SY0-701 Security Operations Practice Test 2 — 15 Questions

Question 1

A weekly vulnerability scan returns five findings across different systems. Which three should be remediated first? Select three.

Accepted Answer

A critical remote-code-execution flaw on an internet-facing VPN appliance with active exploitation reported.. The three findings to remediate first are A, C, and D. A is a critical RCE on an internet-facing VPN appliance with active exploitation, representing immediate operational risk. C uses default administrator credentials on an internet-facing management portal, allowing trivial unauthorized access. D is a high-severity RCE on a public customer portal storing account records, combining internet exposure with sensitive data impact. In contrast, B is on an offline lab VM with no connectivity, and E is a low-severity TLS warning on a site without sensitive data, making both lower priority.

Answer

A medium-severity missing patch on an offline lab VM with no network connectivity.

Answer

A low-severity TLS configuration warning on a public site that does not handle sensitive information.

Question 2

A ransomware incident encrypted a file share and the attached NAS backups because the NAS stayed mounted to production and was reachable over SMB. Which two design changes would have reduced the blast radius most effectively? Select two.

Accepted Answer

Keep at least one backup copy offline or immutable.. Keeping at least one backup copy offline or immutable ensures that even if the primary storage and network-attached backups are compromised, the offline or immutable copy remains intact and recoverable. In this scenario, the NAS was mounted and reachable over SMB, allowing ransomware to encrypt both the production share and the backup target. An immutable backup (e.g., using WORM storage or object lock) cannot be modified or deleted by the ransomware, breaking the encryption chain and preserving a clean recovery point. Option B is also correct because using a separate backup account and a restricted backup network segment limits the ability of ransomware to reach backup systems using compromised production credentials or lateral movement. By isolating backup management and access, the blast radius is reduced even if the production network is fully compromised.

Answer

Mount the backup share permanently so restores are always faster.

Answer

Join the NAS to the same administrative group used by production servers.

Answer

Disable restore testing to avoid risking the backup environment.

Question 3

A SIEM alert shows a workstation making repeated outbound HTTPS connections every 15 minutes to the same cloud IP address. The host belongs to the patch-management group, and the security team suspects an approved agent may be responsible. Which two checks best validate whether this is a false positive? Select two.

Accepted Answer

Verify that the destination domain and IP match the vendor's documented update service.. Verifying that the destination domain and IP match the vendor's documented update service (A) directly confirms whether the outbound HTTPS traffic is legitimate patch-management activity. Additionally, comparing the running process, parent process, and digital signature to the approved agent baseline (B) validates that the traffic originates from the approved software and not from a malicious process masquerading as the agent. Together, these two checks confirm both the destination and the source application, reducing false positives in SIEM alerts.

Answer

Immediately isolate the workstation from the network without reviewing any other evidence.

Answer

Suppress every future alert from that subnet permanently.

Answer

Assume the traffic is benign because it occurs at a regular interval.

Question 4

A SOC analyst confirms that a user entered corporate credentials into a fake sign-in page. Mailbox logs now show a new forwarding rule sending messages to an external address, and the attacker may still have an active session. Which two actions should the analyst take first to contain the account compromise? Select two.

Accepted Answer

Reset the user's password and require a fresh authentication challenge.. Resetting the user's password (Option A) immediately invalidates the credentials the attacker phished, preventing further authentication with those stolen credentials. Additionally, revoking active sessions and invalidating refresh tokens (Option B) is necessary because password reset alone does not terminate existing authenticated sessions or refresh tokens, which would otherwise allow the attacker to continue accessing the account. Together, these two actions provide immediate containment per NIST SP 800-61 incident response guidelines.

Answer

Delete the mailbox and create a new user account.

Answer

Disable all external email delivery for the entire organization.

Answer

Wait for the user to confirm whether the message was legitimate before acting.

Question 5

A Linux administrator must run a weekly maintenance script on 40 servers without giving technicians interactive root access. Which two practices best support secure administration? Select two.

Accepted Answer

Use a dedicated service account with only the required commands.. A dedicated service account with only the required commands implements the principle of least privilege. By using sudo or RBAC to restrict the account to exactly the commands needed for the maintenance script, the administrator avoids granting full root access while still allowing the script to execute with elevated privileges. This minimizes the attack surface and prevents unauthorized actions. Additionally, running the job through a scheduler or automation tool (option B) eliminates the need for interactive logins, ensuring the maintenance runs consistently and automatically without exposing root credentials. Automated execution can also be logged and audited, further improving security and accountability.

Answer

Share one root password across the whole team.

Answer

Embed the account password directly in the script.

