SY0-701 Security Operations Practice Test 14 — 15 Questions

Question 1

A user reports that their laptop is suddenly encrypting files and showing a ransom note. What should the incident response team do first?

Accepted Answer

Isolate the laptop from the network to limit spread and preserve evidence.. When a laptop suddenly encrypts files and displays a ransom note, it indicates an active ransomware infection. The incident response team's first priority is to isolate the laptop from the network to prevent the ransomware from spreading laterally to other systems and to preserve volatile evidence (e.g., memory contents, running processes) that could be lost if the system is powered off or reconnected. This aligns with the NIST SP 800-61 incident response guidelines, which emphasize containment before eradication or recovery.

Answer

Immediately restore the laptop from backup before collecting any information.

Answer

Return the laptop to the user and monitor for additional alerts.

Answer

Apply all pending software updates to the laptop while it remains online.

Question 2

Based on the exhibit, what should the team do next after the account has been contained?

Accepted Answer

Remove mailbox persistence, revoke all tokens and app consent, then monitor for reentry.. After containing a compromised account (e.g., disabling it or resetting its password), the attacker may still have established persistence mechanisms such as mailbox forwarding rules, OAuth app consent grants, or session tokens that survive a password reset. Removing these artifacts and revoking all tokens and app consents ensures the attacker cannot regain access via delegated permissions or persistent mailbox rules. Monitoring for reentry is critical to detect any residual access or new compromise attempts.

Answer

Close the incident because the password reset removed the attacker from the environment.

Answer

Reimage the user's laptop before reviewing mailbox settings.

Answer

Restore the mailbox from backup to remove the forwarding rule and keep the user productive.

Question 3

After a suspicious laptop is imaged with a write blocker, the original drive is sealed and stored. Before a second analyst examines the image, what is the most important next step to preserve admissibility?

Accepted Answer

Document the transfer in the chain-of-custody log and verify the image hash still matches the acquisition value.. Before a second analyst accesses the image, the most critical step is to update the chain-of-custody log to document the transfer of custody and to verify the integrity of the image by comparing its current hash value against the original acquisition hash. This ensures that the evidence has not been altered or corrupted since it was first imaged, which is essential for maintaining admissibility in legal proceedings under rules such as the Federal Rules of Evidence.

Answer

Mount the image read/write so the analyst can browse faster.

Answer

Copy the image to a USB drive for easier transport.

Answer

Rename the evidence file to match the case number.

Question 4

A server room is located next to a chilled-water pipe, and facilities staff want the earliest possible warning if moisture starts leaking under the raised floor. Which control is the best fit?

Accepted Answer

Install water leak sensors tied into the environmental monitoring system.. Water leak sensors are specifically designed to detect the presence of moisture, and when integrated into an environmental monitoring system, they provide immediate alerts (e.g., SNMP traps or email notifications) at the earliest sign of a leak. This allows facilities staff to respond before water damages server equipment under the raised floor, meeting the requirement for earliest possible warning.

Answer

Replace the badge reader with a biometric lock.

Answer

Add a security camera pointing at the server racks.

Answer

Move the servers onto a separate VLAN.

Question 5

A SIEM analyst reviews authentication logs and sees the following pattern over 15 minutes: 68 different user accounts each had one failed login attempt from the same source IP, followed by no lockouts, and then one of the accounts successfully authenticated from that same IP using a valid password. What is the most likely explanation?

Accepted Answer

A password spraying attack using common passwords across many accounts.. The pattern of 68 different user accounts each experiencing a single failed login attempt from the same source IP, followed by one successful authentication from that IP using a valid password, is the classic signature of a password spraying attack. In password spraying, the attacker tries a small number of common passwords (often just one) against many accounts to avoid triggering account lockout policies, which typically lock an account after a small number of consecutive failures (e.g., 3–5 attempts). The single success indicates the attacker found an account using a weak or common password.

Answer

A brute-force attack against a single account using many password guesses.

Answer

A replay attack using captured authentication traffic.

Answer

A successful SSO federation event after a directory sync delay.

