SY0-701 Security Operations Practice Test 14 — 15 Questions

Question 1

A system administrator must run a weekly maintenance script that stops and restarts two services on 50 Linux servers. Security says the job must not use an interactive login and should have only the permissions needed for that task. What is the best approach?

Accepted Answer

Create a dedicated account with sudo rights limited to the required service commands.. Option B is correct because it follows the principle of least privilege by creating a dedicated service account with sudo rights restricted to only the specific service management commands (e.g., systemctl restart serviceA.service && systemctl restart serviceB.service). This avoids using the root account (which has unrestricted access) and eliminates the need for interactive logins or embedded credentials, while still allowing the scheduled job (e.g., via cron) to run non-interactively.

Answer

Use the root account for the scheduled job so it always succeeds.

Answer

Ask an administrator to log in manually each week and run the script.

Answer

Store the administrator password in the script so the task can authenticate automatically.

Question 2

A public web application is seeing bursts of requests that contain SQL metacharacters, encoded script tags, and attempts to POST to administrative endpoints. The team wants a control that can inspect HTTP traffic and block the malicious requests before they reach the app. What should be deployed?

Accepted Answer

A web application firewall in front of the application. A web application firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at the application layer (Layer 7), analyzing request payloads for SQL metacharacters, encoded script tags (XSS), and unauthorized POST attempts to administrative endpoints. By deploying a WAF in front of the web application, malicious traffic is filtered and blocked before it reaches the application server, providing a proactive security control against common web attacks such as SQL injection and cross-site scripting.

Answer

An endpoint detection and response agent on the web server only

Answer

A data loss prevention rule on the email gateway

Answer

A network access control system for user authentication

Question 3

A help desk ticket reports that a user's Microsoft 365 mailbox sent hundreds of messages to external contacts, and the user says they are still receiving MFA prompts they did not start. The attacker may still have an active web session. What is the best first containment action?

Accepted Answer

Revoke the account's active sessions and reset the password immediately.. Option B is correct because the user is still receiving unsolicited MFA prompts, indicating an attacker likely has an active web session with a valid token. Revoking all active sessions immediately invalidates any existing tokens or cookies, while resetting the password ensures the attacker cannot re-authenticate. This is the fastest way to cut off the attacker's access and stop further abuse of the mailbox.

Answer

Delete the suspicious sent messages and close the ticket.

Answer

Wait until the end of the workday to avoid interrupting the user.

Answer

Reimage the user's laptop before touching the email account.

Question 4

An investigator has just created a bit-for-bit image of a suspect's SSD using a write blocker. Before the drive is returned to evidence storage, what action most directly validates the integrity of both the original media and the image?

Accepted Answer

Calculate cryptographic hashes of the source and the image and record them.. Option B is correct because cryptographic hashing (e.g., SHA-256 or MD5) generates a unique digital fingerprint of the original SSD and the forensic image. By comparing the hash values, the investigator can verify that the bit-for-bit copy is identical to the source, ensuring data integrity and admissibility in legal proceedings. This step directly validates that no data has been altered or omitted during acquisition.

Answer

Defragment the original SSD to make later analysis faster.

Answer

Compress the image file to reduce storage usage before documentation.

Answer

Wipe free space on the original SSD to remove deleted remnants.

Question 5

After a ransomware incident, management sees that last night's backups completed successfully and wants proof they can actually be used before production is declared recovered. Which three actions best validate recoverability? Select three.

Accepted Answer

Restore a representative backup into an isolated test environment.. Option A is correct because restoring a representative backup into an isolated test environment directly validates that the backup data is readable, the restore process works, and the system can be brought online without impacting production. This is the only way to confirm the backup is not corrupt or incomplete, as backup software success logs alone are insufficient.

Answer

Increase the retention period without performing any restore.

Answer

Close the incident because the backup software reported a successful job completion.

Question 6

After seizing a suspect's laptop, a responder creates a bit-for-bit disk image using a write blocker. The legal team wants the next step that most directly supports evidence integrity for later review. What should the responder do?

Accepted Answer

Compute and document cryptographic hash values for the source and the image.. Computing and documenting cryptographic hash values (e.g., SHA-256 or MD5) for both the source drive and the bit-for-bit image creates a digital fingerprint. If the hashes match, it proves the image is an exact, unaltered copy of the original evidence, directly supporting integrity for later review. This step is foundational in forensic acquisition to meet legal standards for admissibility.

Answer

Open the image file and browse folders to confirm the contents look normal.

Answer

Rename the image file with the case number and store it on a desktop.

Answer

Run a full antivirus scan on the image before logging it in.

Question 7

A branch office's network closet has repeated unauthorized access issues after staff badge in and hold the door for others. Management wants a control that allows one person through after valid badge use and helps prevent tailgating. Which control is best?

Accepted Answer

A mantrap, because it physically restricts entry to one person at a time.. A mantrap is a physical security control consisting of a small space with two interlocking doors, typically requiring authentication to enter and exit. It ensures that only one person can pass through at a time, effectively preventing tailgating by trapping unauthorized individuals between the doors if they attempt to follow an authorized user.

Answer

Closed-circuit television cameras, because they record the doorway for later review.

Answer

A motion sensor, because it can detect movement inside the room.

Answer

A door closer, because it ensures the door automatically shuts after use.

Question 8

A SIEM analyst reviews the following sequence from a VPN and email platform over 15 minutes: 47 failed logins against different accounts from one public IP, one successful VPN login from that same IP, a new inbox forwarding rule to an external address, and a mailbox sign-in from a device never seen before. Which three findings most strongly support a password-spraying-to-compromise scenario? Select three.

