SY0-701 Security Operations Practice Test 15 — 15 Questions

Question 1

An investigator has just created a bit-for-bit image of a suspect's SSD using a write blocker. Before the drive is returned to evidence storage, what action most directly validates the integrity of both the original media and the image?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Calculate cryptographic hashes of the source and the image and record them.. Cryptographic hashing (e.g., SHA-256 or MD5) generates a unique digital fingerprint of the original SSD and the forensic image. By comparing the hash values, the investigator can verify that the bit-for-bit copy is identical to the source, ensuring data integrity and admissibility in legal proceedings. This step directly validates that no data has been altered or omitted during acquisition.

Answer

Defragment the original SSD to make later analysis faster.

Answer

Compress the image file to reduce storage usage before documentation.

Answer

Wipe free space on the original SSD to remove deleted remnants.

Question 2

After seizing a suspect's laptop, a responder creates a bit-for-bit disk image using a write blocker. The legal team wants the next step that most directly supports evidence integrity for later review. What should the responder do?

Accepted Answer

Compute and document cryptographic hash values for the source and the image.. Computing and documenting cryptographic hash values (e.g., SHA-256 or MD5) for both the source drive and the bit-for-bit image creates a digital fingerprint. If the hashes match, it proves the image is an exact, unaltered copy of the original evidence, directly supporting integrity for later review. This step is foundational in forensic acquisition to meet legal standards for admissibility.

Answer

Open the image file and browse folders to confirm the contents look normal.

Answer

Rename the image file with the case number and store it on a desktop.

Answer

Run a full antivirus scan on the image before logging it in.

Question 3

A branch office's network closet has repeated unauthorized access issues after staff badge in and hold the door for others. Management wants a control that allows one person through after valid badge use and helps prevent tailgating. Which control is best?

Accepted Answer

A mantrap, because it physically restricts entry to one person at a time.. A mantrap is a physical security control consisting of a small space with two interlocking doors, typically requiring authentication to enter and exit. It ensures that only one person can pass through at a time, effectively preventing tailgating by trapping unauthorized individuals between the doors if they attempt to follow an authorized user.

Answer

Closed-circuit television cameras, because they record the doorway for later review.

Answer

A motion sensor, because it can detect movement inside the room.

Answer

A door closer, because it ensures the door automatically shuts after use.

Question 4

A SIEM analyst reviews the following sequence from a VPN and email platform over 15 minutes: 47 failed logins against different accounts from one public IP, one successful VPN login from that same IP, a new inbox forwarding rule to an external address, and a mailbox sign-in from a device never seen before. Which three findings most strongly support a password-spraying-to-compromise scenario? Select three.

Accepted Answer

Many failed logins across different usernames from the same source IP in a short time window.. A high volume of failed logins against multiple accounts from a single public IP within a short time window is the hallmark of a password-spraying attack, where the attacker tries a few common passwords across many usernames to avoid account lockout. This pattern is distinct from a brute-force attack, which targets a single account with many passwords.

Answer

A workstation patch installation completed earlier that day.

Answer

The mailbox server reported normal disk utilization during the same hour.

Question 5

A data center has repeated tailgating incidents at the entry to the server room. Management wants a control that forces one person to pass after badge authentication and prevents two people from entering together. What should be installed?

Accepted Answer

A mantrap between the outer door and the server room entrance. A mantrap is a physical security control with two interlocking doors that enforces one-person entry. After badge authentication at the outer door, the inner door will not unlock until the outer door closes and locks, preventing two people from entering together. This directly addresses tailgating by creating a small vestibule that can only hold one authenticated person at a time.

Answer

A CCTV camera focused on the doorway

Answer

A motion sensor inside the server room

Answer

A standard badge reader with no additional controls

Question 6

A server room uses raised flooring and sits below a chilled-water pipe. Facilities wants the earliest warning if water starts accumulating under the floor tiles. Which control should be added?

Accepted Answer

Install leak-detection sensors or a moisture detection cable tied to alerts.. Leak-detection sensors or moisture-detection cables are specifically designed to detect water accumulation under raised floors, providing the earliest possible warning. These sensors trigger alerts when moisture is present, allowing facilities to respond before water damages equipment or causes downtime. This directly addresses the risk of a chilled-water pipe leak in a server room environment.

Answer

Add more motion detectors near the racks.

Answer

Use badge readers on the server room door.

Answer

Install smoke detectors only.

Question 7

A help desk technician receives an alert that an unmanaged laptop was plugged into a conference room network jack and was automatically placed into a restricted network segment until it passed a security check. Which control is responsible for that behavior?

Accepted Answer

Network access control (NAC).. Network Access Control (NAC) is the correct answer because it is specifically designed to enforce security policies on devices attempting to connect to a network. When an unmanaged laptop is plugged into a network jack, NAC evaluates the device's compliance (e.g., antivirus status, patch level) and, if it fails, automatically places it into a restricted segment (e.g., a quarantine VLAN) until it passes a security check. This behavior is a core function of NAC solutions like Cisco ISE or Aruba ClearPass, which use 802.1X or MAC authentication bypass to dynamically assign VLANs based on device posture.

Answer

Data loss prevention (DLP).

Answer

Intrusion prevention system (IPS).

Answer

Sandboxing gateway.

Question 8

A records room has repeated tailgating after hours and occasional door propping during deliveries. Management wants one control that prevents follow-on entry and another that immediately alerts security if the door is forced open or left ajar. Which two controls best meet the need? Select two.

Accepted Answer

Install a mantrap at the room entrance.. A mantrap (option A) prevents tailgating by requiring one door to close before the next can open, effectively stopping follow-on entry. A door position sensor (option B) detects when the door is forced open or left ajar and triggers an immediate alert to security via an alarm or SIEM integration, meeting the requirement for real-time notification.

