SY0-701 Security Operations Practice Test 3 — 15 Questions

Question 1

After a ransomware incident, management says backups are available but will not approve closure until the team proves the restore process works without risking production data. Which two actions best validate recoverability? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Restore a recent backup to an isolated test system that mirrors production.. Restoring to an isolated test system that mirrors production (Option A) validates the backup's integrity and the restore process without risking production data. After the restore, verifying file integrity and application functionality (Option B) confirms that the restored data is usable and the system works as expected. Together, these actions prove recoverability end-to-end. Option C is wrong because increasing retention without testing does not prove recoverability. Option D is wrong because keeping the ransomware-affected server online risks further damage and does not validate backups. Option E is wrong because a backup job report only shows that a backup was scheduled/successful, not that the data can actually be restored and used.

Answer

Increase backup retention without testing the restore process.

Answer

Keep the original ransomware-affected server online until the backup is approved.

Answer

Use the backup job report as proof that the data can be recovered.

Question 2

After collecting a suspect laptop, the responder makes a bit-for-bit image of the drive. Which two actions best support chain of custody? Select two.

Accepted Answer

Calculate and record a cryptographic hash of the image.. Calculating and recording a cryptographic hash (e.g., SHA-256) of the bit-for-bit image creates a digital fingerprint that can later be used to verify the image has not been altered. This ensures data integrity, a core requirement for maintaining chain of custody in digital forensics. Additionally, documenting every evidence transfer with date, time, and handler names establishes a clear, verifiable record of who had custody of the evidence at every stage. This accountability is essential to prove that the evidence was not tampered with or mishandled, and it directly supports the chain of custody.

Answer

Browse the original drive on a normal office laptop.

Answer

Rename files to make them easier for later review.

Answer

Store the image on a shared folder without access controls.

Question 3

An analyst receives a disk image and the original hash from a response team member. Before any examination begins, the analyst must be able to show the image is unchanged and that the evidence handling process is defensible. Which two actions are most important? Select two.

Accepted Answer

Recompute the SHA-256 hash of the received image and compare it to the acquisition record.. Recomputing the SHA-256 hash of the received image and comparing it to the original acquisition record verifies that the image is unchanged, ensuring data integrity. Recording the transfer, date, time, and handler names in the chain-of-custody log documents who had possession of the evidence at every step, making the evidence handling process defensible. Options B, D, and E are incorrect because they involve modifying the image or compromising chain-of-custody procedures.

Answer

Mount the original disk read/write so the file system can repair itself before analysis.

Answer

Convert the image to another format before hashing so the tool can open it.

Answer

Rename evidence files to match the case number and avoid confusion.

Question 4

A data center wants to reduce tailgating at a sensitive room entrance. Which two controls are most effective? Select two.

Accepted Answer

A mantrap that allows only one person through at a time.. A mantrap is a small room with two interlocking doors that allows only one person to enter at a time, physically preventing tailgating by trapping unauthorized individuals between the doors. A turnstile is a physical barrier that permits only one person to pass at a time, and with anti-passback features it can also prevent tailgating. Both controls actively restrict entry to one person, making them highly effective against tailgating, whereas badge readers without anti-passback, motion sensors, and sign-in sheets do not physically prevent tailgating.

Answer

A standard badge reader without anti-passback.

Answer

A motion sensor in the hallway.

Answer

A visitor sign-in sheet at the front desk.

Question 5

A responder has imaged a suspect laptop and needs to preserve the evidence for possible legal action. Which three actions best support chain of custody and admissibility? Select three.

Accepted Answer

Document the evidence identifier, collector, date, time, and location on the chain-of-custody form.. A: Documenting evidence identifier, collector, date/time, and location on a chain-of-custody form ensures an unbroken, documented chain of custody. B: Calculating cryptographic hashes (e.g., SHA-256) for both the original evidence and the forensic image verifies integrity and shows the image is an exact copy. C: Sealing the original device in an access-controlled evidence locker prevents physical tampering and unauthorised access. These three together support admissibility by demonstrating authenticity, integrity, and a proper chain of custody.

Answer

Mount the original drive read/write so investigators can search it faster.

Answer

Rename the image file to match the case number before hashing it.

Question 6

After a ransomware event, management wants proof that backups can actually be used before trusting them. Which two activities best validate recoverability? Select two.