Answer

Disable logging so the maintenance job runs faster.

Question 6

An email security team receives a macro-enabled spreadsheet from a known supplier. The file must be analyzed before users open it, and if it proves malicious, the organization wants to stop the same attachment from reaching other inboxes. Which two tools are the best fit? Select two.

Accepted Answer

Sandboxing the attachment in an isolated environment.. Sandboxing (A) is correct because it allows the file to be executed in an isolated, controlled environment to observe its behavior (e.g., network connections, file modifications) without risk to the production network. This is the standard method for analyzing suspicious attachments for zero-day or macro-based malware. A secure email gateway with attachment detonation (B) is also correct because it integrates the sandbox into the email flow: it can automatically analyze the attachment, and if it detects malicious behavior, quarantine it and prevent the same attachment from reaching other inboxes. Together, these two tools provide both deep analysis and organization-wide protection.

Answer

Network access control to verify the supplier's laptop posture.

Answer

Data loss prevention to block outbound customer records.

Answer

Intrusion detection system signatures on the mail server.

Question 7

Select all options that correctly match each incident response activity to the phase of the incident response lifecycle it best represents.

1. A SOC analyst disables a compromised account, isolates the workstation from the network, and preserves volatile evidence.
2. The team images the infected system, removes the malicious persistence mechanism, and patches the exploited vulnerability.
3. After restoring services, the team reviews timeline gaps, detection delays, and control failures with management.
4. Before the attack occurs, the team verifies contact lists, playbooks, escalation paths, and backup credentials.
5. The team confirms suspicious authentication logs, endpoint alerts, and unusual outbound traffic indicate an active compromise.

Accepted Answer

Preparation: Verifying contact lists, playbooks, escalation paths, and backup credentials before an attack.. Activities 1 and 2 both fall under Containment, Eradication, and Recovery as they involve immediate response and remediation. Activity 3 is Post-Incident Activity, focusing on lessons learned. Activity 4 is Preparation, done before an incident. Activity 5 is Detection and Analysis, confirming an incident.

Answer

Preparation: A SOC analyst disables a compromised account, isolates the workstation, and preserves volatile evidence.

Answer

Detection and Analysis: The team images the infected system, removes the malicious persistence mechanism, and patches the exploited vulnerability.

Question 8

A finance workstation begins encrypting local files, and the EDR console shows the process is also enumerating SMB shares on adjacent hosts. The user reports no suspicious email and is still logged in. Management wants the fastest containment step that minimizes spread and the best follow-up action to preserve useful evidence. Which two actions should the SOC take first? Select two.

Accepted Answer

Isolate the affected endpoint from the network using EDR or NAC.. Isolating the affected endpoint from the network using EDR or NAC (Option A) is the fastest containment step because it immediately stops the ransomware from encrypting SMB shares on adjacent hosts, preventing lateral spread. This action preserves the system's state for forensic analysis, unlike powering off which destroys volatile evidence. After containment, the SOC should capture volatile evidence (Option C) such as memory, running processes, and active connections before any recovery or wiping, as this data is essential for attribution and understanding the attack vector. These two actions together balance rapid containment with evidence preservation.

Answer

Power the system off immediately to stop encryption and preserve nothing else.

Answer

Begin restoring files from backup on the same workstation before containment is finished.

Answer

Reenable the user's mapped drives so they can verify which files are affected.

Question 9

A data center has a water pipe running above the raised floor, and the facilities team wants the earliest possible warning of a leak before water reaches the equipment. Which control should be installed or expanded?

Accepted Answer

Install or expand water-leak sensors under the raised floor and near the pipe path.. Water-leak sensors provide the earliest possible warning of a liquid hazard by detecting moisture before it reaches equipment or causes electrical shorts. In a data center with raised floors and pipe paths, these sensors can be placed directly in the path of potential leaks, triggering alerts immediately upon contact with water. This proactive monitoring is critical for preventing costly downtime and equipment damage.

Answer

Add badge readers to every rack so the servers can be tracked physically.

Answer

Replace the cameras with motion detectors to improve environmental safety.

Answer

Increase automatic screen lock timeouts on all administrative workstations.

Question 10

A security team receives a macro-enabled spreadsheet from a supplier. The file must be analyzed before any user opens it, and if the same payload later executes on an endpoint the organization wants the ability to contain it automatically. Which two tools best fit those requirements? Select two.

