SY0-701 Security Operations Practice Test 2 — 15 Questions

Question 1

A company-owned laptop is suspected in an insider theft case and legal says the evidence may be used in court. Which two actions best support evidence admissibility during transport to the evidence locker? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Document the chain of custody with the collector, date, time, device condition, and transfer history.. Both actions protect the integrity and evidentiary value of the laptop. Chain-of-custody documentation creates a continuous, verifiable record of every transfer, showing who had control and that the device was not altered. Sealing the laptop in a tamper-evident bag and recording the seal number physically prevents or indicates tampering during transport and ties the evidence to the documented custody transfer. Together, they establish authenticity and integrity for admissibility.

Answer

Browse the user’s files to confirm whether the laptop contains stolen documents.

Answer

Remove the hard drive and place it in an unmarked box for convenience.

Answer

Let the employee continue using the laptop until legal staff are available.

Question 2

A new SIEM rule generates hundreds of alerts from a scheduled backup job that is known to be legitimate. Which two tuning changes are the best ways to reduce noise without losing visibility into real abuse? Select two.

Accepted Answer

Add a targeted exception for the known backup account, host, or signed process.. Adding a targeted exception for the known backup account, host, or signed process suppresses alerts for legitimate backup activity while still monitoring for anomalies. Additionally, baselining the backup job's expected schedule and source systems and alerting only on deviations (e.g., unusual timing or unexpected host) reduces noise while preserving detection of potentially abused credentials or compromised systems. These tuning changes reduce false positives without losing visibility into real abuse.

Answer

Disable the SIEM rule entirely because backup jobs are normal.

Answer

Mark every backup-related alert as harmless without review.

Answer

Stop logging backup systems so they no longer create noise.

Question 3

After isolating an infected endpoint and collecting volatile memory, the team identifies a malicious browser extension and a scheduled task used for persistence. Which two actions belong in the eradication phase before returning the system to service? Select two.

Accepted Answer

Remove the malicious extension and delete the persistence mechanism.. The eradication phase focuses on completely removing the threat from the system. This includes deleting malicious artifacts such as the browser extension and scheduled task, as well as taking stronger measures such as reimaging the host from a trusted gold image to ensure no malware remains. After eradication, recovery actions like restoring user data from backups and reconnecting the system to the network can be performed.

Answer

Restore user files from the most recent backup and reconnect the host immediately.

Answer

Announce the incident to users without changing the host configuration.

Answer

Leave the browser extension in place and only change the user password.

Question 4

A weekly vulnerability scan returns five findings across different systems. Which three should be remediated first? Select three.

Accepted Answer

A critical remote-code-execution flaw on an internet-facing VPN appliance with active exploitation reported.. The three findings to remediate first are A, C, and D. A is a critical RCE on an internet-facing VPN appliance with active exploitation, representing immediate operational risk. C uses default administrator credentials on an internet-facing management portal, allowing trivial unauthorized access. D is a high-severity RCE on a public customer portal storing account records, combining internet exposure with sensitive data impact. In contrast, B is on an offline lab VM with no connectivity, and E is a low-severity TLS warning on a site without sensitive data, making both lower priority.

Answer

A medium-severity missing patch on an offline lab VM with no network connectivity.

Answer

A low-severity TLS configuration warning on a public site that does not handle sensitive information.

Question 5

A ransomware incident encrypted a file share and the attached NAS backups because the NAS stayed mounted to production and was reachable over SMB. Which two design changes would have reduced the blast radius most effectively? Select two.

Accepted Answer

Keep at least one backup copy offline or immutable.. Keeping at least one backup copy offline or immutable ensures that even if the primary storage and network-attached backups are compromised, the offline or immutable copy remains intact and recoverable. In this scenario, the NAS was mounted and reachable over SMB, allowing ransomware to encrypt both the production share and the backup target. An immutable backup (e.g., using WORM storage or object lock) cannot be modified or deleted by the ransomware, breaking the encryption chain and preserving a clean recovery point. Option B is also correct because using a separate backup account and a restricted backup network segment limits the ability of ransomware to reach backup systems using compromised production credentials or lateral movement. By isolating backup management and access, the blast radius is reduced even if the production network is fully compromised.

Answer

Mount the backup share permanently so restores are always faster.

Answer

Join the NAS to the same administrative group used by production servers.

Answer

Disable restore testing to avoid risking the backup environment.

Question 6

A SIEM alert shows a workstation making repeated outbound HTTPS connections every 15 minutes to the same cloud IP address. The host belongs to the patch-management group, and the security team suspects an approved agent may be responsible. Which two checks best validate whether this is a false positive? Select two.

