SY0-701 Security Operations Practice Test 13 — 15 Questions

Question 1

An email security team receives a macro-enabled spreadsheet from a known supplier. The file must be analyzed before users open it, and if it proves malicious, the organization wants to stop the same attachment from reaching other inboxes. Which two tools are the best fit? Select two.

Accepted Answer

Sandboxing the attachment in an isolated environment.. Sandboxing (A) is correct because it allows the file to be executed in an isolated, controlled environment to observe its behavior (e.g., network connections, file modifications) without risk to the production network. This is the standard method for analyzing suspicious attachments for zero-day or macro-based malware.

Answer

Network access control to verify the supplier's laptop posture.

Answer

Data loss prevention to block outbound customer records.

Answer

Intrusion detection system signatures on the mail server.

Question 2

Match each incident response activity to the phase of the incident response lifecycle it best represents. Use each option once.

1. A SOC analyst disables a compromised account, isolates the workstation from the network, and preserves volatile evidence.
2. The team images the infected system, removes the malicious persistence mechanism, and patches the exploited vulnerability.
3. After restoring services, the team reviews timeline gaps, detection delays, and control failures with management.
4. Before the attack occurs, the team verifies contact lists, playbooks, escalation paths, and backup credentials.
5. The team confirms suspicious authentication logs, endpoint alerts, and unusual outbound traffic indicate an active compromise.

Question 3

A finance workstation begins encrypting local files, and the EDR console shows the process is also enumerating SMB shares on adjacent hosts. The user reports no suspicious email and is still logged in. Management wants the fastest containment step that minimizes spread and the best follow-up action to preserve useful evidence. Which two actions should the SOC take first? Select two.

Accepted Answer

Isolate the affected endpoint from the network using EDR or NAC.. Isolating the affected endpoint from the network using EDR or NAC (Option A) is the fastest containment step because it immediately stops the ransomware from encrypting SMB shares on adjacent hosts, preventing lateral spread. This action preserves the system's state for forensic analysis, unlike powering off which destroys volatile evidence.

Answer

Power the system off immediately to stop encryption and preserve nothing else.

Answer

Begin restoring files from backup on the same workstation before containment is finished.

Answer

Reenable the user's mapped drives so they can verify which files are affected.

Question 4

A SIEM analyst reviews authentication logs and sees the following pattern over 15 minutes: 68 different user accounts each had one failed login attempt from the same source IP, followed by no lockouts, and then one of the accounts successfully authenticated from that same IP using a valid password. What is the most likely explanation?

Accepted Answer

A password spraying attack using common passwords across many accounts.. The pattern of 68 different user accounts each experiencing a single failed login attempt from the same source IP, followed by one successful authentication from that IP using a valid password, is the classic signature of a password spraying attack. In password spraying, the attacker tries a small number of common passwords (often just one) against many accounts to avoid triggering account lockout policies, which typically lock an account after a small number of consecutive failures (e.g., 3–5 attempts). The single success indicates the attacker found an account using a weak or common password.

Answer

A brute-force attack against a single account using many password guesses.

Answer

A replay attack using captured authentication traffic.

Answer

A successful SSO federation event after a directory sync delay.

Question 5

After a ransomware incident, management learns the attacker's stolen domain admin credentials were used to delete recent online backups from the same backup network. Which backup strategy would have most reduced the chance of permanent backup loss?

Accepted Answer

Immutable backups stored in a separate repository or offline location.. Immutable backups stored in a separate repository or offline location prevent deletion or modification by an attacker, even with domain admin credentials. This is because immutability enforces a write-once-read-many (WORM) policy, often implemented via object lock (e.g., S3 Object Lock) or a physical air gap, ensuring that backups cannot be altered or deleted before their retention period expires. In this scenario, the attacker's ability to delete online backups from the same network is mitigated because the immutable repository is isolated and resistant to credential-based tampering.

Answer

Nightly incremental backups stored on the same file server as production data.

Answer

Hypervisor snapshots only, because they are always safer than backups.

