SY0-701 Security Operations Practice Test 19 — 15 Questions

Question 1

After a phishing incident, the security team wants to preserve evidence for later review. Which action is most appropriate?

Accepted Answer

Capture and save the email headers and message content. Preserving the email headers and message content is essential for forensic analysis. Email headers contain routing information, including the originating IP address, authentication results (SPF, DKIM, DMARC), and timestamps, which are critical for tracing the source of the phishing attack and understanding the attack vector. Deleting or forwarding the email would destroy this evidence, compromising the investigation.

Answer

Have the user delete the phishing email to avoid further exposure

Answer

Forward the email to every employee as a warning

Answer

Change the user's office seat assignment immediately

Question 2

A SIEM correlation rule alerts when a single user account fails to authenticate 20 times in 5 minutes and then succeeds from the same source IP. What is the most likely reason the team should investigate this event?

Accepted Answer

The pattern may indicate password guessing or credential stuffing. The pattern of 20 rapid failed authentication attempts followed by a successful authentication from the same source IP is a classic indicator of a password guessing or credential stuffing attack. The attacker likely used a list of common passwords or previously compromised credentials, and the final success suggests they found a valid password. SIEM correlation rules are designed to detect such brute-force or spraying behaviors, and this event warrants immediate investigation to determine if the account is compromised.

Answer

The account was probably being used normally because the password was changed

Answer

The SIEM is misconfigured because all failed logons are false positives

Answer

The account is definitely malicious and should be deleted immediately

Question 3

Match each detection pattern to the most likely security issue. Each item has one best match.

Accepted Answer

Repeated login failures: Brute-force attack. Repeated login failures indicate brute-force; Outbound connections to malicious IPs suggest C2; Large data transfers at odd hours indicate exfiltration; Random DNS subdomains are typical of tunneling; Conflicting ARP replies show spoofing; Multiple ICMP requests from many sources indicate DDoS.

Answer

Random DNS subdomains: DDoS

Answer

Conflicting ARP replies: Data exfiltration

Question 4

An EDR alert shows a user workstation launching an unfamiliar executable from the Downloads folder and then making repeated outbound connections to an IP address in another country. What is the best first response by the security team?

Accepted Answer

Isolate the workstation from the network and begin incident triage. Isolating the workstation from the network immediately stops the potential command-and-control (C2) communication and prevents lateral movement, which is the priority first response in incident triage. The EDR alert indicates a suspicious executable from the Downloads folder making repeated outbound connections to a foreign IP, which strongly suggests malware or a trojan. Isolating the host preserves volatile evidence (e.g., memory, network connections) for forensic analysis while containing the threat.

Answer

Wait for more alerts before taking any action to avoid disrupting the user

Answer

Immediately reinstall the operating system without collecting evidence

Answer

Disable the user's account in the directory service and close the ticket

Question 5

An EDR console alerts that powershell.exe launched with an encoded command on a finance workstation, and a minute later the host begins making repeated outbound connections to an unfamiliar IP address. What is the best initial response?

Accepted Answer

Isolate the workstation through the EDR platform and preserve logs and volatile evidence for investigation.. Isolating the workstation via the EDR platform stops the immediate threat (the malicious outbound connections) while preserving volatile evidence (e.g., running processes, network connections, memory contents) and logs for forensic analysis. This aligns with the incident response principle of containment before eradication, and EDR isolation typically uses a host-based firewall rule to block all traffic except to the EDR management server, ensuring the host remains accessible for investigation.

Answer

Run a full antivirus scan first and leave the workstation online so the user can keep working.

Answer

Power off the workstation immediately to ensure the malicious process stops.

Answer

Create a permanent firewall rule that allows the unfamiliar IP address so you can observe more traffic.

Question 6

A hardening script is pushed to a production web server and, within minutes, the application stops accepting secure connections. The team discovers the script disabled a required TLS setting that the legacy application still needs. What should have been in place to reduce the impact of this change?

Accepted Answer

A documented change window with testing in a staging environment and a rollback plan.. A documented change window with testing in a staging environment and a rollback plan ensures that changes are validated before production deployment. In this scenario, the hardening script disabled a required TLS setting (e.g., TLS 1.0 or a specific cipher suite) that the legacy application depended on. Testing in staging would have caught the incompatibility, and a rollback plan would allow reverting the change quickly, minimizing downtime.

Answer

A longer password policy for administrators so they can log in after the outage.

Answer

Disabling all logging during the change so the application can restart faster.

Answer

Replacing the web server hardware to ensure the TLS settings are applied correctly.

Question 7

An NDR tool shows a production web server sending small, periodic DNS queries to random-looking subdomains under a domain the company does not use. The pattern repeats every 60 seconds, even when normal web traffic is idle. What is the best interpretation and next step?

Accepted Answer

Suspect DNS-based command-and-control, then isolate the server and collect logs and packet data for analysis.. The small, periodic DNS queries to random-looking subdomains under an unused domain are a classic indicator of DNS-based command-and-control (C2) communication. Attackers often use DNS tunneling to exfiltrate data or send commands, as DNS traffic is typically allowed through firewalls. The fact that the pattern persists even during idle web traffic confirms it is not related to normal server operations, making isolation and forensic collection the appropriate next step.

Answer

This is normal DNS behavior, so no action is needed unless users report an outage.

Answer

Rotate the DNS server’s administrator password and leave the web server online.

Answer

Assume the web server is performing routine certificate renewal checks and ignore the alert.

Question 8

A file server begins encrypting documents, and the SOC confirms the activity is malicious. Which incident response step should happen first to limit further damage?

