SY0-701 Security Operations Practice Test 6 — 15 Questions

Question 1

A security analyst is reviewing firewall logs and notices repeated connection attempts from a single external IP address to multiple internal IP addresses on TCP port 22 (SSH). Each attempt uses a different username but the same password: 'Spring2024!'. The attempts occur sporadically over a 12-hour period. Which type of attack is most likely being observed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Password spraying attack. This is a password spraying attack because the attacker uses a single common password ('Spring2024!') against multiple usernames across different internal IP addresses, attempting to avoid account lockout by spreading attempts over time and targets. Unlike brute-force or dictionary attacks that focus many passwords against a single account, password spraying targets many accounts with a few weak passwords, making it harder to detect via failed login thresholds.

Answer

Brute-force attack

Answer

Dictionary attack

Answer

Man-in-the-middle attack

Question 2

A SOC analyst detects that a user's workstation is sending large volumes of data to an unusual external IP address during non-business hours. The analyst has already isolated the workstation by disconnecting it from the network. What is the NEXT step in the incident response process?

Accepted Answer

Perform a forensic analysis of the workstation to collect evidence. After isolating the workstation, the next step in the incident response process is to perform forensic analysis to collect evidence. This aligns with the NIST SP 800-61 framework, where containment (isolation) is followed by eradication and recovery, but evidence collection must occur before any destructive actions like reimaging. The forensic analysis preserves volatile data (e.g., memory, network connections) and non-volatile data (e.g., disk artifacts) to determine the scope and cause of the data exfiltration.

Answer

Reimage the workstation to remove any malware

Answer

Reset the user's password to prevent further unauthorized access

Answer

Notify law enforcement immediately

Question 3

A security analyst is reviewing authentication logs and observes multiple failed login attempts for a single user account occurring within a short timeframe, followed by a successful login from an IP address located in a country where the user has never traveled. The failed attempts originate from various IP addresses and use different passwords. Which type of attack has most likely occurred?

Accepted Answer

Brute-force attack. (Brute-force attack) because the log shows multiple failed login attempts from various IP addresses using different passwords, followed by a successful login from an unfamiliar country. This pattern indicates a distributed brute-force attack where the attacker systematically tries many passwords against a single account, often using a botnet or proxy rotation to evade IP-based rate limiting. The successful login from a foreign IP confirms the attacker eventually guessed the correct password.

Answer

Credential stuffing

Answer

Password spraying

Answer

Dictionary attack

Question 4

A security analyst notices unusual outbound traffic from a server that normally only communicates with internal clients. The traffic is encrypted and goes to an external IP address not on any blocklists. The analyst also finds a new scheduled task on the server that runs a PowerShell script. Which of the following best describes the analyst's immediate next step in the incident response process?

Accepted Answer

Disconnect the server from the network to contain the potential breach.. According to standard incident response frameworks such as NIST SP 800-61, containment is one of the first and most critical steps after detecting a potential compromise. The unusual encrypted outbound traffic and the unauthorized scheduled task are strong indicators of compromise (IOCs). Disconnecting the server from the network immediately helps prevent further data exfiltration, lateral movement, or additional damage. Other actions, such as running a scan, wiping the server, or notifying legal, are performed later in the process after containment and evidence preservation.

Answer

Wipe the server and restore from a known good backup.

Answer

Run a full antivirus scan on the server to identify malware.

Answer

Inform the legal department and law enforcement.

Question 5

A security analyst at a manufacturing company notices multiple workstations generating high volumes of encrypted outbound traffic and displaying ransom notes. The analyst suspects a ransomware outbreak. According to the incident response process, which of the following should the analyst perform FIRST?

Accepted Answer

Isolate the affected workstations from the network by disconnecting their network cables and disabling Wi-Fi.. The first priority in a suspected ransomware outbreak is containment to prevent lateral spread and further encryption. Disconnecting network cables and disabling Wi-Fi immediately isolates the affected workstations from the network, stopping the ransomware from communicating with its command-and-control (C2) server or encrypting additional systems. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Answer

Immediately wipe the hard drives of all affected workstations and reinstall the operating system.