Question 6

After a ransomware incident, management learns the attacker's stolen domain admin credentials were used to delete recent online backups from the same backup network. Which backup strategy would have most reduced the chance of permanent backup loss?

Accepted Answer

Immutable backups stored in a separate repository or offline location.. Immutable backups stored in a separate repository or offline location prevent deletion or modification by an attacker, even with domain admin credentials. This is because immutability enforces a write-once-read-many (WORM) policy, often implemented via object lock (e.g., S3 Object Lock) or a physical air gap, ensuring that backups cannot be altered or deleted before their retention period expires. In this scenario, the attacker's ability to delete online backups from the same network is mitigated because the immutable repository is isolated and resistant to credential-based tampering.

Answer

Nightly incremental backups stored on the same file server as production data.

Answer

Hypervisor snapshots only, because they are always safer than backups.

Answer

Longer retention on the same backup share to keep more versions available.

Question 7

The email security team receives a suspicious invoice attachment from a vendor. The attachment is not blocked by signature-based detection, but the team wants to observe its behavior in a safe environment before delivery to users. What tool best fits this requirement?

Accepted Answer

Sandboxing the attachment in an isolated analysis environment. A sandbox provides an isolated, controlled environment where the suspicious attachment can be executed and monitored for malicious behavior without risking the production network. This allows the security team to observe dynamic indicators such as file system changes, registry modifications, or outbound connections that signature-based detection might miss. The goal is to analyze the attachment's true intent before deciding whether to deliver it to users.

Answer

Network access control for unmanaged devices

Answer

A data loss prevention rule on outbound email

Answer

An intrusion prevention system placed on the Wi-Fi network

Question 8

A nightly patch script restarts services on 40 Linux servers. Security does not want an administrator to log in interactively, and the script should only have the permissions needed to install approved patches and restart those services. What is the best design?

Accepted Answer

Run the script with a dedicated automation account that has only the required sudo permissions. It follows the principle of least privilege by using a dedicated automation account with only the specific sudo permissions needed to install approved patches and restart services. This prevents interactive login (as the account is configured for non-interactive use) and ensures the script cannot perform unauthorized actions, aligning with security best practices for automated tasks.

Answer

Use the root account for every scheduled execution to avoid permission errors

Answer

Hard-code the administrator password in the script so it never prompts

Answer

Ask each server owner to manually patch their system during the maintenance window

Question 9

An investigator must collect data from a suspected insider-threat laptop so the evidence could be used in an HR and legal review. Which action best preserves admissibility?

Accepted Answer

Create a forensic image through a write blocker and record hashes before and after acquisition. Creating a forensic image through a write blocker ensures the original evidence is not altered, preserving its integrity for admissibility in HR and legal proceedings. Recording hashes before and after acquisition allows verification that the image is an exact, unmodified copy, which is critical for chain of custody and meeting legal standards such as Daubert or Federal Rules of Evidence.

Answer

Boot the laptop normally and browse the user's files for clues

Answer

Copy the user's documents to a USB drive and continue the investigation later

Answer

Take screenshots of the desktop and delete the original drive contents afterward

Question 10

A SIEM alert shows 300 failed logins against the same VPN account from one source IP over 12 minutes, followed by a successful login from that same IP and a spike in mailbox access. The user says they did not initiate the session. What is the most likely cause?

Accepted Answer

A brute-force attack that eventually guessed the correct password. The sequence of 300 failed logins from a single source IP against one VPN account, followed by a successful login and abnormal mailbox access, is the classic pattern of a brute-force attack. The attacker systematically tried many passwords until they guessed the correct one, then used the compromised credentials to access the user's mailbox. The user's denial confirms the session was unauthorized, ruling out legitimate reconnection or synchronization.

Answer

A password-spraying attempt against many different accounts

Answer

A normal VPN reconnect after a brief network outage

Answer

A false positive caused by email synchronization

Question 11

Based on the exhibit, which change best improves secure administration for the scheduled task?

Accepted Answer

Use a dedicated service account with only the required permissions and allow the task to run whether or not anyone is logged on.. Using a dedicated service account with minimal required permissions follows the principle of least privilege, reducing the attack surface. Allowing the task to run whether or not anyone is logged on ensures the scheduled task executes reliably without depending on a user session, which is essential for automated administrative tasks. This approach also avoids the security risks of using the built-in Administrator account, which has excessive privileges and is a common target for attackers.

