SY0-701 Security Operations Practice Test 16 — 15 Questions

Question 1

After a ransomware event, management wants proof that last night's backups can actually support business operations before they declare recovery complete. What is the best action?

Accepted Answer

Perform a test restore into an isolated environment and validate the files or application work correctly.. Performing a test restore into an isolated environment directly validates that the backup data is intact, the restore process works, and the restored files or applications function as expected. This provides management with the proof they need to confirm business operations can resume, which is the core requirement after a ransomware event.

Answer

Increase the backup retention period without testing the backups.

Answer

Copy the backup set to a new storage bucket and assume it is usable.

Answer

Run a vulnerability scan against the backup server.

Question 2

A Linux operations team needs to run a nightly script that restarts one service and archives its logs on 60 servers. Security does not want an administrator to log in interactively, and the script should have only the permissions needed for that job. What is the best approach?

Accepted Answer

Create a dedicated service account with only the delegated rights needed, and run the script as a scheduled job.. It follows the principle of least privilege by creating a dedicated service account with only the specific rights needed to restart the service and archive logs. Running the script as a scheduled job (e.g., via cron) eliminates the need for interactive login, satisfying the security requirement. This approach minimizes the attack surface and ensures the job runs automatically without exposing administrative credentials.

Answer

Use the root account so the job never fails.

Answer

Store an administrator's SSH key inside the script.

Answer

Have an operator log in and run the commands manually each night.

Question 3

A SOC analyst confirms that a critical Linux virtual machine is making outbound connections to a known malicious IP address. The application owner says the VM hosts a revenue system that cannot be powered off without causing a major outage. What is the best containment action?

Accepted Answer

Isolate the VM at the network layer while keeping it powered on.. Network isolation (e.g., applying a firewall ACL or moving the VM to a quarantine VLAN) stops outbound malicious traffic while keeping the revenue-critical system powered on and available for forensic analysis. This balances security containment with business continuity, as shutting down the VM (Option A) would cause a major outage, and waiting (Option C) would allow continued data exfiltration or lateral movement.

Answer

Shut down the VM immediately to stop all malicious activity.

Answer

Wait for the next maintenance window before taking action.

Answer

Reimage the VM from a known-good template immediately.

Question 4

Based on the exhibit, which control would best reduce unauthorized follow-on entry into the records room?

Accepted Answer

Install a mantrap so only one person can pass through at a time.. A mantrap is a physical security control consisting of a small space with two interlocking doors, designed to allow only one person to pass at a time. This prevents tailgating and piggybacking, which are common methods of unauthorized follow-on entry into a restricted area like a records room.

Answer

Add more network firewall rules around the records room door.

Answer

Increase the screen lock timeout on nearby workstations.

Answer

Replace the UPS batteries to stop unauthorized people from entering.

Question 5

A SIEM correlates VPN logs and sees the same public IP make one failed login attempt against 56 different user accounts over 25 minutes. The usernames vary, but the password value appears to be the same in each attempt. Ten minutes later, one of those accounts authenticates successfully from the same IP, and no password-reset events are recorded. Which attack pattern is most likely?

Accepted Answer

Password spraying against multiple accounts with a shared password guess.. The SIEM logs show the same public IP attempting to authenticate with 56 different usernames using the same password. This is the hallmark of a password spraying attack, where an attacker tries a single common password against many accounts to avoid account lockout policies. The subsequent successful authentication from the same IP, without a password reset, confirms the guessed password was valid for one account.

Answer

A brute-force attack focused on a single account with repeated rapid guesses.

Answer

A replay attack using captured authentication traffic from a previous session.

Answer

Credential stuffing using known breached username and password pairs.

Question 6

Help desk staff must restart one Windows service and read its event logs on 150 servers, but they should not have local administrator rights or interactive logon to the systems. Which approach best supports this requirement?

Accepted Answer

Use a Just Enough Administration constrained endpoint for the allowed tasks.. Just Enough Administration (JEA) allows you to create constrained PowerShell endpoints that delegate specific administrative tasks—such as restarting a service and reading event logs—without granting full local administrator rights or interactive logon. By defining role capabilities that limit cmdlets and parameters, help desk staff can perform only the required operations on all 150 servers via a constrained endpoint, meeting the security requirement precisely.

Answer

Create one shared local administrator account for the entire help desk team.

Answer

Add the staff to the local Administrators group on every server.

Answer

Run the maintenance job under each technician's personal account on a schedule.

Question 7

After seizing a suspected insider's laptop, a responder makes a bit-for-bit image of the drive. The legal team asks what step most directly proves the image was not altered after acquisition. What should be done?

Accepted Answer

Compute and document cryptographic hashes of the source media and the forensic image.. Computing and documenting cryptographic hashes (e.g., SHA-256 or MD5) of both the source media and the forensic image immediately after acquisition creates a verifiable digital fingerprint. If the hash values match, it proves that the image is an exact, unaltered copy of the original drive. This step is foundational to maintaining the chain of custody and ensuring data integrity in forensic investigations.

Answer

Record the laptop's hostname and the user who last logged in.

Answer

Copy the most recent files to a USB drive for quick review.

Answer

Return the laptop to the user once the image is saved.

Question 8

A SOC analyst reviews one user account and sees several failed logins from a single IP, then a successful login from the same IP, followed by a new inbox forwarding rule to an external address. Which two findings most strongly suggest account compromise? Select two.

