SY0-701 Security Operations Practice Test 16 — 15 Questions

Question 1

After seizing a suspected insider's laptop, a responder makes a bit-for-bit image of the drive. The legal team asks what step most directly proves the image was not altered after acquisition. What should be done?

Accepted Answer

Compute and document cryptographic hashes of the source media and the forensic image.. Option B is correct because computing and documenting cryptographic hashes (e.g., SHA-256 or MD5) of both the source media and the forensic image immediately after acquisition creates a verifiable digital fingerprint. If the hash values match, it proves that the image is an exact, unaltered copy of the original drive. This step is foundational to maintaining the chain of custody and ensuring data integrity in forensic investigations.

Answer

Record the laptop's hostname and the user who last logged in.

Answer

Copy the most recent files to a USB drive for quick review.

Answer

Return the laptop to the user once the image is saved.

Question 2

A SOC analyst reviews one user account and sees several failed logins from a single IP, then a successful login from the same IP, followed by a new inbox forwarding rule to an external address. Which two findings most strongly suggest account compromise? Select two.

Accepted Answer

Repeated failed logins followed by a successful login from the same source IP.. Option A is correct because a brute-force attack pattern—multiple failed logins followed by a successful authentication from the same external IP—strongly indicates credential compromise. This sequence suggests the attacker guessed or obtained the password and then successfully logged in. The single source IP ties the failed attempts to the eventual successful session, making it a classic indicator of account takeover.

Answer

The user authenticated during normal business hours.

Answer

The user accessed email from a corporate laptop.

Answer

The password age is 89 days.

Question 3

Based on the exhibit, what should the team do next to confirm the backups can actually be used during an outage?

Accepted Answer

Perform a test restore to a nonproduction location and verify the recovered files.. Option B is correct because the only way to confirm that backups are usable during an outage is to perform a test restore to a nonproduction location and verify the recovered files. This validates the integrity of the backup data, the restore process, and that the files are complete and functional, which is a core principle of backup validation (often called a 'restore test' or 'disaster recovery drill'). Simply reviewing backup status reports or increasing retention does not prove that the data can be successfully restored.

Answer

Increase the retention period before making any restore attempts.

Answer

Delete older backup sets so the backup window is shorter.

Answer

Convert the backups to full backups only so the status report is simpler.

Question 4

A company is placing a customer-facing web application behind a new security control. The team wants to block malicious HTTP requests such as injection attempts before they reach the application server, with minimal code changes to the app itself. Which control is the best fit?

Accepted Answer

Web application firewall (WAF) in front of the application.. A web application firewall (WAF) is specifically designed to inspect and filter HTTP/HTTPS traffic at the application layer (Layer 7), blocking malicious payloads such as SQL injection and cross-site scripting (XSS) before they reach the web server. It operates without requiring changes to the application code, making it the ideal choice for this scenario.

Answer

Network access control (NAC) at the switch port.

Answer

Data loss prevention (DLP) on the email gateway.

Answer

Endpoint detection and response (EDR) on the web server only.

Question 5

A SOC analyst receives an EDR alert showing a finance laptop creating encrypted archives and then attempting SMB connections to several internal file shares. The user is still logged in, and the business wants to stop possible spread without destroying volatile evidence. What should the analyst do first?

Accepted Answer

Isolate the endpoint from the network using the EDR containment feature.. Option B is correct because the EDR containment feature isolates the endpoint from the network while preserving all running processes, memory, and disk state. This stops the encrypted archives from being exfiltrated via SMB and prevents lateral movement, but keeps volatile evidence (e.g., active malware processes, network connections) intact for forensic analysis.

Answer

Power off the laptop immediately to stop all activity.

Answer

Reimage the laptop from a gold image as soon as possible.

Answer

Disable the user account in Active Directory and wait for the malware to stop.

Question 6

An email attachment from an external supplier is not blocked by signature-based AV, but the SOC wants to see whether it drops files, launches child processes, or contacts suspicious domains before delivery to users. Which control best fits?

Accepted Answer

Sandboxing, because it detonates the file in an isolated environment.. Sandboxing is the correct control because it detonates the file in an isolated, virtualized environment to observe its runtime behavior, such as dropping files, spawning child processes, or making outbound connections to suspicious domains. This goes beyond signature-based AV by analyzing dynamic behavior rather than static file hashes or patterns. The SOC's goal is to assess the file's actions before delivery, which sandboxing directly addresses.

Answer

Network IDS, because it passively monitors traffic for known threats.

Answer

DLP, because it prevents sensitive data from leaving the organization.

Answer

NAC, because it controls whether a device can join the network.

Question 7

Based on the exhibit, what should the analyst do before opening the forensic image for examination?

Accepted Answer

Calculate and compare the image hash to the source hash before analysis.. Before examining a forensic image, the analyst must verify its integrity by calculating its hash (e.g., MD5, SHA-1, SHA-256) and comparing it to the known hash of the original source. This ensures the image is an exact, unaltered copy, which is critical for maintaining the chain of custody and admissibility of evidence. Option B is correct because hash verification is the foundational step in forensic analysis.

Answer

Mount the image read-write so the analyst can begin searching immediately.

Answer

Defragment the original SSD so the files will be easier to search later.

Answer

Compress the image into a ZIP file to reduce storage usage before verifying it.

Question 8

After hours, EDR alerts show a finance laptop encrypting local files and trying SMB connections to nearby workstations. The user is still logged in, and management wants the fastest step that limits spread while preserving evidence. What should the SOC do first?

Accepted Answer

Use EDR to isolate the laptop from the network.. Option B is correct because EDR isolation immediately blocks all network communication (including SMB) while preserving the endpoint's state for forensic analysis. This stops lateral movement and further encryption without losing volatile data like memory or running processes, which a shutdown would destroy.

