate administrative boundary ensures that attackers cannot encrypt or delete the backups, even if they compromise the Active Directory domain. An offline backup (e.g., tape or disconnected disk) is physically isolated, while immutable backups (e.g., using S3 Object Lock or a NAS with WORM capabilities) prevent modification or deletion for a defined retention period. This design breaks the attacker's ability to propagate ransomware to the backup repository, addressing the core requirement of making backups much harder to encrypt or delete.

Answer

Increase the backup frequency to every hour while keeping the same NAS design.

Answer

Store all backups on the same network segment for faster restore access.

Answer

Use only snapshots on the production storage array because they are instant to restore.

Question 2

An IDS generates an alert for possible SQL injection against an internal reporting portal at 02:00. The web logs show the source IP belongs to the company's approved vulnerability scanner, the request path matches the scheduled test window, and the WAF blocked the request. What is the most appropriate analyst conclusion?

Accepted Answer

Close it as expected activity after validating the scanner schedule and source IP.. The alert matches expected, authorized activity: the source IP belongs to the approved vulnerability scanner, the request occurred during the scheduled test window, and the WAF blocked the malicious payload. This is a classic false positive triggered by legitimate security testing, not an actual intrusion. The analyst should validate the scanner schedule and source IP, then close the alert as expected activity.

Answer

Treat it as a confirmed intrusion and immediately take the portal offline.

Answer

Classify it as malware because the blocked payload proves the scanner is infected.

Answer

Disable the WAF rule so the scanner can complete without generating more alerts.

Question 3

An engineering firm backs up its file server every night to a NAS that is always mounted to the production domain. After a ransomware event, management asks for the most effective improvement to reduce the chance that backups are encrypted along with production data. What should be recommended?

Accepted Answer

Keep an offline or immutable backup copy that is not continuously reachable from production. An offline or immutable backup copy that is not continuously reachable from the production domain prevents ransomware from encrypting it. Since the NAS is always mounted to the production domain, it is vulnerable to lateral movement and encryption by ransomware. An offline backup (e.g., tape or disconnected disk) or an immutable backup (e.g., using S3 Object Lock or a write-once file system) ensures that even if production data is compromised, the backup remains intact and recoverable.

Answer

Increase the backup frequency but leave the NAS always online

Answer

Store backups in the same server room for faster restore times

Answer

Use only local snapshots on the file server because they are simpler to manage

Question 4

A monthly vulnerability scan identifies a critical vulnerability on a public-facing VPN appliance, but the vendor says no patch is available yet. The service must remain online for remote workers. What is the best compensating control to reduce risk right away?

Accepted Answer

Apply virtual patching or traffic filtering to block exploit attempts until remediation is possible.. Virtual patching or traffic filtering (e.g., via an IPS or WAF) provides immediate, compensating protection by inspecting and blocking exploit traffic targeting the vulnerability, without requiring the vendor to release a patch. This allows the VPN appliance to remain online for remote workers while reducing the risk of exploitation until a permanent fix is available.

Answer

Ignore the finding until the next quarterly review because there is no patch available.

Answer

Move the appliance to a less critical VLAN and leave all access rules unchanged.

Answer

Disable logging so that attackers cannot learn the appliance version from log data.

Question 5

After a phishing account compromise has been contained and the attacker’s mailbox forwarding rule was removed, what should the team do next?

Accepted Answer

Reset credentials and verify there are no other persistence methods before recovery.. After removing a mailbox forwarding rule, the team must reset the compromised account's credentials and verify that no other persistence mechanisms (e.g., additional forwarding rules, OAuth app grants, or mailbox delegation) remain. This ensures the attacker cannot regain access using cached credentials or alternate backdoors, which is critical before returning the account to production.

Answer

Stop the investigation because the forwarding rule was deleted.

Answer

Close the ticket and tell the user to be more careful next time.

Answer

Wait one week before taking any action so the attacker does not notice.

