SY0-701 Security Operations Practice Test 13 — 15 Questions

Question 1

A SOC analyst confirms that an employee entered credentials into a phishing site and that the mailbox now shows a new forwarding rule sending messages to an external address. The account is still signed in on a laptop and a mobile phone. What is the best next action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Revoke active sessions and force a password reset for the account.. The immediate priority is to contain the compromised account by terminating all active sessions (revoking OAuth tokens, clearing SAML sessions) and forcing a password reset to prevent further unauthorized access. The mailbox forwarding rule indicates the attacker has established persistence, and the active sessions on the laptop and mobile phone mean the attacker could still be using the account. Revoking sessions ensures the attacker cannot continue exfiltration or lateral movement, while the password reset invalidates the stolen credentials.

Answer

Wait for the user to log out naturally before taking action.

Answer

Archive the mailbox and close the ticket after notifying the user.

Answer

Delete the forwarding rule only and consider the incident closed.

Question 2

A legacy application cannot be patched for two weeks, but the security team still wants to reduce risk in the meantime. What is the best temporary measure?

Accepted Answer

Add a compensating control such as restricting access to the system.. Implementing a compensating control, such as restricting network access via firewall rules or disabling unnecessary services, reduces the attack surface while the legacy application remains unpatched. This aligns with the principle of defense-in-depth, where temporary mitigations like access control lists (ACLs) or host-based firewalls can block exploit vectors until the patch is applied.

Answer

Do nothing until the patch window opens.

Answer

Disable all logging so the system runs faster.

Answer

Rename the application so attackers cannot find it.

Question 3

A weekly scan reports three findings: a medium-severity missing patch on a lab VM with no network access, a high-severity default credential on a management interface reachable from the internet, and a low-severity outdated browser plug-in on a visitor kiosk. Which issue should be remediated first?

Accepted Answer

The high-severity default credential on the management interface exposed to the internet.. The high-severity default credential on a management interface reachable from the internet represents an immediate, exploitable risk. Default credentials are well-known and can be used by attackers to gain full administrative control over the device, often leading to a complete compromise of the network. In contrast, the other findings have compensating controls (no network access) or lower impact (outdated browser plug-in), making them lower priority in a risk-based remediation strategy.

Answer

The medium-severity missing patch on the isolated lab VM.

Answer

The low-severity outdated browser plug-in on the visitor kiosk.

Answer

All three issues have the same priority because they were found in the same scan cycle.

Question 4

Based on the exhibit, which action should the incident response team take next to eradicate the threat?

Accepted Answer

Reimage the endpoint from a known-good build and reset potentially exposed credentials.. The exhibit indicates a confirmed compromise (e.g., a scheduled task establishing outbound C2 traffic). Eradication requires removing all traces of the attacker's foothold, which is best achieved by reimaging the endpoint from a known-good build. Additionally, any credentials that may have been exposed during the compromise must be reset to prevent lateral movement or re-entry.

Answer

Return the workstation to the user since the outbound connection was blocked.

Answer

Delete only the scheduled task and reconnect the host to monitor for more alerts.

Answer

Close the incident because memory capture has already preserved the evidence.

Question 5

Based on the exhibit, which change best improves recovery resilience against a repeat ransomware incident?

Accepted Answer

Use an immutable or offline backup copy that production credentials cannot modify.. Ransomware often encrypts or deletes accessible backups. An immutable or offline backup copy (e.g., using S3 Object Lock, Write Once Read Many (WORM) storage, or air-gapped tape) ensures that even if production credentials are compromised, the backup data cannot be modified or deleted by the attacker. This directly preserves a clean recovery point after a ransomware incident.

Answer

Keep the current design and add more NAS storage capacity.

Answer

Move the NAS to the same subnet as the file server for faster backups.

Answer

Shorten the backup retention period to reduce storage use.

