SY0-701 Security Operations Practice Test 14 — 15 Questions

Question 1

After a suspicious laptop is imaged with a write blocker, the original drive is sealed and stored. Before a second analyst examines the image, what is the most important next step to preserve admissibility?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Document the transfer in the chain-of-custody log and verify the image hash still matches the acquisition value.. Before a second analyst accesses the image, the most critical step is to update the chain-of-custody log to document the transfer of custody and to verify the integrity of the image by comparing its current hash value against the original acquisition hash. This ensures that the evidence has not been altered or corrupted since it was first imaged, which is essential for maintaining admissibility in legal proceedings under rules such as the Federal Rules of Evidence.

Answer

Mount the image read/write so the analyst can browse faster.

Answer

Copy the image to a USB drive for easier transport.

Answer

Rename the evidence file to match the case number.

Question 2

A server room is located next to a chilled-water pipe, and facilities staff want the earliest possible warning if moisture starts leaking under the raised floor. Which control is the best fit?

Accepted Answer

Install water leak sensors tied into the environmental monitoring system.. Water leak sensors are specifically designed to detect the presence of moisture, and when integrated into an environmental monitoring system, they provide immediate alerts (e.g., SNMP traps or email notifications) at the earliest sign of a leak. This allows facilities staff to respond before water damages server equipment under the raised floor, meeting the requirement for earliest possible warning.

Answer

Replace the badge reader with a biometric lock.

Answer

Add a security camera pointing at the server racks.

Answer

Move the servers onto a separate VLAN.

Question 3

A SIEM analyst reviews authentication logs and sees the following pattern over 15 minutes: 68 different user accounts each had one failed login attempt from the same source IP, followed by no lockouts, and then one of the accounts successfully authenticated from that same IP using a valid password. What is the most likely explanation?

Accepted Answer

A password spraying attack using common passwords across many accounts.. The pattern of 68 different user accounts each experiencing a single failed login attempt from the same source IP, followed by one successful authentication from that IP using a valid password, is the classic signature of a password spraying attack. In password spraying, the attacker tries a small number of common passwords (often just one) against many accounts to avoid triggering account lockout policies, which typically lock an account after a small number of consecutive failures (e.g., 3–5 attempts). The single success indicates the attacker found an account using a weak or common password.

Answer

A brute-force attack against a single account using many password guesses.

Answer

A replay attack using captured authentication traffic.

Answer

A successful SSO federation event after a directory sync delay.

Question 4

After a ransomware incident, management learns the attacker's stolen domain admin credentials were used to delete recent online backups from the same backup network. Which backup strategy would have most reduced the chance of permanent backup loss?

Accepted Answer

Immutable backups stored in a separate repository or offline location.. Immutable backups stored in a separate repository or offline location prevent deletion or modification by an attacker, even with domain admin credentials. This is because immutability enforces a write-once-read-many (WORM) policy, often implemented via object lock (e.g., S3 Object Lock) or a physical air gap, ensuring that backups cannot be altered or deleted before their retention period expires. In this scenario, the attacker's ability to delete online backups from the same network is mitigated because the immutable repository is isolated and resistant to credential-based tampering.

Answer

Nightly incremental backups stored on the same file server as production data.

Answer

Hypervisor snapshots only, because they are always safer than backups.

Answer

Longer retention on the same backup share to keep more versions available.

Question 5

The email security team receives a suspicious invoice attachment from a vendor. The attachment is not blocked by signature-based detection, but the team wants to observe its behavior in a safe environment before delivery to users. What tool best fits this requirement?

Accepted Answer

Sandboxing the attachment in an isolated analysis environment. A sandbox provides an isolated, controlled environment where the suspicious attachment can be executed and monitored for malicious behavior without risking the production network. This allows the security team to observe dynamic indicators such as file system changes, registry modifications, or outbound connections that signature-based detection might miss. The goal is to analyze the attachment's true intent before deciding whether to deliver it to users.