Answer

Longer retention on the same backup share to keep more versions available.

Question 6

The email security team receives a suspicious invoice attachment from a vendor. The attachment is not blocked by signature-based detection, but the team wants to observe its behavior in a safe environment before delivery to users. What tool best fits this requirement?

Accepted Answer

Sandboxing the attachment in an isolated analysis environment. A sandbox provides an isolated, controlled environment where the suspicious attachment can be executed and monitored for malicious behavior without risking the production network. This allows the security team to observe dynamic indicators such as file system changes, registry modifications, or outbound connections that signature-based detection might miss. The goal is to analyze the attachment's true intent before deciding whether to deliver it to users.

Answer

Network access control for unmanaged devices

Answer

A data loss prevention rule on outbound email

Answer

An intrusion prevention system placed on the Wi-Fi network

Question 7

A nightly patch script restarts services on 40 Linux servers. Security does not want an administrator to log in interactively, and the script should only have the permissions needed to install approved patches and restart those services. What is the best design?

Accepted Answer

Run the script with a dedicated automation account that has only the required sudo permissions. Option A is correct because it follows the principle of least privilege by using a dedicated automation account with only the specific sudo permissions needed to install approved patches and restart services. This prevents interactive login (as the account is configured for non-interactive use) and ensures the script cannot perform unauthorized actions, aligning with security best practices for automated tasks.

Answer

Use the root account for every scheduled execution to avoid permission errors

Answer

Hard-code the administrator password in the script so it never prompts

Answer

Ask each server owner to manually patch their system during the maintenance window

Question 8

Based on the exhibit, which control should be installed or expanded to provide the earliest warning of this hazard?

Accepted Answer

Install or expand water-leak sensors under the raised floor and near the pipe path.. Water-leak sensors provide the earliest possible warning of a liquid hazard by detecting moisture before it reaches equipment or causes electrical shorts. In a data center with raised floors and pipe paths, these sensors can be placed directly in the path of potential leaks, triggering alerts immediately upon contact with water. This proactive monitoring is critical for preventing costly downtime and equipment damage.

Answer

Add badge readers to every rack so the servers can be tracked physically.

Answer

Replace the cameras with motion detectors to improve environmental safety.

Answer

Increase automatic screen lock timeouts on all administrative workstations.

Question 9

An investigator must collect data from a suspected insider-threat laptop so the evidence could be used in an HR and legal review. Which action best preserves admissibility?

Accepted Answer

Create a forensic image through a write blocker and record hashes before and after acquisition. Option B is correct because creating a forensic image through a write blocker ensures the original evidence is not altered, preserving its integrity for admissibility in HR and legal proceedings. Recording hashes before and after acquisition allows verification that the image is an exact, unmodified copy, which is critical for chain of custody and meeting legal standards such as Daubert or Federal Rules of Evidence.

Answer

Boot the laptop normally and browse the user's files for clues

Answer

Copy the user's documents to a USB drive and continue the investigation later

Answer

Take screenshots of the desktop and delete the original drive contents afterward

Question 10

A SIEM alert shows 300 failed logins against the same VPN account from one source IP over 12 minutes, followed by a successful login from that same IP and a spike in mailbox access. The user says they did not initiate the session. What is the most likely cause?

Accepted Answer

A brute-force attack that eventually guessed the correct password. The sequence of 300 failed logins from a single source IP against one VPN account, followed by a successful login and abnormal mailbox access, is the classic pattern of a brute-force attack. The attacker systematically tried many passwords until they guessed the correct one, then used the compromised credentials to access the user's mailbox. The user's denial confirms the session was unauthorized, ruling out legitimate reconnection or synchronization.

Answer

A password-spraying attempt against many different accounts

Answer

A normal VPN reconnect after a brief network outage

Answer

A false positive caused by email synchronization

Question 11

Based on the exhibit, which change best improves secure administration for the scheduled task?