Question 6

A monthly scan finds a critical remote-code-execution issue on an internet-facing VPN appliance. The vendor has released a fix, but the appliance can only be rebooted during the weekend maintenance window in five days. What is the BEST immediate action to lower risk until patching can occur?

Accepted Answer

Apply a compensating control such as restricting access to trusted source IPs and disabling nonessential remote access features. Applying a compensating control—such as restricting access to trusted source IPs via an ACL and disabling nonessential remote access features like unused VPN protocols or administrative interfaces—immediately reduces the attack surface. This mitigates the risk of exploitation of the remote-code-execution vulnerability on the internet-facing VPN appliance until the vendor patch can be applied during the scheduled maintenance window. The key is to implement network-layer controls that block untrusted sources from reaching the vulnerable service, buying time without requiring a reboot.

Answer

Wait for the weekend because the exploit is not confirmed

Answer

Remove logging from the appliance to improve performance during the wait

Answer

Run another scan every hour and do nothing else

Question 7

A Linux host is patched, but the scanner still flags the package as vulnerable. The vendor advisory says the distribution backported the fix, so the package version did not change. What should the analyst do before closing the ticket?

Accepted Answer

Verify the vendor advisory and package metadata, then document evidence of the fixed build.. When a vendor backports a security fix to an older package version without incrementing the version number, the vulnerability scanner may still flag the package based on its version string. The analyst must verify the vendor advisory and package metadata (e.g., using `rpm -q --changelog` or `dpkg --status`) to confirm the fix is present, then document this evidence to close the ticket with proper justification.

Answer

Close the ticket immediately because the patch was installed successfully.

Answer

Raise the severity of the finding because the scanner still reports it.

Answer

Disable the scanner until the next maintenance window to avoid repeated alerts.

Question 8

A file server is actively renaming documents and generating ransom notes. The server hosts a shared drive used by finance, and users are still online. What is the best immediate action?

Accepted Answer

Isolate the server from the network to contain the spread while preserving evidence.. Isolating the server from the network stops the ransomware from encrypting more files or spreading laterally, while preserving volatile evidence (e.g., running processes, memory contents) needed for forensic analysis. In a live incident, immediate disconnection (not shutdown) is the standard containment step per NIST SP 800-61 and SANS incident response guidelines, as it halts the attack without destroying data in memory or logs.

Answer

Shut the server down immediately to stop all activity as fast as possible.

Answer

Restore the file server from backup before checking whether the infection is still active.

Answer

Run a full antivirus scan and wait for the results before taking any other action.

Question 9

A branch office uses a NAS for nightly backups, but the NAS is joined to the same domain as the production servers. After ransomware encrypted both production data and backups, management wants the most effective change to reduce the chance of backup tampering without a major redesign. Which control should be implemented?

Accepted Answer

Keep one backup copy offline or immutable and outside the production domain.. Keeping one backup copy offline or immutable and outside the production domain ensures that even if ransomware compromises the domain, it cannot encrypt or tamper with that isolated copy. This breaks the chain of trust between the production environment and the backup storage, directly addressing the root cause of the incident.

Answer

Increase the retention period so deleted files can be recovered for longer.

Answer

Move backups to a larger NAS with more available storage capacity.

Answer

Run backups more frequently to the same NAS so newer files are captured sooner.

Question 10

After containment and eradication of malware on several laptops, the team restores the devices from known-good images and verifies that users can authenticate and access email. Which action should occur NEXT to complete the incident response lifecycle and reduce future impact?

Accepted Answer

Perform a lessons-learned review and update playbooks, controls, or detections based on the incident. The incident response lifecycle includes a post-incident activity phase where the team conducts a lessons-learned review to identify gaps in security controls, update playbooks, and improve detection signatures. This step ensures that the organization reduces the likelihood and impact of similar incidents in the future, completing the lifecycle beyond just restoring operations.

