SY0-701 Security Operations Practice Test 3 — 15 Questions

Question 1

A responder has imaged a suspect laptop and needs to preserve the evidence for possible legal action. Which three actions best support chain of custody and admissibility? Select three.

Accepted Answer

Document the evidence identifier, collector, date, time, and location on the chain-of-custody form.. A: Documenting evidence identifier, collector, date/time, and location on a chain-of-custody form ensures an unbroken, documented chain of custody. B: Calculating cryptographic hashes (e.g., SHA-256) for both the original evidence and the forensic image verifies integrity and shows the image is an exact copy. C: Sealing the original device in an access-controlled evidence locker prevents physical tampering and unauthorised access. These three together support admissibility by demonstrating authenticity, integrity, and a proper chain of custody.

Answer

Mount the original drive read/write so investigators can search it faster.

Answer

Rename the image file to match the case number before hashing it.

Question 2

After a ransomware event, management wants proof that backups can actually be used before trusting them. Which two activities best validate recoverability? Select two.

Accepted Answer

Restore a sample file or folder into an isolated test environment.. Restoring a sample file or folder into an isolated test environment (Option A) directly validates that the backup data is readable and the restore process works end-to-end. Comparing the restored data with hashes or known-good source copies (Option B) verifies the integrity of the restored data, ensuring it matches the original. Together, these activities provide strong evidence that backups can be successfully recovered and used.

Answer

Trust a backup because the job status shows completed successfully.

Answer

Increase backup retention without testing restore ability.

Answer

Keep backups on production servers for quicker access during incidents.

Question 3

A server room sits below a chilled-water line, and occasional condensation is forming on the pipe during humid afternoons. Facilities wants the earliest warning before water reaches equipment and a way to get an alert even if no one is onsite. Which two controls should be implemented? Select two.

Accepted Answer

Install a networked water-leak detection cable beneath the raised floor near the chilled-water line.. Option A is correct because a networked water-leak detection cable provides continuous, real-time monitoring for moisture; condensation completing the circuit triggers an immediate alert. Option B is also correct because monitored environmental alerts ensure that when the sensor trips, the NOC or building management system is notified, providing an alert even when no one is onsite. The other options are unrelated to water detection or early warning.

Answer

Replace standard doors with mantraps to prevent tailgating at the room entrance.

Answer

Increase firewall logging on the server VLAN to spot moisture-related outages.

Answer

Use temperature-only sensors because condensation always raises heat first.

Question 4

A post-incident review shows the SOC detected malicious PowerShell activity six hours late because the existing detections did not correlate the encoded command, the unusual outbound connection, and the creation of a scheduled task. Leadership wants the two follow-up actions most likely to improve future response. Select two.

Accepted Answer

Add the new indicators and event patterns to SIEM and EDR detections.. Adding the new indicators and event patterns to SIEM and EDR detections directly addresses the root cause of the six-hour delay: the lack of correlation. Updating detection rules to correlate these patterns enables near-real-time alerts. Additionally, revising the incident response playbook ensures analysts have clear escalation and containment steps, improving response speed when such detections fire. Both actions together reduce mean time to detect and mean time to respond.

Answer

Restore the compromised host to production immediately after the next reboot.

Answer

Reduce log retention to keep storage costs low.

Answer

Disable PowerShell everywhere without reviewing business requirements or alternatives.

Question 5

A Linux operations team must run a nightly maintenance workflow on 60 servers to rotate logs and restart one service. Security does not allow interactive root logins, and every execution must be auditable. Which two practices best support secure administration? Select two.

Accepted Answer

Use a dedicated service account with sudo rights limited to the exact commands in the workflow.. Using a dedicated service account with sudo rights limited to the exact commands in the workflow enforces the principle of least privilege. This ensures that even if the account is compromised, an attacker can only execute the specific log rotation and service restart commands, not arbitrary root-level operations. It also eliminates the need for interactive root logins, satisfying the security policy while maintaining auditability through sudo logs. Running the workflow through a centralized automation platform that records execution time and output complements this by providing a tamper-evident audit trail, ensuring that all actions are logged and attributable, which is essential for non-repudiation and secure administration.

Answer

Hardcode the root password in the script so the same job works everywhere.

Answer

Share one privileged SSH key among all administrators for convenience.

Answer

Disable command logging so the maintenance output is easier to review.

Question 6

A security analyst is reviewing incident response procedures. Which three of the following activities are typically performed during the 'Containment, Eradication, and Recovery' phase of the incident response process? (Choose three.)

Accepted Answer

Rebuilding compromised servers from a secure baseline image. The 'Containment, Eradication, and Recovery' phase focuses on stopping the spread of an incident, removing the root cause, and restoring normal operations. Isolating affected systems (containment), removing malicious files and restoring from backups (eradication/recovery), and rebuilding from a secure baseline (recovery) are all core activities in this phase, as defined by NIST SP 800-61 Rev. 2 and CompTIA's incident response framework.

