SY0-701 Security Operations Practice Test 2 — 15 Questions

Question 1

A security analyst receives an automated alert indicating that a standard user account logged in from a geographic location that is unusual for the user, and the login occurred at 3:00 AM local time. The analyst has not yet verified whether this was a successful login or if any additional suspicious activity occurred. According to standard incident response procedures, what should the analyst do NEXT?

Accepted Answer

Review the account's recent activity for signs of compromise.. The correct next step is to review the account's recent activity to gather more context. According to the NIST incident response process (Preparation, Detection & Analysis, Containment, Eradication & Recovery, Post-Incident Activity), after detection the analyst should perform analysis to validate the alert and determine the scope. Reviewing recent logins, accessed files, and other actions helps decide if containment is needed. Immediately disabling the account (A) could be premature if the alert is a false positive or if the user is traveling. Conducting a full forensic analysis (B) is too resource-intensive for a single alert without further evidence. Reporting to law enforcement (D) is not appropriate at this stage; that would occur after a confirmed incident that meets legal thresholds.

Answer

Disable the user account immediately and reset the password.

Answer

Conduct a full forensic analysis of the user's workstation.

Answer

Report the incident to law enforcement.

Question 2

A security analyst detects unusual outbound traffic from a workstation that appears to be communicating with a known malicious IP address. The analyst immediately isolates the workstation from the network. Which of the following is the NEXT step in the incident response process according to NIST SP 800-61?

Accepted Answer

Eradication. According to NIST SP 800-61, the incident response process follows a sequence: Preparation, Detection & Analysis, Containment, Eradication, Recovery, and Lessons Learned. Since the analyst has already performed containment by isolating the workstation, the next step is Eradication, which involves removing the threat (e.g., malware, backdoors) from the affected system. This ensures the root cause is eliminated before moving to recovery.

Answer

Recovery

Answer

Containment

Answer

Lessons Learned

Question 3

An organization's file server contains sensitive HR data. The security team discovers that permissions on a confidential folder have been altered. Which of the following security controls would MOST likely help determine the account responsible for this change?

Accepted Answer

Audit logging. Audit logging is the correct answer because it records detailed information about who made changes to files and folders, including the account name, timestamp, and the specific permission alteration. By reviewing audit logs, the security team can trace the unauthorized permission change back to the responsible user account. This is a detective control that directly supports accountability and forensic investigation.

Answer

Data loss prevention (DLP) system

Answer

Mandatory access control (MAC)

Answer

Host-based intrusion prevention system (HIPS)

Question 4

A security analyst detects a high volume of failed authentication attempts from IP address 203.0.113.1 against a web application. The attempts use different usernames, such as 'admin', 'root', 'test', and several common names. Account lockout policies are configured to lock an account after five failed attempts. Despite this, the analyst sees the attempts continuing over several hours. Which of the following security controls is most likely missing or improperly configured?

Accepted Answer

Configure rate limiting per source IP address. Rate limiting per source IP address is the correct control because it restricts the number of authentication requests from a single IP (203.0.113.1) within a given time window, regardless of the usernames used. Account lockout policies are ineffective here because the attacker is rotating through different usernames (e.g., 'admin', 'root', 'test'), so no single account reaches the five-failed-attempt threshold. By limiting the request rate from the source IP, the analyst can throttle the attacker's brute-force attempts without affecting legitimate users.

Answer

Increase the account lockout threshold to a lower number

Answer

Implement geofencing to block traffic from the attacker's region

Answer

Enable detailed failed login attempt logging

Question 5

A security analyst receives an alert about a user account that has been attempting to authenticate from an unusual geographic location outside of business hours. The analyst reviews the event logs and sees that the authentication attempt was successful, but the user has not reported any suspicious activity. Which of the following actions should the analyst take NEXT?

Accepted Answer

Contact the user to verify whether the authentication was legitimate. The correct next step is to contact the user to verify whether the authentication was legitimate. Since the authentication was successful and the user has not reported suspicious activity, the analyst must first gather context from the user before taking any disruptive action. This aligns with the incident response process of validation and scoping before containment.

