SY0-701 Security Operations Practice Test 7 — 15 Questions

Question 1

After restoring a virtual file server from backup, users can log in and browse shares, but finance says the last day's edits are missing. Which two steps should the administrator take before declaring recovery complete? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify the restore point meets the required recovery point objective and the business expects the data loss window.. The Recovery Point Objective (RPO) defines the maximum acceptable data loss. If the restore point is from before the last day's edits, the administrator must confirm that this data loss window is acceptable to the business. Option B is correct because application-consistent backups often require replaying transaction logs (e.g., SQL Server VSS writer logs) to bring the database to the latest committed state; skipping this step leaves the data incomplete.

Answer

Rebuild the server from scratch without checking the backup timestamp.

Answer

Disable all backup jobs until the next maintenance window.

Answer

Change the DNS records so users point to a different server name.

Question 2

A firewall ACL must be modified in production to allow a vendor update server. The team wants to minimize the chance of accidentally blocking payroll traffic. Which change-management step is best before applying the rule?

Accepted Answer

Test the proposed rule in a staged policy set and keep a rollback plan ready.. Testing the proposed rule in a staged policy set allows the team to verify that the new ACL entry does not inadvertently match and drop payroll traffic before it is applied to the production firewall. Keeping a rollback plan ready ensures that if the rule causes unexpected blocking, the previous ACL can be restored immediately, minimizing downtime. This aligns with the change-management principle of validating changes in a controlled environment to prevent service disruption.

Answer

Apply the rule immediately and monitor the help desk for complaints.

Answer

Remove all deny rules temporarily so the vendor traffic can pass cleanly.

Answer

Disable logging during the change to avoid slowing down the firewall.

Question 3

A Windows server is still running after suspected compromise. Before it is powered down, which two volatile data sources should be collected first? Select two.

Accepted Answer

A memory capture or RAM image from the live system.. A memory capture (RAM image) preserves volatile data that is lost on power-down, including running processes, open network connections, encryption keys, and malware that exists only in memory. This is critical for forensic analysis of a live system suspected of compromise, as it captures the system state at the time of collection.

Answer

A full disk image from the powered-off server.

Answer

A hardware inventory report from the asset management database.

Answer

A screenshot of the server’s desktop wallpaper for reference.

Question 4

A company-owned laptop is being transferred from the incident site to the evidence locker for a theft investigation. Which two actions best support chain of custody during transport? Select two.

Accepted Answer

Place the device in a tamper-evident evidence bag or seal. Placing the device in a tamper-evident evidence bag or seal provides a physical barrier that immediately reveals any unauthorized access during transport. This is a foundational chain-of-custody control that preserves the integrity of the evidence by making tampering detectable, which is critical for admissibility in legal proceedings.

Answer

Leave the device unsealed so legal staff can inspect it quickly

Answer

Boot the laptop to confirm the user’s files are still present

Answer

Use a personal note app instead of formal transfer documentation

Question 5

After restoring a virtual file server from backup, users can browse folders, but an accounting application reports missing recent transactions. What should the administrator do next?

Accepted Answer

Verify the restore in an isolated test environment and compare application data consistency. The correct next step is to verify the restore in an isolated test environment and compare application data consistency. Although the file server is reachable and folders appear intact, the accounting application's missing recent transactions indicate that the restored data may be stale or incomplete. Testing in isolation ensures the application's database or transaction logs are consistent with the backup point before returning the server to production, preventing data corruption or loss.

Answer

Mark the restore complete because the file server is reachable

Answer

Immediately run a new full backup over the restored server

Answer

Disable the accounting application permanently to prevent further inconsistency

Question 6

An investigator receives a suspect laptop drive that may be used in court. Which approach best supports a forensically sound image while protecting the original media?

Accepted Answer

Use a hardware write blocker and create a bit-by-bit forensic image with hashes.. Forensic best practice requires preserving the original media in an unaltered state. A hardware write blocker physically prevents any write commands from reaching the drive, ensuring the original evidence is not modified. Creating a bit-by-bit forensic image (e.g., with `dd` or FTK Imager) captures the entire drive, including slack space and unallocated sectors, and generating cryptographic hashes (SHA-256 or MD5) before and after imaging verifies the image's integrity for court admissibility.

Answer

Mount the drive read-write so the investigator can browse it quickly.

Answer

Copy only the user profile folders with a file manager to save time.

Answer

Boot the laptop normally and use backup software to duplicate the disk.

Question 7

An administrator pushed a firewall rule change to allow a new vendor IP range during business hours. Minutes later, payroll users lost access to an internal service. Which change management practice would have best reduced the impact?

Accepted Answer

Test the change in a staging environment and include a rollback plan in the request.. Testing the change in a staging environment first would have revealed any unintended side effects, such as ACL conflicts that blocked payroll traffic. Including a rollback plan ensures that if the change causes issues in production, the administrator can quickly revert the firewall rule to restore service. This aligns with the change management process of minimizing impact through controlled testing and contingency planning.

Answer

Apply changes directly in production so they take effect as quickly as possible.

Answer

Avoid documenting the change until after the maintenance window ends.

Answer

Use verbal approval from the payroll manager instead of the normal ticket process.

Question 8

A SIEM alert shows five failed logins to an administrator account, followed by a successful login from a new city three minutes later. The account owner says they did not sign in. What should the analyst do first?

Accepted Answer

Temporarily disable the account and open an incident for investigation.. The alert shows a classic indicator of account compromise: multiple failed logins followed by a successful authentication from an unusual location. The account owner's denial of the login confirms unauthorized access, so the immediate priority is to contain the threat by disabling the account and opening an incident for formal investigation. This aligns with the NIST SP 800-61 incident response process, specifically the containment phase before eradication or recovery.

