SY0-701 Security Operations Practice Test 8 — 15 Questions

Question 1

EDR alerts on a remote laptop show a suspicious process attempting to dump browser credentials and then contacting a rare domain. The user is in another time zone and still needs the laptop online for a presentation later today. What containment action is best?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remotely isolate the device through the EDR console while keeping it powered on.. Remotely isolating the device through the EDR console is the best containment action because it immediately blocks all network communication to and from the laptop while keeping it powered on and running. This prevents the suspicious process from exfiltrating browser credentials or communicating with the rare command-and-control domain, yet allows the user to continue using local applications for the presentation later today. EDR isolation typically works by applying a host-based firewall rule that drops all traffic except to the EDR management server, ensuring the threat is contained without disrupting local productivity.

Answer

Ask the user to uninstall the EDR agent and reboot the laptop.

Answer

Wait until after the presentation and then begin containment.

Answer

Email the user asking them to close the browser and log out of their accounts.

Question 2

Security receives a company-owned laptop connected to an insider theft investigation. Before the device is transported to the evidence locker, what is the BEST action to support chain of custody?

Accepted Answer

Seal the device in an evidence bag and record each handoff with signatures. Sealing the device in an evidence bag and recording each handoff with signatures establishes a documented, unbroken chain of custody. This ensures the integrity of the evidence by preventing tampering and providing a verifiable record of who handled the device and when, which is critical for admissibility in legal proceedings.

Answer

Factory reset the laptop so investigators can start from a clean system

Answer

Remove the hard drive and image it without any documentation

Answer

Leave the laptop unlocked so the next analyst can inspect it quickly

Question 3

A finance workstation is suspected of running malware. It is still powered on, the user is logged in, and the network cable is connected. Which two actions best preserve volatile evidence before shutdown? Select two.

Accepted Answer

Capture RAM or a volatile memory image before the system is powered off. Capturing RAM or a volatile memory image preserves data that is lost when the system is powered off, such as running processes, encryption keys, and network connections. This is a fundamental step in forensic incident response to ensure volatile evidence is not destroyed before analysis.

Answer

Shut the workstation down immediately and restart it cleanly

Answer

Run a disk defragmentation utility to prepare for imaging

Answer

Uninstall the suspected malware before collecting any evidence

Question 4

A vulnerability scan identifies a critical patch for a fleet of internet-facing servers. The operations lead wants to apply it immediately during peak business hours because the exploit is public. What is the BEST next step?

Accepted Answer

Use the emergency change process with testing, approval, and a rollback plan. An emergency change process allows the critical patch to be applied quickly while still incorporating essential steps like testing, approval, and a rollback plan. This balances the urgency of a public exploit with the need to avoid unintended service disruptions during peak business hours, aligning with change management best practices in Security Operations.

Answer

Install the patch on all servers immediately without testing

Answer

Wait until the next quarterly maintenance window to avoid any risk

Answer

Patch only one production server and assume the rest will be fine

Question 5

A SIEM alert shows a successful VPN login for an executive account from an unusual country, followed 3 minutes later by large downloads from a file share the user rarely accesses. Which log source should the analyst review next to determine whether the session came from the user's assigned laptop or an unmanaged device?

Accepted Answer

Endpoint detection and response telemetry from the user's laptop. B is correct because endpoint detection and response (EDR) telemetry from the user's laptop provides granular process-level and network-level data, including the source IP of the VPN session, the device's hostname, and whether the VPN client software was initiated from the managed laptop's operating system. This allows the analyst to confirm if the VPN session originated from the assigned corporate device or from an unmanaged device using stolen credentials.

Answer

VPN concentrator logs

Answer

DNS query logs from the internal resolver

Answer

Email gateway logs for the executive mailbox

Question 6

EDR detects encoded PowerShell launched from a word processor, a process attempt to read LSASS memory, and an outbound HTTPS connection to a rare domain. What should the analyst do first?

Accepted Answer

Isolate the endpoint from the network while keeping it powered on for investigation.. The EDR alerts indicate a likely credential theft attempt (LSASS read) and C2 communication (rare domain). Isolating the endpoint preserves forensic evidence in memory and disk while preventing further data exfiltration or lateral movement, which is the immediate containment priority per incident response best practices.

Answer

Delete the user's profile to stop the malicious process immediately.

Answer

Patch the word processor before reviewing any alerts or logs.

Answer

Reboot the system immediately to clear anything running in memory.

Question 7

EDR flags a workstation after a word processor launches encoded PowerShell and the host begins contacting a rare domain over HTTPS. The user is still active. What is the best containment action from the EDR console?

Accepted Answer

Isolate the endpoint from the network while keeping it powered on.. Isolating the endpoint from the network while keeping it powered on is the best containment action because it immediately cuts off the command-and-control (C2) communication over HTTPS to the rare domain, preventing further data exfiltration or lateral movement, while preserving volatile memory and running processes for forensic analysis. This aligns with incident response best practices where containment must prioritize stopping the threat without destroying evidence.

Answer

Delete the suspicious PowerShell process from the console and close the alert.

Answer

Reimage the workstation immediately to return it to a clean state.

Answer

Power the workstation off and disconnect the SSD to preserve data.

Question 8

An EDR alert shows suspicious PowerShell activity on a remote employee laptop, and the user is still logged in to cloud applications. Which two response actions are best if the device is believed to be actively compromised? Select two.