Answer

Disable the user account immediately to prevent further access

Answer

Continuously monitor the account for additional suspicious activity

Answer

Revoke all active sessions for the user account

Question 6

A help desk technician reports that a user's account was locked out three times overnight. The security team reviews the authentication logs and discovers that the lockouts resulted from failed login attempts originating from a single external IP address, each attempt using a slightly different variation of the user's password. Which of the following should the security analyst do FIRST?

Accepted Answer

Investigate the user's recent activity for signs of compromise.. Option C is correct because the pattern of failed login attempts from a single external IP using password variations suggests a brute-force or password-spraying attack. The security analyst must first investigate the user's recent activity to determine if the account was successfully compromised or if the attacker gained access via a successful login attempt before the lockouts occurred. This aligns with the incident response process, where identification and analysis precede containment actions like blocking IPs or resetting passwords.

Answer

Block the external IP address at the perimeter firewall.

Answer

Disable the user account and require a password reset.

Answer

Increase the account lockout threshold to prevent future lockouts.

Question 7

A security analyst detects an encrypted outbound connection from a web server to an unknown IP address. The connection is persistent and occurs every 5 minutes. What is the MOST appropriate first step for the analyst to take?

Accepted Answer

Review the server's process list and logs to identify the source.. Option C is correct because the first step in investigating an unknown encrypted outbound connection is to identify the process or service responsible for initiating it. Reviewing the server's process list and logs allows the analyst to determine whether the connection is legitimate (e.g., a scheduled update or backup) or malicious (e.g., a beacon from implanted malware). Without this visibility, actions like blocking or disconnecting could disrupt legitimate services or alert an attacker prematurely.

Answer

Disconnect the server from the network immediately.

Answer

Block the IP address at the perimeter firewall.

Answer

Escalate the incident to the incident response team.

Question 8

A security analyst in the SOC observes a sudden spike in failed authentication attempts from a single external IP address targeting multiple user accounts over the last 30 minutes. After confirming the logs are accurate, which of the following actions should the analyst take FIRST according to standard incident response procedures?

Accepted Answer

Escalate the incident to the incident response team.. Option C is correct because, according to standard incident response procedures (NIST SP 800-61), the first step after confirming an anomaly is to escalate the incident to the incident response team. This ensures that a coordinated, documented, and legally defensible response is initiated, rather than taking unilateral action that could destroy evidence or disrupt legitimate services. The SOC analyst's role is to detect and validate, not to independently execute containment measures without authorization.

Answer

Block the IP address at the firewall immediately.

Answer

Disable all user accounts that were targeted.

Answer

Capture a memory dump of all affected servers.

Question 9

A security analyst detects repeated outbound traffic from a single workstation to an IP address listed on a public threat intelligence feed as a known command-and-control server. The user reports that the workstation is behaving slowly and that antivirus software is up to date. According to incident response best practices, what should the analyst do FIRST?

Accepted Answer

Disconnect the workstation from the network. The correct first step is to disconnect the workstation from the network to immediately contain the threat and prevent further command-and-control (C2) communication. Since the traffic is already confirmed to a known C2 server via a public threat intelligence feed, the priority is to stop data exfiltration and potential lateral movement, not to gather more evidence or notify the user. Incident response best practices emphasize containment before eradication or notification to minimize damage.

Answer

Run a full antivirus scan on the workstation

Answer

Notify the user that their workstation may be compromised

Answer

Check the firewall logs to confirm the destination IP

Question 10

A SOC analyst is investigating an alert triggered when a user clicked a link in an email. The email appeared to be from a trusted vendor and included a PDF attachment with a macro, but the user did not run the macro. Upon reviewing the email headers, the analyst notices that the sender's domain is a common misspelling of the vendor's legitimate domain. Which of the following is the most direct indicator that this email is a phishing attempt?

Accepted Answer

The misspelled sender domain in the email headers. The misspelled sender domain in the email headers is the most direct indicator of a phishing attempt because it reveals the attacker's use of domain spoofing or a lookalike domain to impersonate a trusted vendor. This is a classic social engineering technique that bypasses the user's visual inspection, and since the user did not run the macro, the macro itself is not an active threat. The email headers provide forensic evidence of the domain mismatch, which is a definitive sign of phishing regardless of user actions.