Accepted Answer

Containment. Containment is the correct first step because it isolates the compromised file server from the network, preventing the ransomware from encrypting additional shares or spreading laterally. The SMB protocol (port 445) used for file sharing would be blocked at the switch or firewall, halting further encryption of documents. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Answer

Lessons learned

Answer

Recovery

Answer

Post-incident reporting

Question 9

A SOC analyst receives an alert from the VPN appliance and identity platform. In the last 10 minutes, a user account had 14 failed VPN logons from one country, then one successful login from a different country. The user calls the help desk and says they have not used their account today. What should the analyst do first?

Accepted Answer

Disable the user account and revoke active sessions or tokens while escalating the event as a suspected account compromise.. The combination of multiple failed logins from one country followed by a successful login from a different country, combined with the user's denial of activity, is a classic indicator of account compromise (e.g., credential stuffing or token theft). Disabling the account and revoking active sessions/tokens immediately stops the attacker's access, preventing further lateral movement or data exfiltration, while escalation ensures proper incident response. This aligns with the CompTIA incident response process: identification, containment, eradication, and recovery.

Answer

Block the foreign IP address at the firewall and wait for more alerts before acting.

Answer

Reset the user password and close the alert because the new password will stop the attack.

Answer

Reimage the user’s laptop immediately to remove any possible malware before taking other steps.

Question 10

After a workstation hardening baseline is updated, the security team wants to confirm that finance laptops actually match the new settings. Which control is the best way to verify this?

Accepted Answer

Run a configuration compliance scan against the updated baseline. A configuration compliance scan compares the current settings of the finance laptops against the updated hardening baseline. This automated process checks specific registry keys, file permissions, service states, and security policy settings (e.g., via SCAP or CIS benchmarks) to verify alignment. It provides objective, measurable evidence of compliance, unlike subjective user feedback or assumptions.

Answer

Ask users whether they think their laptops are secure

Answer

Assume the baseline was applied because the change ticket was approved

Answer

Delete the old baseline so there is only one policy to reference

Question 11

A nightly backup job shows "Completed successfully" in the backup console, but a test restore fails with an authentication error after the backup service account password was rotated last week. What is the best next step?

Accepted Answer

Update the backup application with the current service account credentials and rerun a restore validation test.. The backup job succeeded because the service account had cached credentials or the backup process itself didn't require re-authentication at that point. However, the restore operation failed because the backup application's stored credentials for accessing the backup repository are now stale after the password rotation. Updating the backup application with the current service account credentials (Option B) directly resolves the authentication error and allows a proper restore validation test.

Answer

Increase the retention period so the backup console will keep more copies.

Answer

Disable the backup software firewall rule and try the restore again later.

Answer

Delete and recreate all protected files because the backup repository is probably corrupt.

Question 12

A manager asks the security team to let Human Resources inspect the files on a laptop suspected of containing stolen customer data before IT touches it. What is the best response?

Accepted Answer

Create a forensic image of the device, document the handoff, and maintain chain of custody before any analysis.. The first priority in any investigation involving potential evidence is to preserve the data in its original state. Creating a forensic image (bit-for-bit copy) ensures that the original media is not altered, and documenting the handoff with a chain of custody form provides a verifiable audit trail. This process adheres to forensic best practices and legal requirements, preventing spoliation of evidence before any analysis begins.

Answer

Let HR browse the files first so they can confirm whether the data is sensitive.

Answer

Copy the files to a shared drive so multiple departments can review them quickly.

Answer

Factory reset the laptop immediately to prevent further leakage of customer data.

Question 13

An organization is retiring a batch of laptops with SSDs. All of the systems used full-disk encryption and stored sensitive internal documents. What is the best action before the devices leave the company?

Accepted Answer

Perform a cryptographic erase by destroying the encryption keys and document the sanitization process.. A cryptographic erase (also known as a crypto-scrub) renders the encrypted data permanently inaccessible by securely destroying the encryption keys. Since the SSDs used full-disk encryption (FDE), the data is already encrypted at rest, and without the keys, the ciphertext is effectively unrecoverable. This method is fast, reliable, and compliant with sanitization standards like NIST SP 800-88, making it the best action before the devices leave the organization.

Answer

Run a quick format and remove the asset tags after the files are deleted.

Answer

Degauss the SSDs and then store them in the disposal room until pickup.

Answer

Overwrite the drives once with random data and consider the devices ready for resale.

Question 14

A vulnerability scan finds that an old print server still has SMBv1 enabled. The business says the vendor will not support a patch for at least two months, but the server must stay online. What is the best temporary mitigation?

Accepted Answer

Move the server to a restricted network segment and allow SMB access only from required hosts.. Network segmentation is the most effective temporary mitigation when a patch is unavailable. By moving the print server to a restricted VLAN or firewall zone and applying an access control list (ACL) that permits SMB traffic only from known, required hosts, you reduce the attack surface and prevent widespread exploitation of SMBv1 vulnerabilities (e.g., EternalBlue). This approach follows the principle of least privilege and containment, buying time until the vendor releases a patch.

Answer

Turn off endpoint logging to reduce performance impact until the vendor releases a patch.

Answer

Increase the password length requirement for all users and keep the server on the same network.

Answer

Schedule a weekly reboot to clear any malicious sessions and reduce the chance of exploitation.

Question 15

A security scan finds a critical patch missing on a public-facing web server. The patch has already been tested in the lab and approved for deployment. What should the operations team do next?

Accepted Answer

Deploy the patch through the normal change process as soon as possible. The patch has already been tested and approved, meaning it is ready for deployment. The operations team should follow the normal change management process to deploy the patch as soon as possible, ensuring the public-facing web server is secured against the critical vulnerability without bypassing organizational controls.

Answer

Ignore the finding because the server is already protected by a firewall

Answer

Mark the vulnerability as accepted risk without notifying the business

Answer

Remove the web server from the asset inventory to prevent the scanner from finding it