SY0-701 Security Operations Practice Test 17 — 15 Questions

Question 1

After hours, EDR alerts show a finance laptop encrypting local files and trying SMB connections to nearby workstations. The user is still logged in, and management wants the fastest step that limits spread while preserving evidence. What should the SOC do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use EDR to isolate the laptop from the network.. EDR isolation immediately blocks all network communication (including SMB) while preserving the endpoint's state for forensic analysis. This stops lateral movement and further encryption without losing volatile data like memory or running processes, which a shutdown would destroy.

Answer

Shut down the laptop immediately to stop any further activity.

Answer

Run a full antivirus scan before making any network changes.

Answer

Reimage the laptop right away from a standard corporate image.

Question 2

Following a ransomware incident, management wants to verify that backups are usable and that a restored file server will meet recovery expectations before declaring the system trusted again. Which action is best?

Accepted Answer

Perform a documented restore test in an isolated environment and validate the recovered data.. Performing a documented restore test in an isolated environment is the only action that directly validates the integrity and usability of backups, ensuring the restored file server meets recovery point objective (RPO) and recovery time objective (RTO) expectations. This process verifies that the backup data is not corrupted, encrypted, or incomplete, which is critical after a ransomware incident where backups may have been targeted. Without such a test, management cannot confidently declare the system trusted, as logs or retention changes do not prove data recoverability.

Answer

Review the backup job logs and mark the backups as valid.

Answer

Increase the retention period so more restore points are available later.

Answer

Create a new full backup immediately after the incident and trust that one instead.

Question 3

A workstation is suspected of running malware and contacting an unknown host. Which two actions belong in the containment phase? Select two.

Accepted Answer

Isolate the workstation from the network.. Isolating the workstation from the network (A) immediately stops the malware's ability to communicate with the command-and-control (C2) server, preventing data exfiltration and further propagation. Blocking the malicious IP or domain at the firewall or proxy (B) is a containment action that prevents any system on the network from reaching the known malicious host, even if other hosts are already compromised. Both actions align with the NIST SP 800-61 containment strategy of stopping the spread and impact of an incident.

Answer

Reimage the workstation immediately before collecting evidence.

Answer

Tell the user to keep working until tomorrow.

Answer

Delete recent logs to reduce noise.

Question 4

A SOC analyst confirms that a workstation is encrypting local files and attempting SMB connections to nearby hosts. The user is still logged in, and the business wants to limit spread without destroying evidence. What is the best immediate action?

Accepted Answer

Quarantine the workstation from the network using EDR or switch port containment. Quarantining the workstation via EDR or switch port containment immediately stops the SMB-based lateral movement and further encryption of network shares, while preserving the volatile evidence (memory, running processes, encryption keys) for forensic analysis. This aligns with the business requirement to limit spread without destroying evidence, as powering off or reimaging would lose critical forensic data.

Answer

Power the workstation off immediately and leave it in place

Answer

Run a full antivirus scan while the workstation remains connected

Answer

Wipe and reimage the workstation from a standard build image

Question 5

After a ransomware event, the team restores a file server from backup, but management wants proof that the restore process will work before the backups are declared trusted. What should be done next?

Accepted Answer

Perform a test restore in an isolated environment and verify the recovered data. The only way to prove that backups are trustworthy is to perform a test restore in an isolated environment, verifying the integrity and completeness of the recovered data. This validates that the backup process, media, and software are functioning correctly without risking the production environment. Without a successful test restore, the team cannot confirm that the backups are free from corruption, encryption, or other issues that would prevent a real recovery.

Answer

Delete the old backup copies to prevent future confusion

Answer

Switch to incremental backups only so the next restore is faster

Answer

Store the backups on the same file server so they are easier to access

Question 6

A SIEM report shows this sequence over 25 minutes: the same public IP submitted one failed password attempt against 53 different accounts, then one account successfully authenticated, created an inbox forwarding rule, and downloaded hundreds of messages through the web portal. Which two conclusions are best supported? Select two.

Accepted Answer

The pattern is consistent with a password spraying attack.. The SIEM shows a single public IP attempting one failed password against 53 different accounts over 25 minutes. This pattern—low-and-slow, one attempt per account—is the hallmark of a password spraying attack, which avoids account lockout thresholds by never hitting the same account repeatedly. The subsequent successful authentication and mailbox abuse confirm the attacker found a weak password for one account.

Answer

The attacker is performing a brute-force attack against one account.

Answer

The activity is most likely credential stuffing with multiple known password pairs.

Answer

The events primarily indicate a denial-of-service attack against the mail system.

Question 7

Based on the exhibit, what should the analyst do next to limit the impact of the suspected compromise?

Accepted Answer

Isolate FIN-LT-22 from the network to contain the suspected malware activity.. Isolating FIN-LT-22 from the network immediately stops the suspected malware from communicating with command-and-control servers or spreading laterally to other hosts. This containment step aligns with the NIST incident response framework's containment phase, which prioritizes limiting damage before eradication or recovery. In a suspected compromise, network isolation (e.g., disabling the switch port or using a host-based firewall rule) is the fastest way to cut off malicious traffic without destroying volatile evidence in memory.

Answer

Run a full antivirus scan first and wait for the results before taking any other action.

Answer

Reboot the laptop to clear the malicious process from memory.

Answer

Reset the user's password and close the ticket after confirming they can log in again.

Question 8

A web team is moving a customer portal behind a new inspection device. They need something that can examine HTTP requests, block malicious patterns like injection attempts, and still allow normal browsing. Which control is most appropriate?