Answer

The macro embedded in the PDF attachment

Answer

The alert generated by the user clicking the link

Answer

The email appeared to be from a known vendor

Question 11

A security analyst in a SOC receives an alert indicating that a large volume of data was transferred from a user's workstation to an external IP address at 2:00 AM. The analyst suspects a data exfiltration attack. According to incident response best practices, what should the analyst do FIRST?

Accepted Answer

Review the user's login and activity logs.. Option B is correct because, in incident response, the first step is to gather evidence and understand the scope of the incident. Reviewing the user's login and activity logs (e.g., Windows Event Logs, authentication logs, and process creation logs) allows the analyst to verify if the user was actually logged in at 2:00 AM, identify any anomalous behavior (e.g., use of unauthorized tools or unusual file access patterns), and determine whether the data transfer was initiated by the user or by malware. This aligns with the NIST SP 800-61 incident response lifecycle, specifically the identification and analysis phase, where initial triage focuses on log review before taking containment actions.

Answer

Block the external IP address at the firewall.

Answer

Contact the user to inquire about the transfer.

Answer

Restore the workstation from a known good backup.

Question 12

A security analyst receives an alert that a user clicked a link in a phishing email and entered their corporate credentials on a fake login page. Which of the following should the analyst do FIRST to minimize further damage?

Accepted Answer

Disable the user's account and block the compromised system from the network. Option C is correct because immediately disabling the user's account and blocking the compromised system from the network stops the attacker from using the stolen credentials to authenticate to corporate resources, such as email, VPN, or file shares. This containment step is the highest priority in incident response to prevent lateral movement and further compromise, as the attacker already has valid credentials and could be actively using them.

Answer

Run a full antivirus scan on the user's workstation

Answer

Reset the user's password and force re-authentication

Answer

Contact law enforcement and report the phishing site

Question 13

A security analyst notices a sudden increase in outbound traffic from a database server that normally only communicates with internal application servers. The server is running a standard OS with no recent changes. Which of the following actions should the analyst take FIRST to determine if the server is compromised?

Accepted Answer

Check the server's running processes for unknown executables.. Checking the server's running processes for unknown executables is the first and most direct step to identify if an attacker has established a foothold. A sudden outbound traffic spike without recent configuration changes strongly suggests a malicious process (e.g., a reverse shell or data exfiltration tool) is running. Examining running processes allows the analyst to spot suspicious executables or command-line arguments before taking more disruptive actions like blocking traffic or running a scan.

Answer

Run a full antivirus scan on the server.

Answer

Block all outbound traffic from the server at the firewall.

Answer

Review the server's event logs for failed login attempts.

Question 14

A security analyst is reviewing authentication logs from a corporate web application. The logs show that over a span of two hours, a single external IP address attempted to log in with 500 different usernames, each using the same password 'Spring2024!'. Only a few of these attempts succeeded. Which type of attack is most likely being observed?

Accepted Answer

Password spraying attack. This is a password spraying attack because the attacker uses a single common password ('Spring2024!') against many different usernames. This technique avoids account lockout policies that typically trigger after multiple failed attempts on a single account, and the few successful logins indicate valid credentials were found.

Answer

Brute force attack

Answer

Credential stuffing attack

Answer

Dictionary attack

Question 15

A security analyst is reviewing web server logs after a user reports that the company website displayed an error message containing raw database queries. The log shows repeated requests to the product search page with the following parameter: `?id=1 OR 1=1`. Which of the following should the analyst do FIRST to confirm the nature of the suspected attack?

Accepted Answer

Verify the request details against the web application firewall logs.. Option C is correct because the analyst should first verify the request details against the web application firewall (WAF) logs to confirm whether the WAF detected and blocked the SQL injection attempt. The parameter `?id=1 OR 1=1` is a classic SQL injection payload, and WAF logs provide immediate evidence of whether the request was flagged, allowed, or blocked, enabling the analyst to correlate the user's report with actual security controls before taking further action.

Answer

Run a vulnerability scan against the web server.

Answer

Block the source IP address in the firewall.

Answer

Isolate the web server from the network immediately.