Accepted Answer

Verify that the destination domain and IP match the vendor's documented update service.. Verifying that the destination domain and IP match the vendor's documented update service (A) directly confirms whether the outbound HTTPS traffic is legitimate patch-management activity. Additionally, comparing the running process, parent process, and digital signature to the approved agent baseline (B) validates that the traffic originates from the approved software and not from a malicious process masquerading as the agent. Together, these two checks confirm both the destination and the source application, reducing false positives in SIEM alerts.

Answer

Immediately isolate the workstation from the network without reviewing any other evidence.

Answer

Suppress every future alert from that subnet permanently.

Answer

Assume the traffic is benign because it occurs at a regular interval.

Question 7

A SOC analyst confirms that a user entered corporate credentials into a fake sign-in page. Mailbox logs now show a new forwarding rule sending messages to an external address, and the attacker may still have an active session. Which two actions should the analyst take first to contain the account compromise? Select two.

Accepted Answer

Reset the user's password and require a fresh authentication challenge.. Resetting the user's password (Option A) immediately invalidates the credentials the attacker phished, preventing further authentication with those stolen credentials. Additionally, revoking active sessions and invalidating refresh tokens (Option B) is necessary because password reset alone does not terminate existing authenticated sessions or refresh tokens, which would otherwise allow the attacker to continue accessing the account. Together, these two actions provide immediate containment per NIST SP 800-61 incident response guidelines.

Answer

Delete the mailbox and create a new user account.

Answer

Disable all external email delivery for the entire organization.

Answer

Wait for the user to confirm whether the message was legitimate before acting.

Question 8

Management wants to ensure a file server backed up every night can actually be restored within a 4-hour recovery time objective after an incident. Which two actions best improve recovery confidence? Select two.

Accepted Answer

Perform scheduled restore tests to an isolated environment.. Performing scheduled restore tests to an isolated environment validates that the backup data is both readable and usable without risking corruption of the production environment. This directly confirms the ability to meet the 4-hour RTO by measuring actual restore times and identifying any issues with the backup process or media before a real incident occurs.

Answer

Increase retention to keep backups for two years without changing restore testing.

Answer

Move the backup repository onto the same always-mounted file share as production data.

Answer

Reduce the number of user permissions on the file server without changing backup design.

Question 9

A Linux administrator must run a weekly maintenance script on 40 servers without giving technicians interactive root access. Which two practices best support secure administration? Select two.

Accepted Answer

Use a dedicated service account with only the required commands.. A dedicated service account with only the required commands implements the principle of least privilege. By using sudo or RBAC to restrict the account to exactly the commands needed for the maintenance script, the administrator avoids granting full root access while still allowing the script to execute with elevated privileges. This minimizes the attack surface and prevents unauthorized actions. Additionally, running the job through a scheduler or automation tool (option B) eliminates the need for interactive logins, ensuring the maintenance runs consistently and automatically without exposing root credentials. Automated execution can also be logged and audited, further improving security and accountability.

Answer

Share one root password across the whole team.

Answer

Embed the account password directly in the script.

Answer

Disable logging so the maintenance job runs faster.

Question 10

An email security team receives a macro-enabled spreadsheet from a known supplier. The file must be analyzed before users open it, and if it proves malicious, the organization wants to stop the same attachment from reaching other inboxes. Which two tools are the best fit? Select two.

Accepted Answer

Sandboxing the attachment in an isolated environment.. Sandboxing (A) is correct because it allows the file to be executed in an isolated, controlled environment to observe its behavior (e.g., network connections, file modifications) without risk to the production network. This is the standard method for analyzing suspicious attachments for zero-day or macro-based malware. A secure email gateway with attachment detonation (B) is also correct because it integrates the sandbox into the email flow: it can automatically analyze the attachment, and if it detects malicious behavior, quarantine it and prevent the same attachment from reaching other inboxes. Together, these two tools provide both deep analysis and organization-wide protection.

Answer

Network access control to verify the supplier's laptop posture.

Answer

Data loss prevention to block outbound customer records.

Answer

Intrusion detection system signatures on the mail server.

Question 11

Select all options that correctly match each incident response activity to the phase of the incident response lifecycle it best represents.

