SY0-701 Security Operations Practice Test 18 — 15 Questions

Question 1

A SOC analyst notices that log timestamps from different servers do not line up during an investigation. What should be implemented to improve event correlation?

Accepted Answer

Network Time Protocol time synchronization across systems.. Network Time Protocol (NTP) synchronizes clocks across systems to a common time source, ensuring log timestamps align for accurate event correlation. Without NTP, timestamps from different servers can drift, making it impossible to reconstruct the sequence of events during an investigation. This is a foundational requirement for effective security monitoring and incident response.

Answer

A more aggressive password policy for all users.

Answer

Longer user account names to make records easier to read.

Answer

Disabling centralized logging to reduce duplication.

Question 2

A branch office loses power briefly several times each month. Which control best helps keep network equipment running long enough for an orderly shutdown?

Accepted Answer

A UPS. A UPS (Uninterruptible Power Supply) provides battery backup power to network equipment during a power outage, allowing enough time for an orderly shutdown to prevent data corruption or hardware damage. Unlike surge protectors, a UPS actively supplies clean, regulated power from its batteries when the mains fail, making it the correct control for this scenario.

Answer

A badge reader

Answer

A locked filing cabinet

Answer

A fire extinguisher

Question 3

A SOC analyst sees 38 failed logins for a finance user account from one public IP address over 4 minutes, followed by one successful login. What should the analyst do first?

Accepted Answer

Correlate the authentication logs with user activity and VPN records to verify whether the login pattern is expected.. The analyst must first verify whether the failed logins followed by a successful login represent a brute-force attack or legitimate behavior, such as a user mistyping their password and then succeeding. Correlating authentication logs with user activity and VPN records helps confirm if the public IP belongs to a known remote user or VPN endpoint, which is a standard first step in incident response to avoid false positives.

Answer

Immediately delete the account to stop any further access attempts.

Answer

Assume the account is compromised and notify all users to change their passwords.

Answer

Close the alert because one successful login means the activity was normal.

Question 4

A SOC analyst wants to make sure logs from multiple servers can be compared accurately during an incident review. What should be configured on those systems?

Accepted Answer

Time synchronization using the same trusted time source. Time synchronization using a trusted time source (e.g., NTP) ensures that all servers share the same clock. During incident review, accurate log correlation depends on timestamps being consistent across systems; even a few seconds of drift can misalign event sequences. Without synchronized time, comparing logs from multiple servers becomes unreliable, potentially obscuring the true timeline of an attack.

Answer

A local administrator account with the same password on every server

Answer

A larger disk size on the log server

Answer

A separate VLAN for each application server

Question 5

A critical patch must be applied to a production server next week. What is the best way to reduce the risk of downtime if the patch causes a problem?

Accepted Answer

Create a rollback plan before installing the patch. Creating a rollback plan before installing a patch ensures that if the patch causes unexpected issues, the system can be restored to its previous stable state quickly, minimizing downtime. A rollback plan typically includes steps to revert the patch, restore from a backup, or switch to a failover system, which is a fundamental change management practice in security operations.

Answer

Apply the patch during business hours so users can report issues quickly

Answer

Skip testing because critical patches are always safe

Answer

Disable logging during the patch to improve performance

Question 6

A help desk team needs to update desktops in a call center without interrupting callers during peak hours. What is the best operational approach?

Accepted Answer

Schedule the updates during an approved maintenance window. Scheduling updates during an approved maintenance window ensures that desktops are updated during a period of low activity, minimizing disruption to call center operations. This approach aligns with change management best practices, allowing for controlled deployment and rollback if issues arise, and avoids the performance degradation or reboots that could interrupt active calls.

Answer

Deploy the updates immediately to all desktops at once

Answer

Ask each user to install updates whenever they have time

Answer

Disable update notifications permanently

Question 7

A laptop is suspected of being compromised, and the responder wants to preserve useful evidence before shutting it down. What should be done first?

Accepted Answer

Capture volatile data such as memory and running processes if possible.. Volatile data (e.g., RAM contents, running processes, network connections) is lost when the laptop is powered off. Capturing this data first preserves critical evidence of the attacker's current activity, such as malware in memory or active network connections, which is essential for forensic analysis. This aligns with the forensic principle of order of volatility, where the most volatile data is collected first.

Answer

Power off the laptop immediately to stop all attacker activity.

Answer

Install a new antivirus product before collecting evidence.

Answer

Reimage the laptop so the user can return to work quickly.

Question 8

Before applying a critical patch to a production application server, which action best reduces the risk of extended downtime if the patch fails?