Answer

Place a larger warning sign on the wall beside the door.

Answer

Mount a visible camera over the door only.

Answer

Replace the mechanical lock with the same type of lock and no monitoring.

Question 9

A security team receives a suspicious email attachment and wants to inspect its behavior safely before any user opens it. They also want a tool that can isolate the same threat if it reaches an endpoint. Which two tools or capabilities best fit this need? Select two.

Accepted Answer

EDR remote isolation capability on the endpoint.. A is correct because EDR remote isolation capability allows the security team to immediately disconnect an endpoint from the network if the suspicious attachment is executed, preventing lateral movement and data exfiltration. B is correct because sandboxing the attachment before release to users provides a safe, isolated environment to analyze the file's behavior without risking the production network. Together, these tools address both proactive analysis (sandbox) and reactive containment (EDR isolation).

Answer

DLP monitoring to prevent accidental data leakage.

Answer

A WAF filtering web requests to the application.

Answer

Port mirroring on a switch for traffic review.

Question 10

A system administrator must run a weekly patch-and-restart job on 80 Linux servers without logging in interactively. The job should be repeatable, auditable, and limited to only the required maintenance commands. What is the best approach?

Accepted Answer

Use a configuration management tool with a dedicated service account and restricted sudo permissions.. B is correct because configuration management tools (e.g., Ansible, Puppet, or SaltStack) allow you to define a repeatable, auditable patch-and-restart job using a dedicated service account with restricted sudo permissions. This approach enforces the principle of least privilege, logs all actions via the tool's job history, and eliminates the need for interactive login, meeting all requirements for automation, auditability, and command restriction.

Answer

Share a root SSH key with the operations team so anyone can run the job.

Answer

Have each administrator log in manually and run the commands from an interactive shell.

Answer

Create a local root account on every server for maintenance tasks.

Question 11

A SOC analyst reviews an EDR alert showing powershell.exe launched with an encoded command, then immediately connected to an unfamiliar IP address and spawned rundll32.exe. The user is still logged in and the machine may still contain evidence needed for investigation. Which two actions should the analyst take first to contain the incident while preserving evidence? Select two.

Accepted Answer

Isolate the endpoint using EDR network containment or a quarantine policy.. Isolating the endpoint via EDR network containment or quarantine policy immediately stops the malicious process from communicating with the command-and-control (C2) server at the unfamiliar IP address, preventing data exfiltration and lateral movement. This action preserves the volatile evidence in memory (e.g., the spawned rundll32.exe process) and on disk, allowing forensic analysis without the risk of the attacker destroying evidence remotely.

Answer

Reboot the workstation immediately to clear any malicious process from memory.

Answer

Run a full vulnerability scan before taking any other action.

Answer

Delete the suspicious email from the mailbox to remove the original payload.

Question 12

Based on the exhibit, which tool should the security team use to safely observe the attachment's behavior before delivery to users?

Accepted Answer

Sandboxing, so the file can execute in a controlled environment before release.. Sandboxing allows the security team to execute the attachment in a controlled, isolated environment to observe its behavior (e.g., network connections, file modifications) without risking the production network. This is the correct approach because it safely detonates the file before delivery, enabling detection of malicious activity such as ransomware or trojans. Other tools like DLP, NAC, or SIEM do not provide the dynamic analysis needed to assess the attachment's runtime behavior.

Answer

DLP, so the gateway can block sensitive data from leaving the organization.

Answer

NAC, so the sender's device can be checked before the message is accepted.

Answer

SIEM, so the team can store the attachment and review alerts later.

Question 13

Facilities sees occasional water droplets forming above the cable trays in a data room during humid afternoons. The team wants the earliest possible warning before equipment is damaged. Which control should be added?

Accepted Answer

Water leak sensors tied to environmental monitoring.. Water leak sensors tied to environmental monitoring provide the earliest possible warning by detecting moisture directly on or near the cable trays. Unlike motion detectors or badge readers, these sensors are specifically designed to alert before water reaches sensitive equipment, enabling proactive remediation.

Answer

Motion detectors connected to the alarm panel.

Answer

Badge readers on the room entrance only.

Answer

Fire suppression tests scheduled more frequently.

Question 14

A SIEM correlates the following: 17 failed logons against the same VPN account from one IP in 9 minutes, a successful login from that IP, creation of a new API token in the SaaS tenant, and a large export job started two minutes later. Which two interpretations are best supported? Select two.

Accepted Answer

The attacker is likely performing a brute-force password attack against a single account.. A is correct because 17 failed logons against a single VPN account from one IP in 9 minutes is a classic brute-force pattern—repeated authentication attempts targeting one username. The subsequent successful login, API token creation, and data export indicate the attacker gained access and then established persistence (via the token) to exfiltrate data, confirming the account was compromised.

Answer

The pattern is most consistent with password spraying across many accounts.

Answer

The events primarily indicate a volumetric denial-of-service attack.

Answer

Token creation proves the account password was never exposed.

Question 15

A contractor connects a personal tablet to a lobby Ethernet jack. The network team wants the device blocked from internal resources until it passes posture checks and only guest access is allowed meanwhile. Which control best fits?

Accepted Answer

Network access control that verifies the device before granting access.. Network Access Control (NAC) is the correct solution because it enforces security policies by checking a device's compliance (e.g., antivirus, patch level) before granting access to internal resources. In this scenario, the contractor's tablet is initially placed on a guest VLAN with internet-only access until posture checks pass, which is a core NAC function (e.g., using 802.1X or MAC authentication bypass).

Answer

A data loss prevention platform that inspects file transfers.

Answer

A network intrusion detection system placed inline at the switch.

Answer

A VPN concentrator that encrypts remote traffic back to headquarters.