Answer

Network access control for unmanaged devices

Answer

A data loss prevention rule on outbound email

Answer

An intrusion prevention system placed on the Wi-Fi network

Question 6

A nightly patch script restarts services on 40 Linux servers. Security does not want an administrator to log in interactively, and the script should only have the permissions needed to install approved patches and restart those services. What is the best design?

Accepted Answer

Run the script with a dedicated automation account that has only the required sudo permissions. It follows the principle of least privilege by using a dedicated automation account with only the specific sudo permissions needed to install approved patches and restart services. This prevents interactive login (as the account is configured for non-interactive use) and ensures the script cannot perform unauthorized actions, aligning with security best practices for automated tasks.

Answer

Use the root account for every scheduled execution to avoid permission errors

Answer

Hard-code the administrator password in the script so it never prompts

Answer

Ask each server owner to manually patch their system during the maintenance window

Question 7

An investigator must collect data from a suspected insider-threat laptop so the evidence could be used in an HR and legal review. Which action best preserves admissibility?

Accepted Answer

Create a forensic image through a write blocker and record hashes before and after acquisition. Creating a forensic image through a write blocker ensures the original evidence is not altered, preserving its integrity for admissibility in HR and legal proceedings. Recording hashes before and after acquisition allows verification that the image is an exact, unmodified copy, which is critical for chain of custody and meeting legal standards such as Daubert or Federal Rules of Evidence.

Answer

Boot the laptop normally and browse the user's files for clues

Answer

Copy the user's documents to a USB drive and continue the investigation later

Answer

Take screenshots of the desktop and delete the original drive contents afterward

Question 8

A SIEM alert shows 300 failed logins against the same VPN account from one source IP over 12 minutes, followed by a successful login from that same IP and a spike in mailbox access. The user says they did not initiate the session. What is the most likely cause?

Accepted Answer

A brute-force attack that eventually guessed the correct password. The sequence of 300 failed logins from a single source IP against one VPN account, followed by a successful login and abnormal mailbox access, is the classic pattern of a brute-force attack. The attacker systematically tried many passwords until they guessed the correct one, then used the compromised credentials to access the user's mailbox. The user's denial confirms the session was unauthorized, ruling out legitimate reconnection or synchronization.

Answer

A password-spraying attempt against many different accounts

Answer

A normal VPN reconnect after a brief network outage

Answer

A false positive caused by email synchronization

Question 9

Based on the exhibit, which change best improves secure administration for the scheduled task?

Accepted Answer

Use a dedicated service account with only the required permissions and allow the task to run whether or not anyone is logged on.. Using a dedicated service account with minimal required permissions follows the principle of least privilege, reducing the attack surface. Allowing the task to run whether or not anyone is logged on ensures the scheduled task executes reliably without depending on a user session, which is essential for automated administrative tasks. This approach also avoids the security risks of using the built-in Administrator account, which has excessive privileges and is a common target for attackers.

Answer

Keep the Administrator account and leave the task running only when a user is logged on.

Answer

Move the script to the desktop so it is easier for technicians to monitor manually.

Answer

Disable the task and have staff run the script manually whenever they remember to do it.

Question 10

A SIEM correlates VPN authentication logs and sees 14 different user accounts receive one failed login attempt each from the same source IP during a 5-minute window. A few minutes later, one of those accounts successfully authenticates from that same IP. Which attack is most likely?

Accepted Answer

Password spraying using a common password against many accounts.. The SIEM observed 14 different user accounts each receiving a single failed login attempt from the same source IP within a 5-minute window, followed by one account successfully authenticating. This pattern is characteristic of password spraying, where an attacker tries a common password (e.g., 'Password123') against many accounts to avoid triggering account lockouts, then leverages a successful guess. The single failure per account avoids the threshold for brute-force detection, and the eventual success confirms a guessed credential.

Answer

Brute-force attack against a single account using many passwords.

Answer

Replay attack using previously captured authentication traffic.

Answer

ARP poisoning used to intercept local network traffic.