Accepted Answer

Repeated failed logins followed by a successful login from the same source IP.. A brute-force attack pattern—multiple failed logins followed by a successful authentication from the same external IP—strongly indicates credential compromise. This sequence suggests the attacker guessed or obtained the password and then successfully logged in. The single source IP ties the failed attempts to the eventual successful session, making it a classic indicator of account takeover.

Answer

The user authenticated during normal business hours.

Answer

The user accessed email from a corporate laptop.

Answer

The password age is 89 days.

Question 9

Based on the exhibit, what should the team do next to confirm the backups can actually be used during an outage?

Accepted Answer

Perform a test restore to a nonproduction location and verify the recovered files.. The only way to confirm that backups are usable during an outage is to perform a test restore to a nonproduction location and verify the recovered files. This validates the integrity of the backup data, the restore process, and that the files are complete and functional, which is a core principle of backup validation (often called a 'restore test' or 'disaster recovery drill'). Simply reviewing backup status reports or increasing retention does not prove that the data can be successfully restored.

Answer

Increase the retention period before making any restore attempts.

Answer

Delete older backup sets so the backup window is shorter.

Answer

Convert the backups to full backups only so the status report is simpler.

Question 10

A company is placing a customer-facing web application behind a new security control. The team wants to block malicious HTTP requests such as injection attempts before they reach the application server, with minimal code changes to the app itself. Which control is the best fit?

Accepted Answer

Web application firewall (WAF) in front of the application.. A web application firewall (WAF) is specifically designed to inspect and filter HTTP/HTTPS traffic at the application layer (Layer 7), blocking malicious payloads such as SQL injection and cross-site scripting (XSS) before they reach the web server. It operates without requiring changes to the application code, making it the ideal choice for this scenario.

Answer

Network access control (NAC) at the switch port.

Answer

Data loss prevention (DLP) on the email gateway.

Answer

Endpoint detection and response (EDR) on the web server only.

Question 11

A SOC analyst receives an EDR alert showing a finance laptop creating encrypted archives and then attempting SMB connections to several internal file shares. The user is still logged in, and the business wants to stop possible spread without destroying volatile evidence. What should the analyst do first?

Accepted Answer

Isolate the endpoint from the network using the EDR containment feature.. The EDR containment feature isolates the endpoint from the network while preserving all running processes, memory, and disk state. This stops the encrypted archives from being exfiltrated via SMB and prevents lateral movement, but keeps volatile evidence (e.g., active malware processes, network connections) intact for forensic analysis.

Answer

Power off the laptop immediately to stop all activity.

Answer

Reimage the laptop from a gold image as soon as possible.

Answer

Disable the user account in Active Directory and wait for the malware to stop.

Question 12

An email attachment from an external supplier is not blocked by signature-based AV, but the SOC wants to see whether it drops files, launches child processes, or contacts suspicious domains before delivery to users. Which control best fits?

Accepted Answer

Sandboxing, because it detonates the file in an isolated environment.. Sandboxing is the correct control because it detonates the file in an isolated, virtualized environment to observe its runtime behavior, such as dropping files, spawning child processes, or making outbound connections to suspicious domains. This goes beyond signature-based AV by analyzing dynamic behavior rather than static file hashes or patterns. The SOC's goal is to assess the file's actions before delivery, which sandboxing directly addresses.

Answer

Network IDS, because it passively monitors traffic for known threats.

Answer

DLP, because it prevents sensitive data from leaving the organization.

Answer

NAC, because it controls whether a device can join the network.

Question 13

Based on the exhibit, what should the analyst do before opening the forensic image for examination?

Accepted Answer

Calculate and compare the image hash to the source hash before analysis.. Before examining a forensic image, the analyst must verify its integrity by calculating its hash (e.g., MD5, SHA-1, SHA-256) and comparing it to the known hash of the original source. This ensures the image is an exact, unaltered copy, which is critical for maintaining the chain of custody and admissibility of evidence. Option B is correct because hash verification is the foundational step in forensic analysis.

Answer

Mount the image read-write so the analyst can begin searching immediately.

Answer

Defragment the original SSD so the files will be easier to search later.

Answer

Compress the image into a ZIP file to reduce storage usage before verifying it.

Question 14

After hours, EDR alerts show a finance laptop encrypting local files and trying SMB connections to nearby workstations. The user is still logged in, and management wants the fastest step that limits spread while preserving evidence. What should the SOC do first?

Accepted Answer

Use EDR to isolate the laptop from the network.. EDR isolation immediately blocks all network communication (including SMB) while preserving the endpoint's state for forensic analysis. This stops lateral movement and further encryption without losing volatile data like memory or running processes, which a shutdown would destroy.

Answer

Shut down the laptop immediately to stop any further activity.

Answer

Run a full antivirus scan before making any network changes.

Answer

Reimage the laptop right away from a standard corporate image.

Question 15

Following a ransomware incident, management wants to verify that backups are usable and that a restored file server will meet recovery expectations before declaring the system trusted again. Which action is best?

Accepted Answer

Perform a documented restore test in an isolated environment and validate the recovered data.. Performing a documented restore test in an isolated environment is the only action that directly validates the integrity and usability of backups, ensuring the restored file server meets recovery point objective (RPO) and recovery time objective (RTO) expectations. This process verifies that the backup data is not corrupted, encrypted, or incomplete, which is critical after a ransomware incident where backups may have been targeted. Without such a test, management cannot confidently declare the system trusted, as logs or retention changes do not prove data recoverability.

Answer

Review the backup job logs and mark the backups as valid.

Answer

Increase the retention period so more restore points are available later.

Answer

Create a new full backup immediately after the incident and trust that one instead.