Question 6

A SOC analyst receives a SIEM alert for a possible brute-force attack against a remote access portal. The alert shows 240 failed logins from the same source IP over 4 minutes, followed by one successful login. Before escalating as an incident, what is the BEST evidence to check to determine whether the alert is a false positive caused by approved activity?

Accepted Answer

Whether there is a change ticket or test plan for the access portal and the activity matches the approved maintenance window. A change ticket or test plan that matches the observed activity (240 failed logins followed by a successful login during an approved maintenance window) would indicate that the alert is a false positive caused by authorized testing or maintenance, not a malicious brute-force attack. This is the best evidence because it directly ties the SIEM alert to approved, scheduled activity, which is a standard operational control for change management.

Answer

Whether the source IP belongs to the company help desk

Answer

Whether the user account has MFA enabled

Answer

Whether the firewall is in inline mode

Question 7

Based on the exhibit, which change best improves both recovery time and recovery point for the ERP database?

A mid-sized company has a two-hour RTO and a 30-minute RPO, but its current backup design cannot meet either objective during restore testing.

Accepted Answer

Implement frequent transaction log backups and a pre-staged standby or automated recovery image.. Implementing frequent transaction log backups (e.g., every 5–10 minutes) allows point-in-time recovery, reducing the recovery point objective (RPO) to minutes. A pre-staged standby or automated recovery image reduces recovery time objective (RTO) by eliminating the need to restore from scratch, enabling near-instant failover. This directly addresses the company's inability to meet its 30-minute RPO and 2-hour RTO during restore testing.

Answer

Add a second nightly full backup at 23:30 to the same NAS device.

Answer

Move the NAS to a different VLAN but keep the backup schedule unchanged.

Answer

Increase backup retention from one month to one year.

Question 8

A vulnerability scan finds a critical flaw on a public-facing server and a medium flaw on a lab system that is not connected to the production network. Which issue should be fixed first?

Accepted Answer

The critical flaw on the public-facing server, because it has higher business risk.. The critical flaw on the public-facing server should be fixed first because it presents a higher business risk. A public-facing server is directly accessible from the internet, making it a prime target for attackers. Exploiting a critical vulnerability could lead to data breaches, service disruption, or unauthorized access, with immediate and severe business impact. In contrast, the medium flaw on an isolated lab system poses no direct threat to production operations or sensitive data.

Answer

The medium flaw on the isolated lab system, because all vulnerabilities should be fixed in alphabetical order.

Answer

Both systems can wait until the next quarterly patch cycle.

Answer

The lab system, because internal systems always outrank external systems.

Question 9

An EDR console reports possible beaconing from a workstation because it makes outbound HTTPS connections to the same cloud IP every 15 minutes. The workstation belongs to the patch-management team, and the destination resolves to a vendor update service. Which evidence best supports closing the alert as a false positive?

Accepted Answer

Process lineage and signed agent logs show the patch client initiated the traffic on schedule.. It provides verifiable evidence that the outbound HTTPS connections are legitimate: the process lineage and signed agent logs confirm the patch-management client initiated the traffic on its scheduled update cycle. This aligns with the expected behavior of a patch-management tool, which often uses HTTPS to a vendor update service at regular intervals. The EDR's beaconing detection is a false positive because the traffic is not malicious but rather a routine, authorized activity.

Answer

The workstation user says the activity looks normal and no files were encrypted.

Answer

The source IP appears on a blocklist, so the alert must be malicious.

Answer

The workstation has antivirus installed, which means outbound beaconing is impossible.

Question 10

A technician restores a file server from backup, but the business wants confidence that the recovery process will work during an outage. What should the team do most often to validate the backups?

Accepted Answer

Perform regular restore tests using sample files or systems.. The only way to gain confidence that backups can be successfully restored during an actual outage is to perform regular, documented restore tests. This validates the integrity of the backup media, the correctness of the restoration procedure, and the recoverability of data within the required recovery time objective (RTO). Without testing, assumptions about backup reliability remain unverified, which can lead to catastrophic data loss when a real disaster occurs.

Answer

Review the backup vendor brochure for proof that recovery will work.

Answer

Increase the backup retention period without testing restores.