Accepted Answer

Use a sandbox to detonate the attachment in an isolated environment before delivery.. A sandbox detonates the macro-enabled spreadsheet in an isolated environment before delivery, allowing the security team to observe malicious behavior (e.g., payload extraction, network calls) without risk to production systems. This pre-delivery analysis ensures the file is safe before any user opens it, directly meeting the requirement to analyze the file before user access. Additionally, EDR (Endpoint Detection and Response) agents on endpoints monitor for execution of the same payload and can automatically quarantine or isolate the affected endpoint, providing the automatic containment required if the payload later executes.

Answer

Deploy a WAF in front of the mail gateway.

Answer

Create a DNS sinkhole entry only after the file is opened by a user.

Answer

Use DLP to stop the spreadsheet from containing macros.

Question 11

After a ransomware incident, management sees that last night's backups completed successfully and wants proof they can actually be used before production is declared recovered. Which three actions best validate recoverability? Select three.

Accepted Answer

Restore a representative backup into an isolated test environment.. Restoring a representative backup into an isolated test environment directly validates that the backup data is readable, the restore process works, and the system can be brought online without impacting production. Running application and data validation checks on the restored system confirms the integrity and completeness of the restored data, ensuring the backup is actually usable. Measuring the restore duration against the documented recovery objectives verifies that the restore process meets the business requirements for downtime. Together, these actions provide comprehensive evidence of recoverability, whereas backup software success logs alone are insufficient.

Answer

Increase the retention period without performing any restore.

Answer

Close the incident because the backup software reported a successful job completion.

Question 12

After a ransomware incident, management says backups are available but will not approve closure until the team proves the restore process works without risking production data. Which two actions best validate recoverability? Select two.

Accepted Answer

Restore a recent backup to an isolated test system that mirrors production.. Restoring to an isolated test system that mirrors production (Option A) validates the backup's integrity and the restore process without risking production data. After the restore, verifying file integrity and application functionality (Option B) confirms that the restored data is usable and the system works as expected. Together, these actions prove recoverability end-to-end. Option C is wrong because increasing retention without testing does not prove recoverability. Option D is wrong because keeping the ransomware-affected server online risks further damage and does not validate backups. Option E is wrong because a backup job report only shows that a backup was scheduled/successful, not that the data can actually be restored and used.

Answer

Increase backup retention without testing the restore process.

Answer

Keep the original ransomware-affected server online until the backup is approved.

Answer

Use the backup job report as proof that the data can be recovered.

Question 13

After collecting a suspect laptop, the responder makes a bit-for-bit image of the drive. Which two actions best support chain of custody? Select two.

Accepted Answer

Calculate and record a cryptographic hash of the image.. Calculating and recording a cryptographic hash (e.g., SHA-256) of the bit-for-bit image creates a digital fingerprint that can later be used to verify the image has not been altered. This ensures data integrity, a core requirement for maintaining chain of custody in digital forensics. Additionally, documenting every evidence transfer with date, time, and handler names establishes a clear, verifiable record of who had custody of the evidence at every stage. This accountability is essential to prove that the evidence was not tampered with or mishandled, and it directly supports the chain of custody.

Answer

Browse the original drive on a normal office laptop.

Answer

Rename files to make them easier for later review.

Answer

Store the image on a shared folder without access controls.

Question 14

An analyst receives a disk image and the original hash from a response team member. Before any examination begins, the analyst must be able to show the image is unchanged and that the evidence handling process is defensible. Which two actions are most important? Select two.

Accepted Answer

Recompute the SHA-256 hash of the received image and compare it to the acquisition record.. Recomputing the SHA-256 hash of the received image and comparing it to the original acquisition record verifies that the image is unchanged, ensuring data integrity. Recording the transfer, date, time, and handler names in the chain-of-custody log documents who had possession of the evidence at every step, making the evidence handling process defensible. Options B, D, and E are incorrect because they involve modifying the image or compromising chain-of-custody procedures.

Answer

Mount the original disk read/write so the file system can repair itself before analysis.

Answer

Convert the image to another format before hashing so the tool can open it.

Answer

Rename evidence files to match the case number and avoid confusion.

Question 15

A data center wants to reduce tailgating at a sensitive room entrance. Which two controls are most effective? Select two.

Accepted Answer

A mantrap that allows only one person through at a time.. A mantrap is a small room with two interlocking doors that allows only one person to enter at a time, physically preventing tailgating by trapping unauthorized individuals between the doors. A turnstile is a physical barrier that permits only one person to pass at a time, and with anti-passback features it can also prevent tailgating. Both controls actively restrict entry to one person, making them highly effective against tailgating, whereas badge readers without anti-passback, motion sensors, and sign-in sheets do not physically prevent tailgating.

Answer

A standard badge reader without anti-passback.

Answer

A motion sensor in the hallway.

Answer

A visitor sign-in sheet at the front desk.