Accepted Answer

Many failed logins across different usernames from the same source IP in a short time window.. Option A is correct because a high volume of failed logins against multiple accounts from a single public IP within a short time window is the hallmark of a password-spraying attack, where the attacker tries a few common passwords across many usernames to avoid account lockout. This pattern is distinct from a brute-force attack, which targets a single account with many passwords.

Answer

A workstation patch installation completed earlier that day.

Answer

The mailbox server reported normal disk utilization during the same hour.

Question 9

After a ransomware incident, management says backups are available but will not approve closure until the team proves the restore process works without risking production data. Which two actions best validate recoverability? Select two.

Accepted Answer

Restore a recent backup to an isolated test system that mirrors production.. Restoring to an isolated test system that mirrors production (Option A) is correct because it validates the backup's integrity and the restore process without any risk to the live production environment. This approach ensures the backup data is readable and the restoration steps are documented and repeatable, directly addressing management's requirement to prove recoverability without endangering production data.

Answer

Increase backup retention without testing the restore process.

Answer

Keep the original ransomware-affected server online until the backup is approved.

Answer

Use the backup job report as proof that the data can be recovered.

Question 10

A data center has repeated tailgating incidents at the entry to the server room. Management wants a control that forces one person to pass after badge authentication and prevents two people from entering together. What should be installed?

Accepted Answer

A mantrap between the outer door and the server room entrance. A mantrap is a physical security control with two interlocking doors that enforces one-person entry. After badge authentication at the outer door, the inner door will not unlock until the outer door closes and locks, preventing two people from entering together. This directly addresses tailgating by creating a small vestibule that can only hold one authenticated person at a time.

Answer

A CCTV camera focused on the doorway

Answer

A motion sensor inside the server room

Answer

A standard badge reader with no additional controls

Question 11

A server room uses raised flooring and sits below a chilled-water pipe. Facilities wants the earliest warning if water starts accumulating under the floor tiles. Which control should be added?

Accepted Answer

Install leak-detection sensors or a moisture detection cable tied to alerts.. Option D is correct because leak-detection sensors or moisture-detection cables are specifically designed to detect water accumulation under raised floors, providing the earliest possible warning. These sensors trigger alerts when moisture is present, allowing facilities to respond before water damages equipment or causes downtime. This directly addresses the risk of a chilled-water pipe leak in a server room environment.

Answer

Add more motion detectors near the racks.

Answer

Use badge readers on the server room door.

Answer

Install smoke detectors only.

Question 12

After collecting a suspect laptop, the responder makes a bit-for-bit image of the drive. Which two actions best support chain of custody? Select two.

Accepted Answer

Calculate and record a cryptographic hash of the image.. Option A is correct because calculating and recording a cryptographic hash (e.g., SHA-256) of the bit-for-bit image creates a digital fingerprint that can later be used to verify the image has not been altered. This ensures data integrity, a core requirement for maintaining chain of custody in digital forensics.

Answer

Browse the original drive on a normal office laptop.

Answer

Rename files to make them easier for later review.

Answer

Store the image on a shared folder without access controls.

Question 13

An analyst receives a disk image and the original hash from a response team member. Before any examination begins, the analyst must be able to show the image is unchanged and that the evidence handling process is defensible. Which two actions are most important? Select two.

Accepted Answer

Recompute the SHA-256 hash of the received image and compare it to the acquisition record.. Recomputing the SHA-256 hash of the received image and comparing it to the original acquisition record is essential to verify data integrity. SHA-256 is a cryptographic hash function that produces a unique fixed-size output; if even one bit of the image changes, the hash will differ. This comparison proves the image has not been altered during transit or storage, which is a foundational requirement for maintaining forensic soundness.

Answer

Mount the original disk read/write so the file system can repair itself before analysis.

Answer

Convert the image to another format before hashing so the tool can open it.

Answer

Rename evidence files to match the case number and avoid confusion.

Question 14

A help desk technician receives an alert that an unmanaged laptop was plugged into a conference room network jack and was automatically placed into a restricted network segment until it passed a security check. Which control is responsible for that behavior?

Accepted Answer

Network access control (NAC).. Network Access Control (NAC) is the correct answer because it is specifically designed to enforce security policies on devices attempting to connect to a network. When an unmanaged laptop is plugged into a network jack, NAC evaluates the device's compliance (e.g., antivirus status, patch level) and, if it fails, automatically places it into a restricted segment (e.g., a quarantine VLAN) until it passes a security check. This behavior is a core function of NAC solutions like Cisco ISE or Aruba ClearPass, which use 802.1X or MAC authentication bypass to dynamically assign VLANs based on device posture.

Answer

Data loss prevention (DLP).

Answer

Intrusion prevention system (IPS).

Answer

Sandboxing gateway.

Question 15

A records room has repeated tailgating after hours and occasional door propping during deliveries. Management wants one control that prevents follow-on entry and another that immediately alerts security if the door is forced open or left ajar. Which two controls best meet the need? Select two.

Accepted Answer

Install a mantrap at the room entrance.. A mantrap (option A) prevents tailgating by requiring one door to close before the next can open, effectively stopping follow-on entry. A door position sensor (option B) detects when the door is forced open or left ajar and triggers an immediate alert to security via an alarm or SIEM integration, meeting the requirement for real-time notification.

Answer

Place a larger warning sign on the wall beside the door.

Answer

Mount a visible camera over the door only.

Answer

Replace the mechanical lock with the same type of lock and no monitoring.