Answer

Change the backup password every day and skip verification.

Question 11

Based on the exhibit, what is the best-supported conclusion for the SOC analyst?

Accepted Answer

The host is likely using DNS tunneling or DNS-based command and control.. The exhibit shows a high volume of DNS queries to multiple unusual domains with long subdomain strings, which is a classic indicator of DNS tunneling or DNS-based command and control (C2). DNS tunneling encodes data in DNS queries and responses, allowing attackers to exfiltrate data or communicate with a C2 server while bypassing traditional network controls. The SOC analyst should recognize this pattern as anomalous DNS activity rather than normal web browsing.

Answer

The traffic is normal web browsing to a content delivery network.

Answer

The issue is most likely ARP spoofing on the local switch port.

Answer

The evidence most strongly indicates a password spraying campaign.

Question 12

A file server in the accounting department begins renaming documents and dropping ransom notes. The SOC confirms encryption is still in progress, and the server hosts a share used by several finance teams. What should the incident response team do first?

Accepted Answer

Disconnect the server from the network to contain the spread.. Disconnecting the server from the network is the immediate containment step to prevent the ransomware from encrypting additional files on the share or spreading laterally to other systems. Since encryption is still in progress, isolating the server stops the attacker's process from accessing more files and blocks any command-and-control (C2) communication. This aligns with the NIST incident response framework's containment phase, prioritizing stopping the spread over recovery or notification.

Answer

Restore the file share from backup immediately while the server is still connected.

Answer

Power off the server immediately without any other action.

Answer

Notify users to change their passwords before any technical action is taken.

Question 13

An EDR alert flags suspicious PowerShell on a finance workstation. Windows logs show the script started immediately after a patch-management tool launched from the software distribution server. The script only queries installed software and writes results to a log file. What is the most likely conclusion?

Accepted Answer

The alert is likely a false positive because the activity matches approved patch-management behavior. The EDR alert is likely a false positive because the PowerShell script's behavior—querying installed software and writing results to a log file—is consistent with legitimate patch-management inventory tasks. The script's execution immediately after the patch-management tool launched from the software distribution server indicates it was triggered by that tool as part of its normal operations, not by an attacker. Since the activity matches approved patch-management behavior and shows no signs of malicious intent (e.g., data exfiltration, lateral movement, or persistence), the alert should be investigated but is most likely a false positive.

Answer

The workstation is definitely compromised because PowerShell is always malicious

Answer

The endpoint should be immediately wiped because the script wrote to a log file

Answer

The software distribution server should be blocked from the network permanently

Question 14

A company wants to make sure it can recover quickly after ransomware, even if the production network is unavailable. Which backup approach is the best choice?

Accepted Answer

Keep an offline copy of backups that is disconnected from production systems.. An offline (air-gapped) backup, such as a tape stored in a safe or a disconnected external drive, ensures that ransomware cannot encrypt or delete the backup data. This approach guarantees recoverability even when the production network is completely compromised or unavailable, aligning with the 3-2-1 backup rule (three copies, two media types, one offsite/offline).

Answer

Store backups only on the same file server so they are easy to access.

Answer

Use a single monthly backup and never test restores to save time.

Answer

Save backups in the same cloud account using the same admin credentials.

Question 15

A SOC analyst sees 20 failed logins for one user account, followed by a successful login 30 seconds later from the same office subnet. The user confirms they mistyped the password several times. What is the best conclusion?

Accepted Answer

It is most likely a false positive caused by user error and should be documented after verification.. The scenario shows 20 failed logins followed by a successful login from the same office subnet, and the user confirms they mistyped the password. This pattern is consistent with user error (e.g., Caps Lock or typo), not an automated brute-force attack, which would typically show a much higher volume of attempts from diverse IPs. The best conclusion is a false positive, which should be documented after verification to maintain accurate incident records.

Answer

It is definitely a brute-force attack and should be treated as confirmed compromise.

Answer

It is evidence of malware on the user's workstation until the device is rebuilt.

Answer

It proves the password was changed by an attacker and the account must be disabled immediately.