Answer

Close the ticket immediately because the systems are working again

Answer

Reimage the laptops again even though they were already restored and tested

Answer

Disable all email access for the organization until the next quarterly meeting

Question 11

A critical vulnerability is discovered on an internet-facing VPN appliance that cannot be patched for six weeks because the vendor has not released a fix. The VPN service must remain available. What is the best operational response?

Accepted Answer

Apply compensating controls such as restricting source IPs and increasing monitoring.. When a vulnerability cannot be patched immediately, compensating controls such as restricting source IPs via ACLs and increasing monitoring (e.g., enabling detailed logging and alerting on anomalous traffic) reduce the attack surface and improve detection of exploitation attempts. This approach maintains service availability while mitigating risk until the vendor releases a fix.

Answer

Leave the appliance unchanged until the vendor releases a patch.

Answer

Disable all logging so the appliance performs better under load.

Answer

Replace the VPN with a less secure remote access method to avoid the vulnerability.

Question 12

A systems administrator says the backup software reports success every night, but no one has restored a server from backup in over a year. The business wants confidence that a file server can be recovered within the agreed recovery window. What is the best next action?

Accepted Answer

Perform a scheduled restore test in an isolated environment and measure the recovery time.. The only way to validate that backups are both restorable and meet the recovery time objective (RTO) is to perform a scheduled restore test in an isolated environment. Backup success logs only confirm that data was copied, not that the data is intact or that the restoration process completes within the agreed window. This aligns with the 3-2-1 backup rule and the principle of 'trust but verify' in backup validation.

Answer

Trust the success status because completed jobs prove the backups are usable.

Answer

Delete older backups so that only the most recent set remains.

Answer

Extend retention indefinitely to avoid ever losing a recoverable copy.

Question 13

A user reports that their laptop is suddenly encrypting files and showing a ransom note. What should the incident response team do first?

Accepted Answer

Isolate the laptop from the network to limit spread and preserve evidence.. When a laptop suddenly encrypts files and displays a ransom note, it indicates an active ransomware infection. The incident response team's first priority is to isolate the laptop from the network to prevent the ransomware from spreading laterally to other systems and to preserve volatile evidence (e.g., memory contents, running processes) that could be lost if the system is powered off or reconnected. This aligns with the NIST SP 800-61 incident response guidelines, which emphasize containment before eradication or recovery.

Answer

Immediately restore the laptop from backup before collecting any information.

Answer

Return the laptop to the user and monitor for additional alerts.

Answer

Apply all pending software updates to the laptop while it remains online.

Question 14

Based on the exhibit, what should the team do next after the account has been contained?

Accepted Answer

Remove mailbox persistence, revoke all tokens and app consent, then monitor for reentry.. After containing a compromised account (e.g., disabling it or resetting its password), the attacker may still have established persistence mechanisms such as mailbox forwarding rules, OAuth app consent grants, or session tokens that survive a password reset. Removing these artifacts and revoking all tokens and app consents ensures the attacker cannot regain access via delegated permissions or persistent mailbox rules. Monitoring for reentry is critical to detect any residual access or new compromise attempts.

Answer

Close the incident because the password reset removed the attacker from the environment.

Answer

Reimage the user's laptop before reviewing mailbox settings.

Answer

Restore the mailbox from backup to remove the forwarding rule and keep the user productive.

Question 15

Management wants to ensure a file server backed up every night can actually be restored within a 4-hour recovery time objective after an incident. Which two actions best improve recovery confidence? Select two.

Accepted Answer

Perform scheduled restore tests to an isolated environment.. Performing scheduled restore tests to an isolated environment validates that the backup data is both readable and usable without risking corruption of the production environment. This directly confirms the ability to meet the 4-hour RTO by measuring actual restore times and identifying any issues with the backup process or media before a real incident occurs.

Answer

Increase retention to keep backups for two years without changing restore testing.

Answer

Move the backup repository onto the same always-mounted file share as production data.

Answer

Reduce the number of user permissions on the file server without changing backup design.