SY0-701 Security Operations Practice Test 7 — 15 Questions

Question 1

An investigator needs a copy of a suspect laptop drive for analysis without changing the original media. What should be used?

Accepted Answer

A full forensic image taken with a write blocker. A full forensic image taken with a write blocker is the correct method because it creates a bit-for-bit copy of the entire drive, including all partitions, unallocated space, and metadata, without altering the original media. The write blocker hardware or software ensures that no write commands reach the suspect drive, preserving its integrity for legal and evidentiary purposes. This approach is required by forensic standards such as NIST SP 800-86 and ensures the copy is admissible as evidence.

Answer

A simple file copy of the user folder

Answer

A compressed archive of the desktop contents

Answer

The original drive mounted normally on the investigator machine

Question 2

A SIEM alert shows five failed logins to a SaaS admin portal from one IP, followed by a successful login from a new city three minutes later. Which two actions are the best next steps for the analyst to validate the event before containment? Select two.

Accepted Answer

Review the identity provider and MFA logs to confirm the successful login came from the same account and device context.. Reviewing the identity provider (IdP) and MFA logs allows the analyst to verify whether the successful login originated from the same user account and device context as the failed attempts. This step is critical to determine if the successful login was an attacker who bypassed MFA or a legitimate user who eventually succeeded, providing evidence of account compromise or a false positive.

Answer

Immediately disable the SaaS platform for every user until the investigation is finished.

Answer

Reimage the user’s laptop immediately to remove any possible malware.

Answer

Delete the failed login records to reduce noise in the SIEM.

Question 3

A workstation is suspected of malware infection, and it is still powered on and connected to the network. Which action best preserves volatile evidence before the system is shut down?

Accepted Answer

Capture memory and note running processes before taking further action.. Volatile evidence, such as the contents of RAM (running processes, network connections, open files), is lost when the system is powered off. Capturing a memory dump and recording running processes preserves this critical data for forensic analysis, allowing investigators to identify malware artifacts (e.g., injected code, hidden processes) that exist only in memory. This aligns with the NIST SP 800-86 forensic procedure of prioritizing volatile data collection before system shutdown.

Answer

Immediately power off the workstation to stop any malicious activity.

Answer

Run a full antivirus scan before documenting anything.

Answer

Delete temporary files to reduce the chance of reinfection.

Question 4

After restoring a virtual file server from backup, users can log in and browse shares, but finance says the last day's edits are missing. Which two steps should the administrator take before declaring recovery complete? Select two.

Accepted Answer

Verify the restore point meets the required recovery point objective and the business expects the data loss window.. The Recovery Point Objective (RPO) defines the maximum acceptable data loss. If the restore point is from before the last day's edits, the administrator must confirm that this data loss window is acceptable to the business. Option B is correct because application-consistent backups often require replaying transaction logs (e.g., SQL Server VSS writer logs) to bring the database to the latest committed state; skipping this step leaves the data incomplete.

Answer

Rebuild the server from scratch without checking the backup timestamp.

Answer

Disable all backup jobs until the next maintenance window.

Answer

Change the DNS records so users point to a different server name.

Question 5

A firewall ACL must be modified in production to allow a vendor update server. The team wants to minimize the chance of accidentally blocking payroll traffic. Which change-management step is best before applying the rule?

Accepted Answer

Test the proposed rule in a staged policy set and keep a rollback plan ready.. Testing the proposed rule in a staged policy set allows the team to verify that the new ACL entry does not inadvertently match and drop payroll traffic before it is applied to the production firewall. Keeping a rollback plan ready ensures that if the rule causes unexpected blocking, the previous ACL can be restored immediately, minimizing downtime. This aligns with the change-management principle of validating changes in a controlled environment to prevent service disruption.

Answer

Apply the rule immediately and monitor the help desk for complaints.

Answer

Remove all deny rules temporarily so the vendor traffic can pass cleanly.

Answer

Disable logging during the change to avoid slowing down the firewall.

Question 6

A Windows server is still running after suspected compromise. Before it is powered down, which two volatile data sources should be collected first? Select two.

Accepted Answer

A memory capture or RAM image from the live system.. A memory capture (RAM image) preserves volatile data that is lost on power-down, including running processes, open network connections, encryption keys, and malware that exists only in memory. This is critical for forensic analysis of a live system suspected of compromise, as it captures the system state at the time of collection.

Answer

A full disk image from the powered-off server.

Answer

A hardware inventory report from the asset management database.

Answer

A screenshot of the server’s desktop wallpaper for reference.

Question 7

A company-owned laptop is being transferred from the incident site to the evidence locker for a theft investigation. Which two actions best support chain of custody during transport? Select two.

Accepted Answer

Place the device in a tamper-evident evidence bag or seal. Placing the device in a tamper-evident evidence bag or seal provides a physical barrier that immediately reveals any unauthorized access during transport. This is a foundational chain-of-custody control that preserves the integrity of the evidence by making tampering detectable, which is critical for admissibility in legal proceedings.

Answer

Leave the device unsealed so legal staff can inspect it quickly

Answer

Boot the laptop to confirm the user’s files are still present

Answer

Use a personal note app instead of formal transfer documentation

Question 8

After restoring a virtual file server from backup, users can browse folders, but an accounting application reports missing recent transactions. What should the administrator do next?

Accepted Answer

Verify the restore in an isolated test environment and compare application data consistency. The correct next step is to verify the restore in an isolated test environment and compare application data consistency. Although the file server is reachable and folders appear intact, the accounting application's missing recent transactions indicate that the restored data may be stale or incomplete. Testing in isolation ensures the application's database or transaction logs are consistent with the backup point before returning the server to production, preventing data corruption or loss.