Accepted Answer

Isolate the endpoint through the EDR tool or quarantine its network access.. Isolating the endpoint via the EDR tool or quarantining its network access immediately stops the attacker's ability to communicate with command-and-control servers, preventing lateral movement and further data exfiltration. This containment action is a critical first step in incident response for an actively compromised device, as it preserves the integrity of the investigation while halting malicious activity.

Answer

Power off the laptop immediately to stop the activity as fast as possible.

Answer

Wait until the user returns the laptop to the office for physical inspection.

Answer

Remove the EDR agent so the attacker cannot detect the investigation.

Question 9

A SIEM correlates three failed MFA prompts for a payroll admin account from one IP, a successful login two minutes later from the same IP, and a new mailbox forwarding rule to an external address. What is the best immediate action?

Accepted Answer

Disable the account and revoke active sessions and tokens.. The combination of failed MFA prompts followed by a successful login and immediate creation of an external mailbox forwarding rule is a classic indicator of account compromise (e.g., adversary-in-the-middle or token theft). Disabling the account and revoking active sessions and tokens stops the attacker from maintaining access and prevents further data exfiltration via the forwarding rule, which is the most urgent containment step in incident response.

Answer

Reset the password and leave the account enabled so the user can keep working.

Answer

Delete the forwarding rule and monitor the account for a few hours.

Answer

Wait for the user to confirm the login before taking any action.

Question 10

An administrator wants to add a new vendor IP range to a firewall rule in production. What is the best change-management step to reduce risk?

Accepted Answer

Test and approve the change before implementing it in production.. Change management requires testing and approval before applying changes to production systems. Adding a new vendor IP range to a firewall rule without validation could inadvertently allow malicious traffic or block legitimate traffic, leading to a security breach or service disruption. Testing in a non-production environment or using a change window ensures the rule behaves as intended and aligns with the organization's security policy.

Answer

Apply the change immediately during peak business hours.

Answer

Allow the entire vendor subnet permanently without review.

Answer

Skip documentation to speed up the rollout.

Question 11

During malware containment, an analyst needs to preserve transient information from a compromised Windows workstation that is still running. Which action is MOST appropriate before shutdown or imaging?

Accepted Answer

Capture memory and live process information with approved response tools. Transient information such as running processes, network connections, and memory-resident malware is lost when the system is powered off. Capturing memory and live process data with approved forensic tools (e.g., FTK Imager, DumpIt, or WinPmem) preserves volatile evidence critical for incident analysis and attribution, in accordance with the order of volatility (RFC 3227).

Answer

Immediately unplug the workstation and carry it to the evidence room

Answer

Run a full antivirus scan to clean the machine before analysis

Answer

Clear the event logs so the malicious activity is easier to isolate

Question 12

EDR reports that a workstation launched PowerShell from a word processor, created a scheduled task named WinUpdateSvc, and began making repeated HTTPS connections to a rare external domain. The user is still logged in to several cloud apps. Which two response actions are best to initiate from the EDR console? Select two.

Accepted Answer

Isolate the endpoint from the network to stop further communication and lateral movement.. Isolating the endpoint from the network immediately stops the active HTTPS command-and-control (C2) communication and prevents lateral movement to other systems. Given the suspicious chain (word processor spawning PowerShell, creating a scheduled task, and connecting to a rare external domain), this is a strong indicator of a malware infection or unauthorized remote access. Isolation preserves the forensic state while cutting off the attacker's access.

Answer

Delete the scheduled task immediately so the host returns to normal operation.

Answer

Reimage the workstation from the golden image as the first response.

Answer

Ignore the alert because the PowerShell binary is built into Windows and therefore safe.

Question 13

An employee reports a ransomware note on a file server. The server is still powered on, shares are still being accessed, and management wants service restored as quickly as possible. What should the incident response team do first?

Accepted Answer

Isolate the server from the network while keeping it powered on. The correct first step is to isolate the server from the network while keeping it powered on. This preserves volatile evidence (e.g., memory, running processes, network connections) that is critical for forensic analysis and understanding the ransomware's entry vector. Powering off would destroy this data, and restoring from backup prematurely could reintroduce the infection or miss evidence needed to prevent recurrence.

Answer

Power off the server immediately to stop all attacker activity

Answer

Start restoring from backup before collecting any logs or memory data

Answer

Delete the ransomware note and suspicious files to reduce business disruption

Question 14

Several Windows servers were built from the same image, and all of them use the same local Administrator password. What is the best operational hardening change?

Accepted Answer

Implement a tool that automatically sets unique local admin passwords on each server.. Using a tool like Local Administrator Password Solution (LAPS) automates the rotation of unique, complex passwords for each server's local administrator account. This eliminates the risk of lateral movement if one server's credentials are compromised, as each machine has a distinct password stored securely in Active Directory.

Answer

Keep the shared password but store it in a spreadsheet with restricted access.

Answer

Remove all administrator accounts from the servers.

Answer

Change the password manually once a year on one server only.

Question 15

EDR flags a workstation because a word processor launched an unusual script and then contacted a rare external domain. What is the best immediate action?

Accepted Answer

Isolate the workstation from the network using the EDR tool.. Isolating the workstation with the EDR tool is the best immediate action because it contains the potential compromise by cutting off network communication, preventing lateral movement or data exfiltration while preserving forensic evidence. The combination of an unusual script execution from a word processor and a connection to a rare external domain strongly suggests a possible malware infection or remote access trojan (RAT) that requires immediate containment.

Answer

Wait for another alert before taking any action.

Answer

Delete the word processor immediately.

Answer

Reboot the workstation to see if the behavior happens again.