SY0-701 Security Operations Practice Test 8 — 15 Questions

Question 1

A finance laptop is powered on, the user is still logged in, and it remains connected to Wi-Fi after a malware alert. What should the responder do first to preserve volatile evidence?

Accepted Answer

Collect volatile data such as memory, running processes, and active network connections.. The laptop is powered on, the user is logged in, and it is connected to the network, meaning volatile data (memory contents, running processes, active network connections) is at immediate risk of being lost if the system is shut down or tampered with. The responder must collect this data first to preserve evidence of the malware's current state, including any malicious processes, network connections, and in-memory artifacts that would disappear on power loss.

Answer

Power the laptop off immediately to stop any further attacker activity.

Answer

Run a full antimalware scan before touching any other data.

Answer

Disconnect the power cable and remove the battery to prevent changes.

Question 2

A laptop is suspected of being used in a malware incident. It is still powered on and connected to Wi-Fi. What should the responder do before shutting it down?

Accepted Answer

Capture volatile evidence such as running processes and memory contents.. Volatile evidence, such as running processes, network connections, and memory contents, is lost when the system is powered off. Capturing this data first preserves critical forensic artifacts that can reveal the malware's behavior, persistence mechanisms, and indicators of compromise (IOCs). In a live incident, the responder must follow the order of volatility (RFC 3227) to collect the most ephemeral data before it disappears.

Answer

Install endpoint protection updates on the laptop right away.

Answer

Delete suspicious files so the malware can no longer spread.

Answer

Reboot the laptop immediately to clear the suspected malware.

Question 3

A Linux server starts showing many failed SSH logins from one source IP address. Which log source should the analyst review first?

Accepted Answer

The system authentication log. The system authentication log (e.g., /var/log/auth.log or /var/log/secure) records all SSH login attempts, including failed ones, along with source IP addresses. This is the primary log source for investigating authentication failures on Linux systems, as it captures PAM (Pluggable Authentication Module) events and SSH daemon messages.

Answer

The printer spooler log

Answer

The browser history log

Answer

The backup completion log

Question 4

EDR alerts on a remote laptop show a suspicious process attempting to dump browser credentials and then contacting a rare domain. The user is in another time zone and still needs the laptop online for a presentation later today. What containment action is best?

Accepted Answer

Remotely isolate the device through the EDR console while keeping it powered on.. Remotely isolating the device through the EDR console is the best containment action because it immediately blocks all network communication to and from the laptop while keeping it powered on and running. This prevents the suspicious process from exfiltrating browser credentials or communicating with the rare command-and-control domain, yet allows the user to continue using local applications for the presentation later today. EDR isolation typically works by applying a host-based firewall rule that drops all traffic except to the EDR management server, ensuring the threat is contained without disrupting local productivity.

Answer

Ask the user to uninstall the EDR agent and reboot the laptop.

Answer

Wait until after the presentation and then begin containment.

Answer

Email the user asking them to close the browser and log out of their accounts.

Question 5

Security receives a company-owned laptop connected to an insider theft investigation. Before the device is transported to the evidence locker, what is the BEST action to support chain of custody?

Accepted Answer

Seal the device in an evidence bag and record each handoff with signatures. Sealing the device in an evidence bag and recording each handoff with signatures establishes a documented, unbroken chain of custody. This ensures the integrity of the evidence by preventing tampering and providing a verifiable record of who handled the device and when, which is critical for admissibility in legal proceedings.

Answer

Factory reset the laptop so investigators can start from a clean system

Answer

Remove the hard drive and image it without any documentation

Answer

Leave the laptop unlocked so the next analyst can inspect it quickly

Question 6

A finance workstation is suspected of running malware. It is still powered on, the user is logged in, and the network cable is connected. Which two actions best preserve volatile evidence before shutdown? Select two.

Accepted Answer

Capture RAM or a volatile memory image before the system is powered off. Capturing RAM or a volatile memory image preserves data that is lost when the system is powered off, such as running processes, encryption keys, and network connections. This is a fundamental step in forensic incident response to ensure volatile evidence is not destroyed before analysis.

Answer

Shut the workstation down immediately and restart it cleanly

Answer

Run a disk defragmentation utility to prepare for imaging

Answer

Uninstall the suspected malware before collecting any evidence

Question 7

A vulnerability scan identifies a critical patch for a fleet of internet-facing servers. The operations lead wants to apply it immediately during peak business hours because the exploit is public. What is the BEST next step?

