SY0-701 Security Operations Practice Test 18 — 15 Questions

Question 1

Match each SOC alert artifact to the most useful investigation pivot. Each pivot should help determine whether the alert is a true incident, a false positive, or part of a broader campaign.

Accepted Answer

IP address: Perform reputation check against known threat feeds.. Each artifact is matched to a pivot that directly aids in verifying the alert's validity, whether by checking reputation, correlating with threat intelligence, or comparing against normal behavior.

Answer

IP address: Conduct WHOIS lookup to verify registration details.

Answer

File hash: Perform memory analysis on the endpoint.

Question 2

Employees in a server room often prop the door open while carrying equipment. What control best helps detect and prevent this behavior?

Accepted Answer

Install a door-ajar alarm and use a self-closing door mechanism.. A door-ajar alarm provides immediate notification when the door is left open, while a self-closing door mechanism physically ensures the door closes automatically after each use. Together, they directly address the behavior of propping the door open by both detecting the violation and preventing it from remaining open, which is critical for maintaining physical security controls in a server room.

Answer

Add more desk chairs outside the server room for convenience.

Answer

Increase the screen brightness on the monitoring workstation.

Answer

Move backup tapes to a nearby shelf for easier access.

Question 3

A SOC analyst notices that log timestamps from different servers do not line up during an investigation. What should be implemented to improve event correlation?

Accepted Answer

Network Time Protocol time synchronization across systems.. Network Time Protocol (NTP) synchronizes clocks across systems to a common time source, ensuring log timestamps align for accurate event correlation. Without NTP, timestamps from different servers can drift, making it impossible to reconstruct the sequence of events during an investigation. This is a foundational requirement for effective security monitoring and incident response.

Answer

A more aggressive password policy for all users.

Answer

Longer user account names to make records easier to read.

Answer

Disabling centralized logging to reduce duplication.

Question 4

A branch office loses power briefly several times each month. Which control best helps keep network equipment running long enough for an orderly shutdown?

Accepted Answer

A UPS. A UPS (Uninterruptible Power Supply) provides battery backup power to network equipment during a power outage, allowing enough time for an orderly shutdown to prevent data corruption or hardware damage. Unlike surge protectors, a UPS actively supplies clean, regulated power from its batteries when the mains fail, making it the correct control for this scenario.

Answer

A badge reader

Answer

A locked filing cabinet

Answer

A fire extinguisher

Question 5

A SOC analyst sees 38 failed logins for a finance user account from one public IP address over 4 minutes, followed by one successful login. What should the analyst do first?

Accepted Answer

Correlate the authentication logs with user activity and VPN records to verify whether the login pattern is expected.. The analyst must first verify whether the failed logins followed by a successful login represent a brute-force attack or legitimate behavior, such as a user mistyping their password and then succeeding. Correlating authentication logs with user activity and VPN records helps confirm if the public IP belongs to a known remote user or VPN endpoint, which is a standard first step in incident response to avoid false positives.

Answer

Immediately delete the account to stop any further access attempts.

Answer

Assume the account is compromised and notify all users to change their passwords.

Answer

Close the alert because one successful login means the activity was normal.

Question 6

A SOC analyst wants to make sure logs from multiple servers can be compared accurately during an incident review. What should be configured on those systems?

Accepted Answer

Time synchronization using the same trusted time source. Time synchronization using a trusted time source (e.g., NTP) ensures that all servers share the same clock. During incident review, accurate log correlation depends on timestamps being consistent across systems; even a few seconds of drift can misalign event sequences. Without synchronized time, comparing logs from multiple servers becomes unreliable, potentially obscuring the true timeline of an attack.

Answer

A local administrator account with the same password on every server

Answer

A larger disk size on the log server

Answer

A separate VLAN for each application server

Question 7

A critical patch must be applied to a production server next week. What is the best way to reduce the risk of downtime if the patch causes a problem?

Accepted Answer

Create a rollback plan before installing the patch. Creating a rollback plan before installing a patch ensures that if the patch causes unexpected issues, the system can be restored to its previous stable state quickly, minimizing downtime. A rollback plan typically includes steps to revert the patch, restore from a backup, or switch to a failover system, which is a fundamental change management practice in security operations.

Answer

Apply the patch during business hours so users can report issues quickly

Answer

Skip testing because critical patches are always safe

Answer

Disable logging during the patch to improve performance

Question 8

A help desk team needs to update desktops in a call center without interrupting callers during peak hours. What is the best operational approach?

Accepted Answer

Schedule the updates during an approved maintenance window. Scheduling updates during an approved maintenance window ensures that desktops are updated during a period of low activity, minimizing disruption to call center operations. This approach aligns with change management best practices, allowing for controlled deployment and rollback if issues arise, and avoids the performance degradation or reboots that could interrupt active calls.