Accepted Answer

Restore a sample file or folder into an isolated test environment.. Restoring a sample file or folder into an isolated test environment (Option A) directly validates that the backup data is readable and the restore process works end-to-end. Comparing the restored data with hashes or known-good source copies (Option B) verifies the integrity of the restored data, ensuring it matches the original. Together, these activities provide strong evidence that backups can be successfully recovered and used.

Answer

Trust a backup because the job status shows completed successfully.

Answer

Increase backup retention without testing restore ability.

Answer

Keep backups on production servers for quicker access during incidents.

Question 7

A server room sits below a chilled-water line, and occasional condensation is forming on the pipe during humid afternoons. Facilities wants the earliest warning before water reaches equipment and a way to get an alert even if no one is onsite. Which two controls should be implemented? Select two.

Accepted Answer

Install a networked water-leak detection cable beneath the raised floor near the chilled-water line.. A networked water-leak detection cable provides continuous, real-time monitoring for moisture; condensation completing the circuit triggers an immediate alert. Option B is also correct because monitored environmental alerts ensure that when the sensor trips, the NOC or building management system is notified, providing an alert even when no one is onsite. The other options are unrelated to water detection or early warning.

Answer

Replace standard doors with mantraps to prevent tailgating at the room entrance.

Answer

Increase firewall logging on the server VLAN to spot moisture-related outages.

Answer

Use temperature-only sensors because condensation always raises heat first.

Question 8

A post-incident review shows the SOC detected malicious PowerShell activity six hours late because the existing detections did not correlate the encoded command, the unusual outbound connection, and the creation of a scheduled task. Leadership wants the two follow-up actions most likely to improve future response. Select two.

Accepted Answer

Add the new indicators and event patterns to SIEM and EDR detections.. Adding the new indicators and event patterns to SIEM and EDR detections directly addresses the root cause of the six-hour delay: the lack of correlation. Updating detection rules to correlate these patterns enables near-real-time alerts. Additionally, revising the incident response playbook ensures analysts have clear escalation and containment steps, improving response speed when such detections fire. Both actions together reduce mean time to detect and mean time to respond.

Answer

Restore the compromised host to production immediately after the next reboot.

Answer

Reduce log retention to keep storage costs low.

Answer

Disable PowerShell everywhere without reviewing business requirements or alternatives.

Question 9

A Linux operations team must run a nightly maintenance workflow on 60 servers to rotate logs and restart one service. Security does not allow interactive root logins, and every execution must be auditable. Which two practices best support secure administration? Select two.

Accepted Answer

Use a dedicated service account with sudo rights limited to the exact commands in the workflow.. Using a dedicated service account with sudo rights limited to the exact commands in the workflow enforces the principle of least privilege. This ensures that even if the account is compromised, an attacker can only execute the specific log rotation and service restart commands, not arbitrary root-level operations. It also eliminates the need for interactive root logins, satisfying the security policy while maintaining auditability through sudo logs. Running the workflow through a centralized automation platform that records execution time and output complements this by providing a tamper-evident audit trail, ensuring that all actions are logged and attributable, which is essential for non-repudiation and secure administration.

Answer

Hardcode the root password in the script so the same job works everywhere.

Answer

Share one privileged SSH key among all administrators for convenience.

Answer

Disable command logging so the maintenance output is easier to review.

Question 10

A security analyst is reviewing incident response procedures. Which three of the following activities are typically performed during the 'Containment, Eradication, and Recovery' phase of the incident response process? (Choose three.)

Accepted Answer

Isolating affected systems from the network to prevent further damage. The 'Containment, Eradication, and Recovery' phase focuses on stopping the spread of an incident, removing the root cause, and restoring normal operations. Isolating affected systems (containment), removing malicious files and restoring from backups (eradication/recovery), and rebuilding from a secure baseline (recovery) are all core activities in this phase, as defined by NIST SP 800-61 Rev. 2 and CompTIA's incident response framework.

Answer

Performing forensic imaging of all systems before any action is taken

Answer

Conducting a lessons-learned meeting with the incident response team

Answer

Escalating the incident to law enforcement agencies

Question 11

A security operations center (SOC) analyst is investigating a potential malware outbreak. Which three of the following indicators of compromise (IOCs) would provide the strongest evidence of malicious activity? (Choose three.)