Answer

Keep the Administrator account and leave the task running only when a user is logged on.

Answer

Move the script to the desktop so it is easier for technicians to monitor manually.

Answer

Disable the task and have staff run the script manually whenever they remember to do it.

Question 12

A SIEM correlates VPN authentication logs and sees 14 different user accounts receive one failed login attempt each from the same source IP during a 5-minute window. A few minutes later, one of those accounts successfully authenticates from that same IP. Which attack is most likely?

Accepted Answer

Password spraying using a common password against many accounts.. The SIEM observed 14 different user accounts each receiving a single failed login attempt from the same source IP within a 5-minute window, followed by one account successfully authenticating. This pattern is characteristic of password spraying, where an attacker tries a common password (e.g., 'Password123') against many accounts to avoid triggering account lockouts, then leverages a successful guess. The single failure per account avoids the threshold for brute-force detection, and the eventual success confirms a guessed credential.

Answer

Brute-force attack against a single account using many passwords.

Answer

Replay attack using previously captured authentication traffic.

Answer

ARP poisoning used to intercept local network traffic.

Question 13

A network analyst reviews packet captures from a subnet where users intermittently lose access to the gateway. Which two findings would most strongly indicate ARP spoofing? Select two.

Accepted Answer

Repeated unsolicited ARP replies map the gateway IP to a different MAC address.. ARP spoofing involves an attacker sending forged ARP replies to associate the gateway's IP address with the attacker's MAC address. Repeated unsolicited ARP replies mapping the gateway IP to a different MAC address is a classic indicator, as legitimate ARP replies are normally solicited by requests. This causes traffic intended for the gateway to be redirected to the attacker, enabling interception or disruption.

Answer

Extra DNS traffic appears during the lunch hour.

Answer

A switch port negotiates a slower speed than usual.

Answer

The wireless network name appears in a site survey.

Question 14

A Linux operations team must run a nightly maintenance script on 70 servers to rotate logs and restart one service. Security will not allow interactive SSH logins, and the script should only have the permissions required for those two commands. Which two configuration choices best meet the requirement? Select two.

Accepted Answer

Create a dedicated automation account and restrict it in sudoers to the exact commands needed.. Option A is correct because a dedicated automation account scoped in sudoers to only the exact log-rotation and service-restart commands enforces least privilege, satisfying the requirement that the script have only the permissions needed for those two operations. Option C is correct because SSH key authentication with a forced command (via authorized_keys command=) or a restricted shell prevents interactive logins while still allowing the non-interactive nightly job to execute only the permitted action, directly meeting the security ban on interactive SSH. Option B is wrong because adding the account to the root group grants far broader privileges than the two required commands, violating least privilege. Option D is wrong because embedding an administrator's personal password in a script is a credential-exposure and non-repudiation violation and does not meet the no-interactive-login policy. Option E is wrong because one-time email approval followed by unrestricted permanent execution removes all ongoing access control and auditing.

Answer

Place the automation account in the root group so it can restart services everywhere.

Answer

Copy the administrator's personal password into the script so the job can log in unattended.

Answer

Approve the job through email one time, then allow the script to run with no restrictions forever.

Question 15

A system administrator must run a weekly maintenance script that stops and restarts two services on 50 Linux servers. Security says the job must not use an interactive login and should have only the permissions needed for that task. What is the best approach?

Accepted Answer

Create a dedicated account with sudo rights limited to the required service commands.. It follows the principle of least privilege by creating a dedicated service account with sudo rights restricted to only the specific service management commands (e.g., systemctl restart serviceA.service && systemctl restart serviceB.service). This avoids using the root account (which has unrestricted access) and eliminates the need for interactive logins or embedded credentials, while still allowing the scheduled job (e.g., via cron) to run non-interactively.

Answer

Use the root account for the scheduled job so it always succeeds.

Answer

Ask an administrator to log in manually each week and run the script.

Answer

Store the administrator password in the script so the task can authenticate automatically.