Answer

Mark the restore complete because the file server is reachable

Answer

Immediately run a new full backup over the restored server

Answer

Disable the accounting application permanently to prevent further inconsistency

Question 9

An investigator receives a suspect laptop drive that may be used in court. Which approach best supports a forensically sound image while protecting the original media?

Accepted Answer

Use a hardware write blocker and create a bit-by-bit forensic image with hashes.. Forensic best practice requires preserving the original media in an unaltered state. A hardware write blocker physically prevents any write commands from reaching the drive, ensuring the original evidence is not modified. Creating a bit-by-bit forensic image (e.g., with `dd` or FTK Imager) captures the entire drive, including slack space and unallocated sectors, and generating cryptographic hashes (SHA-256 or MD5) before and after imaging verifies the image's integrity for court admissibility.

Answer

Mount the drive read-write so the investigator can browse it quickly.

Answer

Copy only the user profile folders with a file manager to save time.

Answer

Boot the laptop normally and use backup software to duplicate the disk.

Question 10

An administrator pushed a firewall rule change to allow a new vendor IP range during business hours. Minutes later, payroll users lost access to an internal service. Which change management practice would have best reduced the impact?

Accepted Answer

Test the change in a staging environment and include a rollback plan in the request.. Testing the change in a staging environment first would have revealed any unintended side effects, such as ACL conflicts that blocked payroll traffic. Including a rollback plan ensures that if the change causes issues in production, the administrator can quickly revert the firewall rule to restore service. This aligns with the change management process of minimizing impact through controlled testing and contingency planning.

Answer

Apply changes directly in production so they take effect as quickly as possible.

Answer

Avoid documenting the change until after the maintenance window ends.

Answer

Use verbal approval from the payroll manager instead of the normal ticket process.

Question 11

A SIEM alert shows five failed logins to an administrator account, followed by a successful login from a new city three minutes later. The account owner says they did not sign in. What should the analyst do first?

Accepted Answer

Temporarily disable the account and open an incident for investigation.. The alert shows a classic indicator of account compromise: multiple failed logins followed by a successful authentication from an unusual location. The account owner's denial of the login confirms unauthorized access, so the immediate priority is to contain the threat by disabling the account and opening an incident for formal investigation. This aligns with the NIST SP 800-61 incident response process, specifically the containment phase before eradication or recovery.

Answer

Ignore the alert because the login eventually succeeded.

Answer

Reset the password only and close the alert.

Answer

Reboot the user's laptop to clear any malicious activity.

Question 12

You are handed a company laptop suspected in an insider theft case. Legal says the evidence may be needed in court. Which action best preserves admissibility?

Accepted Answer

Create a forensic image using a write blocker and record hash values.. Creating a forensic image with a write blocker ensures the original evidence remains unaltered, preserving its integrity for court admissibility. Recording hash values (e.g., SHA-256) provides a cryptographic fingerprint that can later verify the image is an exact copy, meeting legal standards for chain of custody and authenticity.

Answer

Browse the drive directly on the original laptop to identify the most relevant files.

Answer

Email the user asking them to return any copies they may have made.

Answer

Mount the drive read-write so searching and exporting data will be faster.

Question 13

A virtual file server was restored from last night’s backup. The service is online, but some finance users report missing spreadsheet changes and a few files show a 'recovered copy' timestamp. Which two checks should be completed before the team accepts the restore as successful? Select two.

Accepted Answer

Compare restored data against backup hashes or a manifest to verify that the copy is complete and uncorrupted.. Comparing restored data against backup hashes or a manifest ensures the data integrity and completeness of the restore process. Even though the file server is online, missing spreadsheet changes and 'recovered copy' timestamps suggest possible corruption or incomplete restoration. Verifying hashes (e.g., SHA-256) against a known-good manifest confirms that every file was restored without bit-rot or truncation, which is a standard post-restore validation step in backup and recovery procedures.

Answer

Assume the restore is acceptable because the file server is online and users can browse shares.

Answer

Delete the previous night’s backup so the team will not accidentally restore it again.

Answer

Expose the restored server directly to the internet so remote users can test it faster.

Question 14

After a new MFA policy rollout, the SIEM generates an alert for five failed logins to a SaaS admin portal from one IP, followed by a successful login to the same account from an IP in another country. The account owner says they were in meetings all day. What should the analyst do first?

Accepted Answer

Correlate identity provider, VPN, and endpoint logs to validate whether the activity matches the user's normal pattern.. The alert shows a successful login after five failures from a different country, which is a classic indicator of a potential account takeover. The analyst must correlate identity provider logs (e.g., Okta, Microsoft Entra ID) for authentication details, VPN logs for network origination, and endpoint logs for device posture to determine if the successful login matches the user's normal behavior. This step validates whether the activity is legitimate or malicious before taking any irreversible action.

Answer

Disable the account immediately without checking any other logs.

Answer

Delete the alert because MFA was enabled and the login eventually succeeded.

Answer

Reimage the user's laptop to remove any possible malware right away.

Question 15

A firewall rule change was implemented directly in production to allow a new vendor IP range. Within minutes, several internal services became unreachable because the rule order changed unexpectedly. Which change-management practice would have most likely prevented this outage?

Accepted Answer

Testing the change in a staging environment and approving it through a peer-reviewed change process before production.. Implementing the change in a staging environment first allows validation of the rule order and its impact on traffic flow without affecting production. A peer-reviewed change process ensures that the rule insertion point (e.g., before a deny-all or after a permit statement) is verified, preventing the accidental reordering that caused the outage. This aligns with the change-management principle of testing in a representative environment before production deployment.

Answer

Applying the rule during business hours so the team can respond faster if something breaks.

Answer

Making the change first in production because that is the only environment that matters.

Answer

Documenting the outage after the vendor confirms their IP range is valid.