Answer

Shut down the laptop immediately to stop any further activity.

Answer

Run a full antivirus scan before making any network changes.

Answer

Reimage the laptop right away from a standard corporate image.

Question 9

Following a ransomware incident, management wants to verify that backups are usable and that a restored file server will meet recovery expectations before declaring the system trusted again. Which action is best?

Accepted Answer

Perform a documented restore test in an isolated environment and validate the recovered data.. Option B is correct because performing a documented restore test in an isolated environment is the only action that directly validates the integrity and usability of backups, ensuring the restored file server meets recovery point objective (RPO) and recovery time objective (RTO) expectations. This process verifies that the backup data is not corrupted, encrypted, or incomplete, which is critical after a ransomware incident where backups may have been targeted. Without such a test, management cannot confidently declare the system trusted, as logs or retention changes do not prove data recoverability.

Answer

Review the backup job logs and mark the backups as valid.

Answer

Increase the retention period so more restore points are available later.

Answer

Create a new full backup immediately after the incident and trust that one instead.

Question 10

A workstation is suspected of running malware and contacting an unknown host. Which two actions belong in the containment phase? Select two.

Accepted Answer

Isolate the workstation from the network.. Isolating the workstation from the network (A) immediately stops the malware's ability to communicate with the command-and-control (C2) server, preventing data exfiltration and further propagation. Blocking the malicious IP or domain at the firewall or proxy (B) is a containment action that prevents any system on the network from reaching the known malicious host, even if other hosts are already compromised. Both actions align with the NIST SP 800-61 containment strategy of stopping the spread and impact of an incident.

Answer

Reimage the workstation immediately before collecting evidence.

Answer

Tell the user to keep working until tomorrow.

Answer

Delete recent logs to reduce noise.

Question 11

After a ransomware event, management wants proof that backups can actually be used before trusting them. Which two activities best validate recoverability? Select two.

Accepted Answer

Restore a sample file or folder into an isolated test environment.. Restoring a sample file or folder into an isolated test environment (Option A) directly validates that the backup data is readable, the restore process works, and the data can be accessed in a clean environment. This is the most practical way to prove recoverability without risking production systems, as it tests the actual restore workflow end-to-end.

Answer

Trust a backup because the job status shows completed successfully.

Answer

Increase backup retention without testing restore ability.

Answer

Keep backups on production servers for quicker access during incidents.

Question 12

A server room sits below a chilled-water line, and occasional condensation is forming on the pipe during humid afternoons. Facilities wants the earliest warning before water reaches equipment and a way to get an alert even if no one is onsite. Which two controls should be implemented? Select two.

Accepted Answer

Install a networked water-leak detection cable beneath the raised floor near the chilled-water line.. A networked water-leak detection cable is the correct choice because it provides continuous, real-time monitoring for moisture along the length of the cable. When condensation drips onto the cable, it completes a circuit between two conductors, triggering an immediate alert. This gives the earliest possible warning before water reaches server equipment, even in an unattended facility.

Answer

Replace standard doors with mantraps to prevent tailgating at the room entrance.

Answer

Increase firewall logging on the server VLAN to spot moisture-related outages.

Answer

Use temperature-only sensors because condensation always raises heat first.

Question 13

A post-incident review shows the SOC detected malicious PowerShell activity six hours late because the existing detections did not correlate the encoded command, the unusual outbound connection, and the creation of a scheduled task. Leadership wants the two follow-up actions most likely to improve future response. Select two.

Accepted Answer

Add the new indicators and event patterns to SIEM and EDR detections.. Option A is correct because adding the new indicators (encoded command, unusual outbound connection, scheduled task creation) and event patterns to SIEM and EDR detections directly addresses the root cause of the six-hour delay: the lack of correlation between these specific events. By updating detection rules to correlate these patterns, the SOC can trigger alerts in near-real time rather than relying on manual post-hoc analysis. This is a core SIEM/EDR tuning practice to reduce mean time to detect (MTTD).

Answer

Restore the compromised host to production immediately after the next reboot.

Answer

Reduce log retention to keep storage costs low.

Answer

Disable PowerShell everywhere without reviewing business requirements or alternatives.

Question 14

A SOC analyst confirms that a workstation is encrypting local files and attempting SMB connections to nearby hosts. The user is still logged in, and the business wants to limit spread without destroying evidence. What is the best immediate action?

Accepted Answer

Quarantine the workstation from the network using EDR or switch port containment. Option B is correct because quarantining the workstation via EDR or switch port containment immediately stops the SMB-based lateral movement and further encryption of network shares, while preserving the volatile evidence (memory, running processes, encryption keys) for forensic analysis. This aligns with the business requirement to limit spread without destroying evidence, as powering off or reimaging would lose critical forensic data.

Answer

Power the workstation off immediately and leave it in place

Answer

Run a full antivirus scan while the workstation remains connected

Answer

Wipe and reimage the workstation from a standard build image

Question 15

A Linux operations team must run a nightly maintenance workflow on 60 servers to rotate logs and restart one service. Security does not allow interactive root logins, and every execution must be auditable. Which two practices best support secure administration? Select two.

Accepted Answer

Use a dedicated service account with sudo rights limited to the exact commands in the workflow.. Option A is correct because using a dedicated service account with sudo rights limited to the exact commands in the workflow enforces the principle of least privilege. This ensures that even if the account is compromised, an attacker can only execute the specific log rotation and service restart commands, not arbitrary root-level operations. It also eliminates the need for interactive root logins, satisfying the security policy while maintaining auditability through sudo logs.

Answer

Hardcode the root password in the script so the same job works everywhere.

Answer

Share one privileged SSH key among all administrators for convenience.

Answer

Disable command logging so the maintenance output is easier to review.