1. A SOC analyst disables a compromised account, isolates the workstation from the network, and preserves volatile evidence.
2. The team images the infected system, removes the malicious persistence mechanism, and patches the exploited vulnerability.
3. After restoring services, the team reviews timeline gaps, detection delays, and control failures with management.
4. Before the attack occurs, the team verifies contact lists, playbooks, escalation paths, and backup credentials.
5. The team confirms suspicious authentication logs, endpoint alerts, and unusual outbound traffic indicate an active compromise.

Accepted Answer

Preparation: Verifying contact lists, playbooks, escalation paths, and backup credentials before an attack.. Activities 1 and 2 both fall under Containment, Eradication, and Recovery as they involve immediate response and remediation. Activity 3 is Post-Incident Activity, focusing on lessons learned. Activity 4 is Preparation, done before an incident. Activity 5 is Detection and Analysis, confirming an incident.

Answer

Preparation: A SOC analyst disables a compromised account, isolates the workstation, and preserves volatile evidence.

Answer

Detection and Analysis: The team images the infected system, removes the malicious persistence mechanism, and patches the exploited vulnerability.

Question 12

A finance workstation begins encrypting local files, and the EDR console shows the process is also enumerating SMB shares on adjacent hosts. The user reports no suspicious email and is still logged in. Management wants the fastest containment step that minimizes spread and the best follow-up action to preserve useful evidence. Which two actions should the SOC take first? Select two.

Accepted Answer

Isolate the affected endpoint from the network using EDR or NAC.. Isolating the affected endpoint from the network using EDR or NAC (Option A) is the fastest containment step because it immediately stops the ransomware from encrypting SMB shares on adjacent hosts, preventing lateral spread. This action preserves the system's state for forensic analysis, unlike powering off which destroys volatile evidence. After containment, the SOC should capture volatile evidence (Option C) such as memory, running processes, and active connections before any recovery or wiping, as this data is essential for attribution and understanding the attack vector. These two actions together balance rapid containment with evidence preservation.

Answer

Power the system off immediately to stop encryption and preserve nothing else.

Answer

Begin restoring files from backup on the same workstation before containment is finished.

Answer

Reenable the user's mapped drives so they can verify which files are affected.

Question 13

A data center has a water pipe running above the raised floor, and the facilities team wants the earliest possible warning of a leak before water reaches the equipment. Which control should be installed or expanded?

Accepted Answer

Install or expand water-leak sensors under the raised floor and near the pipe path.. Water-leak sensors provide the earliest possible warning of a liquid hazard by detecting moisture before it reaches equipment or causes electrical shorts. In a data center with raised floors and pipe paths, these sensors can be placed directly in the path of potential leaks, triggering alerts immediately upon contact with water. This proactive monitoring is critical for preventing costly downtime and equipment damage.

Answer

Add badge readers to every rack so the servers can be tracked physically.

Answer

Replace the cameras with motion detectors to improve environmental safety.

Answer

Increase automatic screen lock timeouts on all administrative workstations.

Question 14

A security team receives a macro-enabled spreadsheet from a supplier. The file must be analyzed before any user opens it, and if the same payload later executes on an endpoint the organization wants the ability to contain it automatically. Which two tools best fit those requirements? Select two.

Accepted Answer

Use a sandbox to detonate the attachment in an isolated environment before delivery.. A sandbox detonates the macro-enabled spreadsheet in an isolated environment before delivery, allowing the security team to observe malicious behavior (e.g., payload extraction, network calls) without risk to production systems. This pre-delivery analysis ensures the file is safe before any user opens it, directly meeting the requirement to analyze the file before user access. Additionally, EDR (Endpoint Detection and Response) agents on endpoints monitor for execution of the same payload and can automatically quarantine or isolate the affected endpoint, providing the automatic containment required if the payload later executes.

Answer

Deploy a WAF in front of the mail gateway.

Answer

Create a DNS sinkhole entry only after the file is opened by a user.

Answer

Use DLP to stop the spreadsheet from containing macros.

Question 15

After a ransomware incident, management sees that last night's backups completed successfully and wants proof they can actually be used before production is declared recovered. Which three actions best validate recoverability? Select three.

Accepted Answer

Restore a representative backup into an isolated test environment.. Restoring a representative backup into an isolated test environment directly validates that the backup data is readable, the restore process works, and the system can be brought online without impacting production. Running application and data validation checks on the restored system confirms the integrity and completeness of the restored data, ensuring the backup is actually usable. Measuring the restore duration against the documented recovery objectives verifies that the restore process meets the business requirements for downtime. Together, these actions provide comprehensive evidence of recoverability, whereas backup software success logs alone are insufficient.

Answer

Increase the retention period without performing any restore.

Answer

Close the incident because the backup software reported a successful job completion.