SY0-701 Security Operations Practice Test 4 — 15 Questions

Question 1

A privileged account is used on a jump box at 02:15, and the SIEM shows multiple interactive logons from the same account to different servers within 10 minutes. The administrator says they used a password vault for the session. Which log source best confirms whether the access was authorized?

Accepted Answer

Privileged access management or password vault audit logs. The privileged access management (PAM) or password vault audit logs are the definitive source because they record exactly when a password was checked out, which user performed the checkout, and the specific session ID or ticket associated with the jump box use. Since the administrator claims the password vault was used, these logs will show the checkout event at 02:15 and the subsequent interactive logons, confirming whether the vault authorized the session. No other log source can tie the authentication to the vault's approval process.

Answer

DHCP lease logs from the jump box subnet

Answer

Printer server logs for the operations department

Answer

Web proxy logs for outbound browsing activity

Question 2

After confirming malicious activity on a workstation, the incident lead wants the system cleaned up quickly. The analyst has not yet collected any volatile data. What should the analyst do before remediation begins?

Accepted Answer

Capture volatile evidence such as memory and running process information before changing the system.. Option A is correct because volatile data (e.g., memory contents, running processes, network connections) is lost when the system is powered off or changed. The analyst must capture this evidence first to preserve forensic artifacts that can identify the root cause, scope, and indicators of compromise (IOCs) before remediation alters the system state.

Answer

Immediately uninstall every suspicious application and delete related files.

Answer

Restore the workstation from backup before documenting the incident.

Answer

Close the incident because the malicious activity has already been confirmed.

Question 3

After restoring a virtualized file server from backup, users can log in but the accounting application returns database consistency errors. What should you do next?

Accepted Answer

Verify the restore in an isolated environment and confirm application-level integrity and permissions.. Option B is correct because the restore process must be validated beyond basic boot and login functionality. Database consistency errors indicate that the application-level data integrity was compromised during the restore, likely due to missing or inconsistent database files, permissions, or transaction logs. Verifying the restore in an isolated environment allows you to test application-specific integrity checks (e.g., DBCC CHECKDB for SQL Server) and confirm that file permissions and security descriptors are intact before returning the server to production.

Answer

Declare the restore successful because the virtual machine boots and users can sign in.

Answer

Increase the backup retention period and wait for the next scheduled full backup.

Answer

Delete the backup set to prevent confusion with the restored data.

Question 4

A web application was updated at 10:00. At 10:05, the SIEM reports a sharp rise in HTTP 500 errors and WAF blocks from the same source range. The application owner says customers are seeing failures only on the new checkout page. What is the best next step?

Accepted Answer

Correlate deployment, WAF, and application logs to determine whether the release or an attack caused the failures.. Option B is correct because the temporal correlation between the deployment at 10:00 and the spike in HTTP 500 errors and WAF blocks at 10:05 strongly suggests a causal relationship. The best next step is to correlate deployment logs, WAF logs, and application logs to determine whether the new checkout page code introduced a bug (causing 500 errors) or whether an attacker is exploiting a vulnerability in the new code (triggering WAF blocks). This diagnostic step avoids premature conclusions and ensures the root cause is identified before any remediation.

Answer

Close the incident because the WAF is blocking the suspicious traffic.

Answer

Disable all customer accounts until the failures disappear from the dashboard.

Answer

Increase the server's disk space and memory thresholds immediately.

Question 5

EDR flags a word processor that launched encoded PowerShell and then made an outbound HTTPS connection to a rare domain. Which two actions should the analyst take first from the EDR console? Select two.

Accepted Answer

Isolate the endpoint from the network to stop further communication and lateral movement.. Option A is correct because isolating the endpoint from the network immediately stops the outbound HTTPS connection to the rare domain, preventing data exfiltration and blocking potential lateral movement. This is a critical first step in containment, as the encoded PowerShell and rare domain strongly suggest a malicious payload or C2 communication.

Answer

Uninstall the word processor immediately because it is the process that launched PowerShell.