Answer

Performing forensic imaging of all systems before any action is taken

Answer

Conducting a lessons-learned meeting with the incident response team

Answer

Escalating the incident to law enforcement agencies

Question 7

A security operations center (SOC) analyst is investigating a potential malware outbreak. Which three of the following indicators of compromise (IOCs) would provide the strongest evidence of malicious activity? (Choose three.)

Accepted Answer

A registry key modification that creates a run key for persistence on a system. An outbound connection to a known C2 IP address is a strong indicator of compromise because it suggests the infected host is communicating with an attacker-controlled server to receive commands or exfiltrate data. This is a direct network-level IOC that is rarely seen in legitimate traffic, especially when the IP is listed in threat intelligence feeds as malicious. Similarly, a registry run key modification is a common persistence mechanism used by malware to survive reboots, and a file hash matching a known malware signature provides definitive evidence of malicious code. In contrast, user reports of slow computers, a single failed login, or increased legitimate web traffic from a new region are weak or contextual indicators and do not provide strong evidence of compromise.

Answer

A single failed login attempt on a user account from an internal IP address

Answer

A user reporting a slow computer that started after installing a software update

Answer

An increase in legitimate web traffic to a corporate website from a new geographic region

Question 8

A SOC analyst receives an alert from the EDR system indicating that the process 'C:\Program Files\Vendor\Updater.exe' attempted to modify the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key on a user's workstation. The analyst checks the file hash and finds it matches a known legitimate software updater. Which of the following actions is most appropriate for the analyst to take?

Accepted Answer

Investigate the user's recent activity and check for signs of process hollowing or DLL injection.. The EDR alert indicates a legitimate process (Updater.exe) modifying a critical persistence registry key (Run). Even with a known good hash, the process could be compromised via process hollowing or DLL injection, where malicious code runs under the guise of a trusted executable. Investigating user activity and checking for these attack techniques is the appropriate next step to confirm whether the behavior is benign or indicative of a threat.

Answer

Disable the software updater immediately to prevent further registry modifications.

Answer

Create an exception rule in the EDR to suppress future alerts for this process.

Answer

Isolate the workstation from the network and reimage the system immediately.

Question 9

A SOC analyst is reviewing logs from a Windows domain controller and notices a large number of failed logon attempts (Event ID 4625) from a single source IP address within a five-minute window. The account names used are random strings such as "a1b2c3", "x9y8z7", etc. The analyst then checks the source IP and finds it is a known external address from a foreign country. Which of the following is the most appropriate next step for the analyst to take?

Accepted Answer

Investigate whether any of the attempted accounts correspond to actual domain users.. The analyst must first determine if any of the randomly generated account names match existing domain user accounts. If a match is found, it indicates a targeted password-spraying or brute-force attack against valid accounts, requiring immediate account lockdown and credential reset. This investigation step aligns with the incident response process of identification before containment or escalation.

Answer

Immediately block the IP address at the perimeter firewall.

Answer

Run a full antivirus scan on the domain controller.

Answer

Notify the company's legal department for law enforcement involvement.

Question 10

A security analyst is responding to a potential ransomware incident on a Windows server that is still running. The analyst needs to preserve forensic evidence for analysis. Which of the following actions should the analyst perform first, based on the order of volatility?

Accepted Answer

Capture a full memory dump of the server. The order of volatility dictates that the most volatile data (memory) must be captured first because it contains critical evidence like running processes, network connections, and encryption keys that will be lost when the system is powered off. A full memory dump preserves this volatile data before any other actions that could alter the system state.

Answer

Shut down the server to prevent further damage

Answer

Create a forensic disk image of the hard drive

Answer

Run a full antivirus scan on the system

Question 11

A security analyst is monitoring logs from the cloud access security broker (CASB) and observes that a user account downloaded 500 GB of data from a highly sensitive SharePoint document library within a single hour. The user's historical baseline shows an average daily download of less than 10 MB. Additionally, the log shows the session originated from an IP address in a country where the company has no employees or business operations. Which of the following actions is the most appropriate for the analyst to take?

Accepted Answer

Initiate the organization's incident response process for a potential data exfiltration event.. The combination of a massive data download (500 GB vs. a 10 MB baseline) and a session originating from a country with no business presence strongly indicates a potential data exfiltration event. Initiating the incident response process ensures that the organization follows a structured, documented procedure to contain, analyze, and remediate the threat, preserving forensic evidence and coordinating response actions. The CASB log provides the initial indicators, but the incident response plan is the appropriate framework for handling such high-risk anomalies.