Accepted Answer

Create a verified backup or rollback plan before making the change.. Creating a verified backup or rollback plan before applying a critical patch ensures that if the patch causes unexpected failures or incompatibilities, the system can be restored to its previous stable state quickly. This directly reduces the risk of extended downtime by providing a reliable recovery path, which is a fundamental principle of change management and risk mitigation in production environments.

Answer

Apply the patch immediately without testing so the system is protected sooner.

Answer

Disable logging so the patch process uses fewer resources.

Answer

Postpone the patch indefinitely until all business users request it.

Question 9

A user reports a ransomware note on one department file share, but other departments are still working normally. What is the best first containment action?

Accepted Answer

Disconnect the affected file share or server from the network.. The immediate priority in a ransomware incident is to contain the threat by isolating the affected system to prevent lateral movement. Disconnecting the file share or server from the network stops the ransomware from encrypting additional files or spreading to other departments via SMB or other protocols. This aligns with the NIST SP 800-61 containment strategy, which emphasizes rapid isolation without disrupting unaffected systems.

Answer

Shut down the entire company network immediately.

Answer

Delete the ransom note and wait to see whether the problem returns.

Answer

Restore the share immediately before checking what caused the incident.

Question 10

Match each security monitoring artifact from the SOC alert queue to the best investigation focus.

Accepted Answer

Phishing: Investigate email headers and links. Each alert type suggests a specific investigation focus: phishing requires email analysis; malware needs file/behavior analysis; brute force focuses on auth logs; data exfiltration looks at outbound traffic; privileged misuse examines user activity; ransomware involves encryption events.

Answer

Brute force: Audit user activity logs for unusual administrative actions

Answer

Data exfiltration: Check for file encryption events and ransom notes

Answer

Privileged misuse: Monitor outbound traffic volume to unusual destinations

Answer

Ransomware: Review authentication logs for repeated failures

Question 11

A critical patch must be applied to a retail point-of-sale server. What is the best way to reduce business disruption?

Accepted Answer

Schedule the patch during an approved maintenance window.. Scheduling the patch during an approved maintenance window is the best practice to minimize business disruption because it allows the organization to plan for downtime during low-activity periods, coordinate with stakeholders, and ensure rollback procedures are in place. For a retail point-of-sale (POS) server, applying a critical patch outside of business hours prevents transaction interruptions and potential revenue loss, aligning with change management policies that prioritize availability and security.

Answer

Apply the patch during the busiest business hours to make the change sooner.

Answer

Skip the patch and rely on hope that the issue will not be exploited.

Answer

Turn off all backups so the patch process runs faster.

Question 12

Match each change-management practice to the best description for reducing patching risk in production.

Accepted Answer

Change Advisory Board: A group that reviews and approves changes to reduce unauthorized modifications.. These change-management practices reduce patching risk by ensuring proper review, scheduling, rollback capability, pre-testing, documentation, and automation to minimize errors.

Answer

Change Advisory Board: Testing patches in a staging environment before deployment.

Answer

Rollback plan: Performing patching during a time window that minimizes impact on operations.

Question 13

A server room is sometimes left open while technicians carry equipment in and out. Which control best helps detect and discourage unauthorized entry?

Accepted Answer

A CCTV camera covering the entrance. A CCTV camera covering the entrance provides continuous monitoring and recording of activity, which both detects unauthorized entry in real time and creates a deterrent effect through the awareness of surveillance. Unlike passive measures, it offers forensic evidence and can be integrated with access control systems to alert security personnel of breaches.

Answer

A written reminder poster on the wall

Answer

A brighter color for the server room door

Answer

A larger monitor in the nearby office

Question 14

Match each incident response action to its primary purpose during a suspected endpoint compromise.

Accepted Answer

Isolation: Preventing the spread of the incident to other systems.. Incident response actions are sequenced to contain, preserve, analyze, remove, and learn from the incident. Isolating prevents spread; volatile data capture is time-sensitive; imaging preserves evidence; log analysis reveals details; eradication cleans the system; lessons learned improve processes.

Answer

Isolation: Removing malicious files from the system.

Answer

Volatile Data Capture: Creating a forensic copy of the hard drive.

Question 15

A SIEM alert shows 120 failed logins for one user account from three different countries within 10 minutes, followed by a successful login. What should the analyst do first?

Accepted Answer

Verify the activity with related logs and check whether the account owner confirms the login.. The analyst must first validate the alert by correlating the SIEM data with additional logs (e.g., authentication logs, firewall logs) and contacting the account owner to confirm whether the successful login was legitimate. This follows the incident response process of verification before action, preventing unnecessary disruption if the activity is benign (e.g., the user traveling with VPN).

Answer

Close the alert because the login eventually succeeded.

Answer

Immediately delete the account to stop further access.

Answer

Reimage the user's laptop before collecting any information.