Answer

Contact local law enforcement to report the ransomware incident and request a forensic investigation.

Answer

Conduct a full forensic analysis of one affected workstation to determine the ransomware variant and entry vector.

Question 6

A security analyst detects unusual outbound traffic from a workstation to an external IP address known for command and control. The analyst has verified the alert and wants to contain the threat. According to the NIST SP 800-61 incident response process, which of the following steps should the analyst take FIRST?

Accepted Answer

Disconnect the workstation from the network. According to NIST SP 800-61, the first step in containment during incident response is to prevent further damage by isolating the compromised system. Disconnecting the workstation from the network immediately stops the outbound command-and-control traffic, preventing data exfiltration and further compromise. This aligns with the 'containment' phase before any analysis or remediation occurs.

Answer

Perform a forensic analysis of the workstation

Answer

Reimage the workstation

Answer

Alert the system administrator

Question 7

During malware response on a finance workstation, the system is still powered on and connected. The manager asks whether you can just reboot it to stop the issue. What is the best next step?

Accepted Answer

Capture volatile evidence and document the system state before containment actions.. In incident response, the first priority when a system is still powered on is to capture volatile evidence (e.g., memory contents, running processes, network connections) before any containment actions like rebooting. Rebooting would destroy this critical data, which may be essential for forensic analysis and understanding the malware's behavior. The order of volatility (RFC 3227) dictates that volatile data must be collected first to preserve evidence integrity.

Answer

Reboot immediately to prevent any further damage from the suspected malware.

Answer

Copy suspicious files to a shared drive and continue normal operations.

Answer

Run a full disk cleanup to remove temporary files and reduce risk.

Question 8

A privileged account is used on a jump box at 02:15, and the SIEM shows multiple interactive logons from the same account to different servers within 10 minutes. The administrator says they used a password vault for the session. Which log source best confirms whether the access was authorized?

Accepted Answer

Privileged access management or password vault audit logs. The privileged access management (PAM) or password vault audit logs are the definitive source because they record exactly when a password was checked out, which user performed the checkout, and the specific session ID or ticket associated with the jump box use. Since the administrator claims the password vault was used, these logs will show the checkout event at 02:15 and the subsequent interactive logons, confirming whether the vault authorized the session. No other log source can tie the authentication to the vault's approval process.

Answer

DHCP lease logs from the jump box subnet

Answer

Printer server logs for the operations department

Answer

Web proxy logs for outbound browsing activity

Question 9

After confirming malicious activity on a workstation, the incident lead wants the system cleaned up quickly. The analyst has not yet collected any volatile data. What should the analyst do before remediation begins?

Accepted Answer

Capture volatile evidence such as memory and running process information before changing the system.. Volatile data (e.g., memory contents, running processes, network connections) is lost when the system is powered off or changed. The analyst must capture this evidence first to preserve forensic artifacts that can identify the root cause, scope, and indicators of compromise (IOCs) before remediation alters the system state.

Answer

Immediately uninstall every suspicious application and delete related files.

Answer

Restore the workstation from backup before documenting the incident.

Answer

Close the incident because the malicious activity has already been confirmed.

Question 10

After restoring a virtualized file server from backup, users can log in but the accounting application returns database consistency errors. What should you do next?

Accepted Answer

Verify the restore in an isolated environment and confirm application-level integrity and permissions.. The restore process must be validated beyond basic boot and login functionality. Database consistency errors indicate that the application-level data integrity was compromised during the restore, likely due to missing or inconsistent database files, permissions, or transaction logs. Verifying the restore in an isolated environment allows you to test application-specific integrity checks (e.g., DBCC CHECKDB for SQL Server) and confirm that file permissions and security descriptors are intact before returning the server to production.

Answer

Declare the restore successful because the virtual machine boots and users can sign in.

Answer

Increase the backup retention period and wait for the next scheduled full backup.

Answer

Delete the backup set to prevent confusion with the restored data.

Question 11

A web application was updated at 10:00. At 10:05, the SIEM reports a sharp rise in HTTP 500 errors and WAF blocks from the same source range. The application owner says customers are seeing failures only on the new checkout page. What is the best next step?