Answer

Ignore the alert because the login eventually succeeded.

Answer

Reset the password only and close the alert.

Answer

Reboot the user's laptop to clear any malicious activity.

Question 9

You are handed a company laptop suspected in an insider theft case. Legal says the evidence may be needed in court. Which action best preserves admissibility?

Accepted Answer

Create a forensic image using a write blocker and record hash values.. Creating a forensic image with a write blocker ensures the original evidence remains unaltered, preserving its integrity for court admissibility. Recording hash values (e.g., SHA-256) provides a cryptographic fingerprint that can later verify the image is an exact copy, meeting legal standards for chain of custody and authenticity.

Answer

Browse the drive directly on the original laptop to identify the most relevant files.

Answer

Email the user asking them to return any copies they may have made.

Answer

Mount the drive read-write so searching and exporting data will be faster.

Question 10

A virtual file server was restored from last night’s backup. The service is online, but some finance users report missing spreadsheet changes and a few files show a 'recovered copy' timestamp. Which two checks should be completed before the team accepts the restore as successful? Select two.

Accepted Answer

Compare restored data against backup hashes or a manifest to verify that the copy is complete and uncorrupted.. Comparing restored data against backup hashes or a manifest ensures the data integrity and completeness of the restore process. Even though the file server is online, missing spreadsheet changes and 'recovered copy' timestamps suggest possible corruption or incomplete restoration. Verifying hashes (e.g., SHA-256) against a known-good manifest confirms that every file was restored without bit-rot or truncation, which is a standard post-restore validation step in backup and recovery procedures.

Answer

Assume the restore is acceptable because the file server is online and users can browse shares.

Answer

Delete the previous night’s backup so the team will not accidentally restore it again.

Answer

Expose the restored server directly to the internet so remote users can test it faster.

Question 11

After a new MFA policy rollout, the SIEM generates an alert for five failed logins to a SaaS admin portal from one IP, followed by a successful login to the same account from an IP in another country. The account owner says they were in meetings all day. What should the analyst do first?

Accepted Answer

Correlate identity provider, VPN, and endpoint logs to validate whether the activity matches the user's normal pattern.. The alert shows a successful login after five failures from a different country, which is a classic indicator of a potential account takeover. The analyst must correlate identity provider logs (e.g., Okta, Azure AD) for authentication details, VPN logs for network origination, and endpoint logs for device posture to determine if the successful login matches the user's normal behavior. This step validates whether the activity is legitimate or malicious before taking any irreversible action.

Answer

Disable the account immediately without checking any other logs.

Answer

Delete the alert because MFA was enabled and the login eventually succeeded.

Answer

Reimage the user's laptop to remove any possible malware right away.

Question 12

A firewall rule change was implemented directly in production to allow a new vendor IP range. Within minutes, several internal services became unreachable because the rule order changed unexpectedly. Which change-management practice would have most likely prevented this outage?

Accepted Answer

Testing the change in a staging environment and approving it through a peer-reviewed change process before production.. Implementing the change in a staging environment first allows validation of the rule order and its impact on traffic flow without affecting production. A peer-reviewed change process ensures that the rule insertion point (e.g., before a deny-all or after a permit statement) is verified, preventing the accidental reordering that caused the outage. This aligns with the change-management principle of testing in a representative environment before production deployment.

Answer

Applying the rule during business hours so the team can respond faster if something breaks.

Answer

Making the change first in production because that is the only environment that matters.

Answer

Documenting the outage after the vendor confirms their IP range is valid.

Question 13

A finance laptop is powered on, the user is still logged in, and it remains connected to Wi-Fi after a malware alert. What should the responder do first to preserve volatile evidence?

Accepted Answer

Collect volatile data such as memory, running processes, and active network connections.. The laptop is powered on, the user is logged in, and it is connected to the network, meaning volatile data (memory contents, running processes, active network connections) is at immediate risk of being lost if the system is shut down or tampered with. The responder must collect this data first to preserve evidence of the malware's current state, including any malicious processes, network connections, and in-memory artifacts that would disappear on power loss.

Answer

Power the laptop off immediately to stop any further attacker activity.

Answer

Run a full antimalware scan before touching any other data.

Answer

Disconnect the power cable and remove the battery to prevent changes.

Question 14

A laptop is suspected of being used in a malware incident. It is still powered on and connected to Wi-Fi. What should the responder do before shutting it down?

Accepted Answer

Capture volatile evidence such as running processes and memory contents.. Volatile evidence, such as running processes, network connections, and memory contents, is lost when the system is powered off. Capturing this data first preserves critical forensic artifacts that can reveal the malware's behavior, persistence mechanisms, and indicators of compromise (IOCs). In a live incident, the responder must follow the order of volatility (RFC 3227) to collect the most ephemeral data before it disappears.

Answer

Install endpoint protection updates on the laptop right away.

Answer

Delete suspicious files so the malware can no longer spread.

Answer

Reboot the laptop immediately to clear the suspected malware.

Question 15

A Linux server starts showing many failed SSH logins from one source IP address. Which log source should the analyst review first?

Accepted Answer

The system authentication log. The system authentication log (e.g., /var/log/auth.log or /var/log/secure) records all SSH login attempts, including failed ones, along with source IP addresses. This is the primary log source for investigating authentication failures on Linux systems, as it captures PAM (Pluggable Authentication Module) events and SSH daemon messages.

Answer

The printer spooler log

Answer

The browser history log

Answer

The backup completion log