Answer

Immediately block the user account and the source IP address at the CASB.

Answer

Contact the user directly by phone to verify whether they initiated the download.

Answer

Disable the SharePoint document library and remove all user permissions to prevent further data loss.

Question 12

A security analyst in the SOC is investigating a potential DNS tunneling incident. The analyst has identified a workstation that is making thousands of DNS queries to an external domain with base64-encoded subdomains. The analyst suspects that sensitive files from the workstation are being exfiltrated by encoding their contents into the subdomains of the DNS queries. Which of the following log sources will provide the most definitive evidence to confirm that the contents of a specific sensitive file are being transmitted in the DNS queries?

Accepted Answer

A full packet capture of the network traffic from the workstation showing the complete DNS messages.. A full packet capture (PCAP) contains the complete DNS query and response messages, including the raw payload of the subdomain fields. This allows the analyst to extract the base64-encoded data from the subdomains and decode it to verify that it matches the contents of the suspected sensitive file. DNS server logs (option A) typically only record the queried domain names, not the full DNS message payload, and may truncate long subdomains. Process creation logs (option B) show which executable made the queries but not the data being sent. Firewall logs (option D) only show connection metadata (source, destination, port) and never the DNS query content.

Answer

The DNS server logs showing the queried domains and subdomains.

Answer

The workstation's process creation logs showing which process initiated the DNS queries.

Answer

The firewall logs showing outbound connections from the workstation to the external DNS server on port 53.

Question 13

A security analyst is reviewing network flow logs and notices a series of outbound connections from a single internal workstation to an external IP address on TCP port 443. The connections occur every 5 minutes, each lasting about 2 seconds, and the amount of data transferred per connection is consistently around 1 KB. The workstation's user reports no unusual activity. The analyst checks the host's EDR logs and sees no malicious processes or known indicators. Which type of activity is this pattern most consistent with?

Accepted Answer

Beaconing to a command-and-control server. This pattern is most consistent with beaconing to a command-and-control (C2) server because the connections are periodic (every 5 minutes), short-lived (2 seconds), and consistently transfer a small amount of data (~1 KB) over HTTPS (TCP 443). These characteristics—regular intervals, low data volume, and stealthy use of encrypted channels—are hallmarks of C2 beaconing used by malware to maintain persistence and receive instructions without raising immediate suspicion.

Answer

Normal software update check

Answer

DNS tunneling

Answer

Data exfiltration via HTTPS

Question 14

A security analyst in the SOC is reviewing an alert from the corporate VPN server. The alert indicates that user 'jsmith' authenticated successfully from an IP address in Brazil at 14:30 UTC. The analyst contacts jsmith, who confirms he is physically in the company's headquarters in Chicago and has not remotely accessed the VPN today. The VPN authentication logs show that jsmith's session used a valid smart card certificate for authentication. The analyst checks the certificate revocation list and finds that jsmith's certificate has not been revoked. Which of the following is the most likely explanation for this event?

Accepted Answer

The user's smart card and PIN were stolen, allowing an attacker to authenticate from Brazil.. The scenario describes a successful VPN authentication using a valid smart card certificate from a location (Brazil) that the legitimate user (jsmith) denies accessing. Since the certificate was not revoked and the smart card requires both the card and PIN for use, the most plausible explanation is that both were stolen, enabling an attacker to authenticate as jsmith. The certificate revocation list (CRL) check confirms the certificate is still valid, ruling out revocation-based defenses, and the user's physical presence in Chicago eliminates the possibility of a legitimate remote session.

Answer

An attacker performed a pass-the-hash attack using cached credentials from jsmith's workstation.

Answer

The VPN server's certificate was forged, allowing the attacker to intercept jsmith's credentials.

Answer

The user's account password was guessed through a brute-force attack and then used to create a new certificate.

Question 15

A security analyst receives an alert from the intrusion detection system indicating that a workstation in the finance department has established an outbound connection to a known malicious IP address using an encrypted protocol. The analyst verifies the alert and checks the user's activity logs, which show no legitimate business reason for the connection. According to the incident response process, what should the analyst do NEXT?

Accepted Answer

Isolate the workstation from the network to contain the threat.. According to the NIST SP 800-61 incident response process, containment is the immediate priority after verification to prevent further damage or data exfiltration. Since the workstation has an active encrypted outbound connection to a known malicious IP with no legitimate business reason, isolating the network interface (e.g., disabling the port, blocking the MAC address, or unplugging the cable) stops the threat from communicating while preserving the system state for later analysis. This aligns with the containment phase, which must precede eradication or full forensic analysis.

Answer

Begin the eradication phase by immediately reimaging the workstation.

Answer

Conduct a full forensic analysis of the workstation's hard drive.

Answer

Update the firewall rule to block all outbound traffic to the malicious IP.