Accepted Answer

WAF, because it understands web requests and can block malicious application-layer traffic.. A WAF (Web Application Firewall) is the correct choice because it operates at Layer 7 (application layer) and is specifically designed to inspect HTTP/HTTPS traffic. It can parse web requests, identify malicious patterns such as SQL injection or XSS payloads, and block them while allowing legitimate traffic to pass through to the customer portal.

Answer

IDS, because it alerts on suspicious traffic without affecting application delivery.

Answer

DLP, because it can stop sensitive data from being posted to the portal.

Answer

NAC, because it verifies whether devices are allowed onto the network.

Question 9

An email gateway receives a macro-enabled spreadsheet from an external supplier. Signature-based scanning does not flag it, but the security team wants to observe whether it drops files, creates persistence, or contacts suspicious domains before delivery to the user. Which tool best meets this need?

Accepted Answer

Sandboxing, because it detonates the file and observes malicious behavior safely.. Sandboxing is the correct choice because it detonates the file in an isolated, controlled environment to observe its runtime behavior, such as dropping files, creating persistence mechanisms, or making outbound connections to suspicious domains. Unlike signature-based scanning, sandboxing can detect unknown or zero-day malware by analyzing behavioral indicators without risking the production network.

Answer

DLP, because it prevents any document from leaving the organization.

Answer

NAC, because it can block the supplier's laptop from the network.

Answer

A SIEM, because it can block the attachment and quarantine the message.

Question 10

Following a ransomware incident, management wants proof that the organization can actually recover from its backups before declaring the backups trustworthy. What should the security team do next?

Accepted Answer

Restore a backup into an isolated test environment and validate the result.. The only way to prove that backups are trustworthy after a ransomware incident is to perform a full restoration into an isolated test environment and validate the integrity, completeness, and functionality of the recovered data. Simply checking that backup jobs completed successfully (Option A) does not verify that the backup data is uncorrupted, free from ransomware, or restorable in a real scenario. A controlled restore test provides tangible evidence that the recovery process works and the data is usable, which is the core requirement of management’s request for proof of recoverability.

Answer

Check that the backup job completed successfully during the last seven days.

Answer

Increase the backup retention period to reduce the chance of future loss.

Answer

Compress the backup files further so they take up less storage.

Question 11

The web team is placing a public customer portal behind a control that can inspect HTTP requests, block malicious payloads such as SQL injection and cross-site scripting, and still allow legitimate application traffic without rewriting the app. Which control should they deploy?

Accepted Answer

A WAF in front of the application.. A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at the application layer (Layer 7), filtering out malicious payloads like SQL injection and cross-site scripting (XSS) while allowing legitimate requests to pass through. Unlike an IDS, a WAF operates inline and can actively block threats without requiring modifications to the application code, making it the ideal choice for protecting a public-facing web portal.

Answer

An IDS placed on the same network segment as the web server.

Answer

A DLP appliance between users and the portal.

Answer

A NAC solution on the switch ports feeding the portal.

Question 12

A Linux web server was compromised through an outdated package. The team isolated the host, captured evidence, removed a malicious cron job, patched the vulnerable package, and confirmed no persistence remains. Which incident response phase are they primarily in now?

Accepted Answer

Eradication, because malicious artifacts and the underlying weakness are being removed.. The team has already identified the compromise, isolated the host, and removed the malicious cron job. Patching the vulnerable package addresses the root cause, which is the core of the Eradication phase. Confirming no persistence remains verifies that the eradication was successful, making this the current phase.

Answer

Identification, because the team is still confirming that the event happened.

Answer

Containment, because the host was isolated from the network.

Answer

Lessons learned, because the server has already been secured.

Question 13

A SIEM reviews VPN authentication logs and sees 36 different usernames each receive one failed login attempt from the same source IP over 20 minutes, followed by one successful login to an unrelated account. Which attack is most likely?

Accepted Answer

Password spraying against many accounts with a low number of attempts per account.. The SIEM observed 36 different usernames each receiving one failed login attempt from the same source IP over 20 minutes, followed by one successful login to an unrelated account. This pattern is characteristic of a password spraying attack, where an attacker tries a small number of common passwords against many accounts to avoid account lockout thresholds, and then uses a successful credential to pivot to another account. The low number of attempts per account (one each) and the wide spread of usernames distinguish it from brute-force or targeted attacks.

Answer

A brute-force attack focused on a single locked account.

Answer

A replay attack using captured authentication data.

Answer

A port scan that accidentally triggered authentication failures.

Question 14

An office loses power several times each month, causing servers to shut down without warning. Which control best helps keep the systems running long enough for a safe shutdown?

Accepted Answer

A UPS sized to support the equipment for a short period.. A UPS (Uninterruptible Power Supply) provides battery backup power to connected equipment, allowing servers to continue running for a short duration after a power loss. This gives administrators enough time to perform a safe, orderly shutdown, preventing data corruption and hardware damage from abrupt power loss.

Answer

A better wallpaper design in the server room.

Answer

A stronger password for the power strip.

Answer

More user awareness training about turning monitors off.

Question 15

A user reports a suspicious pop-up on a workstation and the SOC suspects malware. Which action should the responder take first to contain the threat?

Accepted Answer

Disconnect the workstation from the network. Disconnecting the workstation from the network immediately isolates the suspected malware, preventing it from communicating with command-and-control (C2) servers, spreading laterally to other hosts, or exfiltrating data. This is the first step in the NIST incident response containment phase, as it stops network-based propagation without destroying forensic evidence.

Answer

Wipe the workstation immediately

Answer

Return the workstation to the user after restarting it

Answer

Wait until the next patch cycle to see if the issue disappears