Accepted Answer

Correlate deployment, WAF, and application logs to determine whether the release or an attack caused the failures.. The temporal correlation between the deployment at 10:00 and the spike in HTTP 500 errors and WAF blocks at 10:05 strongly suggests a causal relationship. The best next step is to correlate deployment logs, WAF logs, and application logs to determine whether the new checkout page code introduced a bug (causing 500 errors) or whether an attacker is exploiting a vulnerability in the new code (triggering WAF blocks). This diagnostic step avoids premature conclusions and ensures the root cause is identified before any remediation.

Answer

Close the incident because the WAF is blocking the suspicious traffic.

Answer

Disable all customer accounts until the failures disappear from the dashboard.

Answer

Increase the server's disk space and memory thresholds immediately.

Question 12

EDR flags a word processor that launched encoded PowerShell and then made an outbound HTTPS connection to a rare domain. Which two actions should the analyst take first from the EDR console? Select two.

Accepted Answer

Isolate the endpoint from the network to stop further communication and lateral movement.. Isolating the endpoint from the network immediately stops the outbound HTTPS connection to the rare domain, preventing data exfiltration and blocking potential lateral movement. This is a critical first step in containment, as the encoded PowerShell and rare domain strongly suggest a malicious payload or C2 communication.

Answer

Uninstall the word processor immediately because it is the process that launched PowerShell.

Answer

Reboot the laptop right away to clear the encoded PowerShell process from memory.

Answer

Whitelist the rare domain temporarily to see whether the connection is business-related.

Question 13

Security receives a company laptop used in an insider theft investigation. A manager wants the device moved to another office for review by legal staff. Which action best supports chain of custody?

Accepted Answer

Place it in a labeled evidence bag, record the collector, time, location, and condition, and require signatures for each transfer.. It follows the formal chain of custody process required for evidence handling. Placing the laptop in a labeled evidence bag with documented collector, time, location, and condition, along with requiring signatures for each transfer, ensures the integrity and admissibility of evidence by creating an unbroken audit trail. This aligns with NIST SP 800-86 and forensic best practices for maintaining custody of digital evidence.

Answer

Power on the laptop to confirm the user profile and recent activity before transport.

Answer

Remove the drive and clone it without documenting the collection process.

Answer

Email a photo of the laptop to legal and leave the original on a desk.

Question 14

After restoring a virtual file server from last night’s backup, users can browse shares, but finance reports that several spreadsheet edits from yesterday are missing. What should the administrator verify next before declaring the restore successful?

Accepted Answer

Whether the backup job used the correct restore point and included the needed transaction logs.. The missing spreadsheet edits indicate that the backup may have been taken before those changes were committed. The administrator must verify that the restore point includes the necessary transaction logs (e.g., from a VSS-aware backup or application-consistent snapshot) to recover the most recent data. Without these logs, any edits made after the last full backup are lost, so confirming the correct restore point and log inclusion is the next logical step before declaring success.

Answer

Whether the file server antivirus signatures are fully up to date.

Answer

Whether the share permissions were tightened during the restore.

Answer

Whether the virtual machine has enough CPU and memory allocated.

Question 15

A firewall rule was changed in production to allow a new vendor IP range, and payroll users immediately lost access to an internal service. Which two change-management practices would have reduced the risk of this outage? Select two.

Accepted Answer

Test the rule in a staging environment with representative traffic before production deployment.. Testing the firewall rule in a staging environment with representative traffic allows you to validate that the new vendor IP range does not inadvertently block or conflict with existing rules before impacting production. This practice catches misconfigurations—such as an overly broad permit that shadows a deny rule for payroll users—without risking service disruption. Staging mirrors production ACL logic, so you can verify that the rule order and match criteria (e.g., source IP, destination port) behave as intended.

Answer

Make the change during the busiest business hour so the team can observe the effect immediately.

Answer

Remove logging on the firewall so only the new rule is visible during troubleshooting.

Answer

Skip approval because the vendor was already known to the organization.