Question 11

A network analyst reviews packet captures from a subnet where users intermittently lose access to the gateway. Which two findings would most strongly indicate ARP spoofing? Select two.

Accepted Answer

Repeated unsolicited ARP replies map the gateway IP to a different MAC address.. ARP spoofing involves an attacker sending forged ARP replies to associate the gateway's IP address with the attacker's MAC address. Repeated unsolicited ARP replies mapping the gateway IP to a different MAC address is a classic indicator, as legitimate ARP replies are normally solicited by requests. This causes traffic intended for the gateway to be redirected to the attacker, enabling interception or disruption.

Answer

Extra DNS traffic appears during the lunch hour.

Answer

A switch port negotiates a slower speed than usual.

Answer

The wireless network name appears in a site survey.

Question 12

A Linux operations team must run a nightly maintenance script on 70 servers to rotate logs and restart one service. Security will not allow interactive SSH logins, and the script should only have the permissions required for those two commands. Which two configuration choices best meet the requirement? Select two.

Accepted Answer

Create a dedicated automation account and restrict it in sudoers to the exact commands needed.. Creating a dedicated automation account and restricting it in sudoers to the exact commands needed (e.g., `/usr/sbin/logrotate` and `/usr/bin/systemctl restart <service>`) enforces the principle of least privilege. This ensures the account can only execute the specific maintenance tasks without granting interactive SSH access or unnecessary permissions.

Answer

Place the automation account in the root group so it can restart services everywhere.

Answer

Copy the administrator's personal password into the script so the job can log in unattended.

Answer

Approve the job through email one time, then allow the script to run with no restrictions forever.

Question 13

A system administrator must run a weekly maintenance script that stops and restarts two services on 50 Linux servers. Security says the job must not use an interactive login and should have only the permissions needed for that task. What is the best approach?

Accepted Answer

Create a dedicated account with sudo rights limited to the required service commands.. It follows the principle of least privilege by creating a dedicated service account with sudo rights restricted to only the specific service management commands (e.g., systemctl restart serviceA.service && systemctl restart serviceB.service). This avoids using the root account (which has unrestricted access) and eliminates the need for interactive logins or embedded credentials, while still allowing the scheduled job (e.g., via cron) to run non-interactively.

Answer

Use the root account for the scheduled job so it always succeeds.

Answer

Ask an administrator to log in manually each week and run the script.

Answer

Store the administrator password in the script so the task can authenticate automatically.

Question 14

A public web application is seeing bursts of requests that contain SQL metacharacters, encoded script tags, and attempts to POST to administrative endpoints. The team wants a control that can inspect HTTP traffic and block the malicious requests before they reach the app. What should be deployed?

Accepted Answer

A web application firewall in front of the application. A web application firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at the application layer (Layer 7), analyzing request payloads for SQL metacharacters, encoded script tags (XSS), and unauthorized POST attempts to administrative endpoints. By deploying a WAF in front of the web application, malicious traffic is filtered and blocked before it reaches the application server, providing a proactive security control against common web attacks such as SQL injection and cross-site scripting.

Answer

An endpoint detection and response agent on the web server only

Answer

A data loss prevention rule on the email gateway

Answer

A network access control system for user authentication

Question 15

A help desk ticket reports that a user's Microsoft 365 mailbox sent hundreds of messages to external contacts, and the user says they are still receiving MFA prompts they did not start. The attacker may still have an active web session. What is the best first containment action?

Accepted Answer

Revoke the account's active sessions and reset the password immediately.. The user is still receiving unsolicited MFA prompts, indicating an attacker likely has an active web session with a valid token. Revoking all active sessions immediately invalidates any existing tokens or cookies, while resetting the password ensures the attacker cannot re-authenticate. This is the fastest way to cut off the attacker's access and stop further abuse of the mailbox.

Answer

Delete the suspicious sent messages and close the ticket.

Answer

Wait until the end of the workday to avoid interrupting the user.

Answer

Reimage the user's laptop before touching the email account.