Answer

Deploy the updates immediately to all desktops at once

Answer

Ask each user to install updates whenever they have time

Answer

Disable update notifications permanently

Question 9

A laptop is suspected of being compromised, and the responder wants to preserve useful evidence before shutting it down. What should be done first?

Accepted Answer

Capture volatile data such as memory and running processes if possible.. Volatile data (e.g., RAM contents, running processes, network connections) is lost when the laptop is powered off. Capturing this data first preserves critical evidence of the attacker's current activity, such as malware in memory or active network connections, which is essential for forensic analysis. This aligns with the forensic principle of order of volatility, where the most volatile data is collected first.

Answer

Power off the laptop immediately to stop all attacker activity.

Answer

Install a new antivirus product before collecting evidence.

Answer

Reimage the laptop so the user can return to work quickly.

Question 10

Before applying a critical patch to a production application server, which action best reduces the risk of extended downtime if the patch fails?

Accepted Answer

Create a verified backup or rollback plan before making the change.. Creating a verified backup or rollback plan before applying a critical patch ensures that if the patch causes unexpected failures or incompatibilities, the system can be restored to its previous stable state quickly. This directly reduces the risk of extended downtime by providing a reliable recovery path, which is a fundamental principle of change management and risk mitigation in production environments.

Answer

Apply the patch immediately without testing so the system is protected sooner.

Answer

Disable logging so the patch process uses fewer resources.

Answer

Postpone the patch indefinitely until all business users request it.

Question 11

A user reports a ransomware note on one department file share, but other departments are still working normally. What is the best first containment action?

Accepted Answer

Disconnect the affected file share or server from the network.. The immediate priority in a ransomware incident is to contain the threat by isolating the affected system to prevent lateral movement. Disconnecting the file share or server from the network stops the ransomware from encrypting additional files or spreading to other departments via SMB or other protocols. This aligns with the NIST SP 800-61 containment strategy, which emphasizes rapid isolation without disrupting unaffected systems.

Answer

Shut down the entire company network immediately.

Answer

Delete the ransom note and wait to see whether the problem returns.

Answer

Restore the share immediately before checking what caused the incident.

Question 12

Match each security monitoring artifact from the SOC alert queue to the best investigation focus.

Accepted Answer

Phishing: Investigate email headers and links. Each alert type suggests a specific investigation focus: phishing requires email analysis; malware needs file/behavior analysis; brute force focuses on auth logs; data exfiltration looks at outbound traffic; privileged misuse examines user activity; ransomware involves encryption events.

Answer

Brute force: Audit user activity logs for unusual administrative actions

Answer

Data exfiltration: Check for file encryption events and ransom notes

Answer

Privileged misuse: Monitor outbound traffic volume to unusual destinations

Answer

Ransomware: Review authentication logs for repeated failures

Question 13

A critical patch must be applied to a retail point-of-sale server. What is the best way to reduce business disruption?

Accepted Answer

Schedule the patch during an approved maintenance window.. Scheduling the patch during an approved maintenance window is the best practice to minimize business disruption because it allows the organization to plan for downtime during low-activity periods, coordinate with stakeholders, and ensure rollback procedures are in place. For a retail point-of-sale (POS) server, applying a critical patch outside of business hours prevents transaction interruptions and potential revenue loss, aligning with change management policies that prioritize availability and security.

Answer

Apply the patch during the busiest business hours to make the change sooner.

Answer

Skip the patch and rely on hope that the issue will not be exploited.

Answer

Turn off all backups so the patch process runs faster.

Question 14

Match each change-management practice to the best description for reducing patching risk in production.

Accepted Answer

Change Advisory Board: A group that reviews and approves changes to reduce unauthorized modifications.. These change-management practices reduce patching risk by ensuring proper review, scheduling, rollback capability, pre-testing, documentation, and automation to minimize errors.

Answer

Change Advisory Board: Testing patches in a staging environment before deployment.

Answer

Rollback plan: Performing patching during a time window that minimizes impact on operations.

Question 15

A server room is sometimes left open while technicians carry equipment in and out. Which control best helps detect and discourage unauthorized entry?

Accepted Answer

A CCTV camera covering the entrance. A CCTV camera covering the entrance provides continuous monitoring and recording of activity, which both detects unauthorized entry in real time and creates a deterrent effect through the awareness of surveillance. Unlike passive measures, it offers forensic evidence and can be integrated with access control systems to alert security personnel of breaches.

Answer

A written reminder poster on the wall

Answer

A brighter color for the server room door

Answer

A larger monitor in the nearby office