Answer

Reboot the laptop right away to clear the encoded PowerShell process from memory.

Answer

Whitelist the rare domain temporarily to see whether the connection is business-related.

Question 6

Security receives a company laptop used in an insider theft investigation. A manager wants the device moved to another office for review by legal staff. Which action best supports chain of custody?

Accepted Answer

Place it in a labeled evidence bag, record the collector, time, location, and condition, and require signatures for each transfer.. Option B is correct because it follows the formal chain of custody process required for evidence handling. Placing the laptop in a labeled evidence bag with documented collector, time, location, and condition, along with requiring signatures for each transfer, ensures the integrity and admissibility of evidence by creating an unbroken audit trail. This aligns with NIST SP 800-86 and forensic best practices for maintaining custody of digital evidence.

Answer

Power on the laptop to confirm the user profile and recent activity before transport.

Answer

Remove the drive and clone it without documenting the collection process.

Answer

Email a photo of the laptop to legal and leave the original on a desk.

Question 7

After restoring a virtual file server from last night’s backup, users can browse shares, but finance reports that several spreadsheet edits from yesterday are missing. What should the administrator verify next before declaring the restore successful?

Accepted Answer

Whether the backup job used the correct restore point and included the needed transaction logs.. Option A is correct because the missing spreadsheet edits indicate that the backup may have been taken before those changes were committed. The administrator must verify that the restore point includes the necessary transaction logs (e.g., from a VSS-aware backup or application-consistent snapshot) to recover the most recent data. Without these logs, any edits made after the last full backup are lost, so confirming the correct restore point and log inclusion is the next logical step before declaring success.

Answer

Whether the file server antivirus signatures are fully up to date.

Answer

Whether the share permissions were tightened during the restore.

Answer

Whether the virtual machine has enough CPU and memory allocated.

Question 8

A firewall rule was changed in production to allow a new vendor IP range, and payroll users immediately lost access to an internal service. Which two change-management practices would have reduced the risk of this outage? Select two.

Accepted Answer

Test the rule in a staging environment with representative traffic before production deployment.. Option A is correct because testing the firewall rule in a staging environment with representative traffic allows you to validate that the new vendor IP range does not inadvertently block or conflict with existing rules before impacting production. This practice catches misconfigurations—such as an overly broad permit that shadows a deny rule for payroll users—without risking service disruption. Staging mirrors production ACL logic, so you can verify that the rule order and match criteria (e.g., source IP, destination port) behave as intended.

Answer

Make the change during the busiest business hour so the team can observe the effect immediately.

Answer

Remove logging on the firewall so only the new rule is visible during troubleshooting.

Answer

Skip approval because the vendor was already known to the organization.

Question 9

An investigator needs a copy of a suspect laptop drive for analysis without changing the original media. What should be used?

Accepted Answer

A full forensic image taken with a write blocker. A full forensic image taken with a write blocker is the correct method because it creates a bit-for-bit copy of the entire drive, including all partitions, unallocated space, and metadata, without altering the original media. The write blocker hardware or software ensures that no write commands reach the suspect drive, preserving its integrity for legal and evidentiary purposes. This approach is required by forensic standards such as NIST SP 800-86 and ensures the copy is admissible as evidence.

Answer

A simple file copy of the user folder

Answer

A compressed archive of the desktop contents

Answer

The original drive mounted normally on the investigator machine

Question 10

A SIEM alert shows five failed logins to a SaaS admin portal from one IP, followed by a successful login from a new city three minutes later. Which two actions are the best next steps for the analyst to validate the event before containment? Select two.

Accepted Answer

Review the identity provider and MFA logs to confirm the successful login came from the same account and device context.. Option A is correct because reviewing the identity provider (IdP) and MFA logs allows the analyst to verify whether the successful login originated from the same user account and device context as the failed attempts. This step is critical to determine if the successful login was an attacker who bypassed MFA or a legitimate user who eventually succeeded, providing evidence of account compromise or a false positive.