Accepted Answer

A hash of a file that matches a known malware signature in a threat intelligence feed. An outbound connection to a known C2 IP address is a strong indicator of compromise because it suggests the infected host is communicating with an attacker-controlled server to receive commands or exfiltrate data. This is a direct network-level IOC that is rarely seen in legitimate traffic, especially when the IP is listed in threat intelligence feeds as malicious. Similarly, a registry run key modification is a common persistence mechanism used by malware to survive reboots, and a file hash matching a known malware signature provides definitive evidence of malicious code. In contrast, user reports of slow computers, a single failed login, or increased legitimate web traffic from a new region are weak or contextual indicators and do not provide strong evidence of compromise.

Answer

An increase in legitimate web traffic to a corporate website from a new geographic region

Answer

A user reporting a slow computer that started after installing a software update

Answer

A single failed login attempt on a user account from an internal IP address

Question 12

A security analyst is investigating a suspected compromised account. The SIEM shows that the account authenticated successfully from an IP address in a different country at 02:00, and then from the user's usual office IP at 02:05. There are no other alerts. Which authentication-related data source should the analyst examine first to determine if this represents a credential-stuffing attack or a false positive?

Accepted Answer

Active Directory domain controller security event logs, specifically events for successful and failed logon attempts (e.g., Event ID 4624 and 4625).. Domain controller security logs are the authoritative source for authentication events in an Active Directory environment. They record the account name, source IP, logon type, and success/failure status. By correlating the foreign IP logon with any preceding failed attempts and the logon type, the analyst can determine if this was a credential-stuffing attack or a legitimate logon from a new location.

Answer

The VPN concentrator's authentication logs, focusing on the user's VPN session start and end times.

Answer

The user's workstation local security event logs, looking for logon type 2 (interactive) events.

Answer

The firewall's outbound connection logs to see if the user's workstation connected to the foreign IP address.

Question 13

A security analyst is reviewing a packet capture of suspicious network traffic. The analyst observes a series of TCP SYN packets sent to multiple ports on a single target host, with no corresponding SYN-ACK responses. The source IP is spoofed. Which type of attack is most likely occurring?

Accepted Answer

TCP SYN flood. The traffic pattern of multiple TCP SYN packets to various ports with spoofed source IP and no SYN-ACK responses is indicative of a TCP SYN flood. The attacker aims to consume the target's resources by initiating many half-open connections. The spoofed source IP prevents the target from completing the handshake and also hides the attacker's identity.

Answer

UDP flood

Answer

Smurf attack

Answer

Port scan

Question 14

A SOC analyst receives an alert from the EDR system indicating that the process 'C:\Program Files\Vendor\Updater.exe' attempted to modify the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key on a user's workstation. The analyst checks the file hash and finds it matches a known legitimate software updater. Which of the following actions is most appropriate for the analyst to take?

Accepted Answer

Investigate the user's recent activity and check for signs of process hollowing or DLL injection.. The EDR alert indicates a legitimate process (Updater.exe) modifying a critical persistence registry key (Run). Even with a known good hash, the process could be compromised via process hollowing or DLL injection, where malicious code runs under the guise of a trusted executable. Investigating user activity and checking for these attack techniques is the appropriate next step to confirm whether the behavior is benign or indicative of a threat.

Answer

Disable the software updater immediately to prevent further registry modifications.

Answer

Create an exception rule in the EDR to suppress future alerts for this process.

Answer

Isolate the workstation from the network and reimage the system immediately.

Question 15

A SOC analyst is reviewing logs from a Windows domain controller and notices a large number of failed logon attempts (Event ID 4625) from a single source IP address within a five-minute window. The account names used are random strings such as "a1b2c3", "x9y8z7", etc. The analyst then checks the source IP and finds it is a known external address from a foreign country. Which of the following is the most appropriate next step for the analyst to take?

Accepted Answer

Investigate whether any of the attempted accounts correspond to actual domain users.. The analyst must first determine if any of the randomly generated account names match existing domain user accounts. If a match is found, it indicates a targeted password-spraying or brute-force attack against valid accounts, requiring immediate account lockdown and credential reset. This investigation step aligns with the incident response process of identification before containment or escalation.

Answer

Immediately block the IP address at the perimeter firewall.

Answer

Run a full antivirus scan on the domain controller.

Answer

Notify the company's legal department for law enforcement involvement.