Accepted Answer

Use a dedicated service account with only the required permissions and allow the task to run whether or not anyone is logged on.. Option C is correct because using a dedicated service account with minimal required permissions follows the principle of least privilege, reducing the attack surface. Allowing the task to run whether or not anyone is logged on ensures the scheduled task executes reliably without depending on a user session, which is essential for automated administrative tasks. This approach also avoids the security risks of using the built-in Administrator account, which has excessive privileges and is a common target for attackers.

Answer

Keep the Administrator account and leave the task running only when a user is logged on.

Answer

Move the script to the desktop so it is easier for technicians to monitor manually.

Answer

Disable the task and have staff run the script manually whenever they remember to do it.

Question 12

A SIEM correlates VPN authentication logs and sees 14 different user accounts receive one failed login attempt each from the same source IP during a 5-minute window. A few minutes later, one of those accounts successfully authenticates from that same IP. Which attack is most likely?

Accepted Answer

Password spraying using a common password against many accounts.. The SIEM observed 14 different user accounts each receiving a single failed login attempt from the same source IP within a 5-minute window, followed by one account successfully authenticating. This pattern is characteristic of password spraying, where an attacker tries a common password (e.g., 'Password123') against many accounts to avoid triggering account lockouts, then leverages a successful guess. The single failure per account avoids the threshold for brute-force detection, and the eventual success confirms a guessed credential.

Answer

Brute-force attack against a single account using many passwords.

Answer

Replay attack using previously captured authentication traffic.

Answer

ARP poisoning used to intercept local network traffic.

Question 13

A security team receives a macro-enabled spreadsheet from a supplier. The file must be analyzed before any user opens it, and if the same payload later executes on an endpoint the organization wants the ability to contain it automatically. Which two tools best fit those requirements? Select two.

Accepted Answer

Use a sandbox to detonate the attachment in an isolated environment before delivery.. Option A is correct because a sandbox detonates the macro-enabled spreadsheet in an isolated environment before delivery, allowing the security team to observe malicious behavior (e.g., payload extraction, network calls) without risk to production systems. This pre-delivery analysis ensures the file is safe before any user opens it, directly meeting the requirement to analyze the file before user access.

Answer

Deploy a WAF in front of the mail gateway.

Answer

Create a DNS sinkhole entry only after the file is opened by a user.

Answer

Use DLP to stop the spreadsheet from containing macros.

Question 14

A network analyst reviews packet captures from a subnet where users intermittently lose access to the gateway. Which two findings would most strongly indicate ARP spoofing? Select two.

Accepted Answer

Repeated unsolicited ARP replies map the gateway IP to a different MAC address.. ARP spoofing involves an attacker sending forged ARP replies to associate the gateway's IP address with the attacker's MAC address. Repeated unsolicited ARP replies mapping the gateway IP to a different MAC address is a classic indicator, as legitimate ARP replies are normally solicited by requests. This causes traffic intended for the gateway to be redirected to the attacker, enabling interception or disruption.

Answer

Extra DNS traffic appears during the lunch hour.

Answer

A switch port negotiates a slower speed than usual.

Answer

The wireless network name appears in a site survey.

Question 15

A Linux operations team must run a nightly maintenance script on 70 servers to rotate logs and restart one service. Security will not allow interactive SSH logins, and the script should only have the permissions required for those two commands. Which two configuration choices best meet the requirement? Select two.

Accepted Answer

Create a dedicated automation account and restrict it in sudoers to the exact commands needed.. Option A is correct because creating a dedicated automation account and restricting it in sudoers to the exact commands needed (e.g., `/usr/sbin/logrotate` and `/usr/bin/systemctl restart <service>`) enforces the principle of least privilege. This ensures the account can only execute the specific maintenance tasks without granting interactive SSH access or unnecessary permissions.

Answer

Place the automation account in the root group so it can restart services everywhere.

Answer

Copy the administrator's personal password into the script so the job can log in unattended.

Answer

Approve the job through email one time, then allow the script to run with no restrictions forever.