Answer

Immediately disable the SaaS platform for every user until the investigation is finished.

Answer

Reimage the user’s laptop immediately to remove any possible malware.

Answer

Delete the failed login records to reduce noise in the SIEM.

Question 11

A workstation is suspected of malware infection, and it is still powered on and connected to the network. Which action best preserves volatile evidence before the system is shut down?

Accepted Answer

Capture memory and note running processes before taking further action.. Option B is correct because volatile evidence, such as the contents of RAM (running processes, network connections, open files), is lost when the system is powered off. Capturing a memory dump and recording running processes preserves this critical data for forensic analysis, allowing investigators to identify malware artifacts (e.g., injected code, hidden processes) that exist only in memory. This aligns with the NIST SP 800-86 forensic procedure of prioritizing volatile data collection before system shutdown.

Answer

Immediately power off the workstation to stop any malicious activity.

Answer

Run a full antivirus scan before documenting anything.

Answer

Delete temporary files to reduce the chance of reinfection.

Question 12

After restoring a virtual file server from backup, users can log in and browse shares, but finance says the last day's edits are missing. Which two steps should the administrator take before declaring recovery complete? Select two.

Accepted Answer

Verify the restore point meets the required recovery point objective and the business expects the data loss window.. Option A is correct because the Recovery Point Objective (RPO) defines the maximum acceptable data loss. If the restore point is from before the last day's edits, the administrator must confirm that this data loss window is acceptable to the business. Option B is correct because application-consistent backups often require replaying transaction logs (e.g., SQL Server VSS writer logs) to bring the database to the latest committed state; skipping this step leaves the data incomplete.

Answer

Rebuild the server from scratch without checking the backup timestamp.

Answer

Disable all backup jobs until the next maintenance window.

Answer

Change the DNS records so users point to a different server name.

Question 13

A firewall ACL must be modified in production to allow a vendor update server. The team wants to minimize the chance of accidentally blocking payroll traffic. Which change-management step is best before applying the rule?

Accepted Answer

Test the proposed rule in a staged policy set and keep a rollback plan ready.. Option B is correct because testing the proposed rule in a staged policy set allows the team to verify that the new ACL entry does not inadvertently match and drop payroll traffic before it is applied to the production firewall. Keeping a rollback plan ready ensures that if the rule causes unexpected blocking, the previous ACL can be restored immediately, minimizing downtime. This aligns with the change-management principle of validating changes in a controlled environment to prevent service disruption.

Answer

Apply the rule immediately and monitor the help desk for complaints.

Answer

Remove all deny rules temporarily so the vendor traffic can pass cleanly.

Answer

Disable logging during the change to avoid slowing down the firewall.

Question 14

A Windows server is still running after suspected compromise. Before it is powered down, which two volatile data sources should be collected first? Select two.

Accepted Answer

A memory capture or RAM image from the live system.. A memory capture (RAM image) preserves volatile data that is lost on power-down, including running processes, open network connections, encryption keys, and malware that exists only in memory. This is critical for forensic analysis of a live system suspected of compromise, as it captures the system state at the time of collection.

Answer

A full disk image from the powered-off server.

Answer

A hardware inventory report from the asset management database.

Answer

A screenshot of the server’s desktop wallpaper for reference.

Question 15

A company-owned laptop is being transferred from the incident site to the evidence locker for a theft investigation. Which two actions best support chain of custody during transport? Select two.

Accepted Answer

Place the device in a tamper-evident evidence bag or seal. Option A is correct because placing the device in a tamper-evident evidence bag or seal provides a physical barrier that immediately reveals any unauthorized access during transport. This is a foundational chain-of-custody control that preserves the integrity of the evidence by making tampering detectable, which is critical for admissibility in legal proceedings.

Answer

Leave the device unsealed so legal staff can inspect it quickly

Answer

Boot the laptop to confirm the user’s files are still present

Answer

Use a personal note app instead of formal transfer documentation