Accepted Answer

Use the emergency change process with testing, approval, and a rollback plan. An emergency change process allows the critical patch to be applied quickly while still incorporating essential steps like testing, approval, and a rollback plan. This balances the urgency of a public exploit with the need to avoid unintended service disruptions during peak business hours, aligning with change management best practices in Security Operations.

Answer

Install the patch on all servers immediately without testing

Answer

Wait until the next quarterly maintenance window to avoid any risk

Answer

Patch only one production server and assume the rest will be fine

Question 8

A SIEM alert shows a successful VPN login for an executive account from an unusual country, followed 3 minutes later by large downloads from a file share the user rarely accesses. Which log source should the analyst review next to determine whether the session came from the user's assigned laptop or an unmanaged device?

Accepted Answer

Endpoint detection and response telemetry from the user's laptop. B is correct because endpoint detection and response (EDR) telemetry from the user's laptop provides granular process-level and network-level data, including the source IP of the VPN session, the device's hostname, and whether the VPN client software was initiated from the managed laptop's operating system. This allows the analyst to confirm if the VPN session originated from the assigned corporate device or from an unmanaged device using stolen credentials.

Answer

VPN concentrator logs

Answer

DNS query logs from the internal resolver

Answer

Email gateway logs for the executive mailbox

Question 9

EDR detects encoded PowerShell launched from a word processor, a process attempt to read LSASS memory, and an outbound HTTPS connection to a rare domain. What should the analyst do first?

Accepted Answer

Isolate the endpoint from the network while keeping it powered on for investigation.. The EDR alerts indicate a likely credential theft attempt (LSASS read) and C2 communication (rare domain). Isolating the endpoint preserves forensic evidence in memory and disk while preventing further data exfiltration or lateral movement, which is the immediate containment priority per incident response best practices.

Answer

Delete the user's profile to stop the malicious process immediately.

Answer

Patch the word processor before reviewing any alerts or logs.

Answer

Reboot the system immediately to clear anything running in memory.

Question 10

EDR flags a workstation after a word processor launches encoded PowerShell and the host begins contacting a rare domain over HTTPS. The user is still active. What is the best containment action from the EDR console?

Accepted Answer

Isolate the endpoint from the network while keeping it powered on.. Isolating the endpoint from the network while keeping it powered on is the best containment action because it immediately cuts off the command-and-control (C2) communication over HTTPS to the rare domain, preventing further data exfiltration or lateral movement, while preserving volatile memory and running processes for forensic analysis. This aligns with incident response best practices where containment must prioritize stopping the threat without destroying evidence.

Answer

Delete the suspicious PowerShell process from the console and close the alert.

Answer

Reimage the workstation immediately to return it to a clean state.

Answer

Power the workstation off and disconnect the SSD to preserve data.

Question 11

An EDR alert shows suspicious PowerShell activity on a remote employee laptop, and the user is still logged in to cloud applications. Which two response actions are best if the device is believed to be actively compromised? Select two.

Accepted Answer

Isolate the endpoint through the EDR tool or quarantine its network access.. Isolating the endpoint via the EDR tool or quarantining its network access immediately stops the attacker's ability to communicate with command-and-control servers, preventing lateral movement and further data exfiltration. This containment action is a critical first step in incident response for an actively compromised device, as it preserves the integrity of the investigation while halting malicious activity.

Answer

Power off the laptop immediately to stop the activity as fast as possible.

Answer

Wait until the user returns the laptop to the office for physical inspection.

Answer

Remove the EDR agent so the attacker cannot detect the investigation.

Question 12

A SIEM correlates three failed MFA prompts for a payroll admin account from one IP, a successful login two minutes later from the same IP, and a new mailbox forwarding rule to an external address. What is the best immediate action?

Accepted Answer

Disable the account and revoke active sessions and tokens.. The combination of failed MFA prompts followed by a successful login and immediate creation of an external mailbox forwarding rule is a classic indicator of account compromise (e.g., adversary-in-the-middle or token theft). Disabling the account and revoking active sessions and tokens stops the attacker from maintaining access and prevents further data exfiltration via the forwarding rule, which is the most urgent containment step in incident response.

Answer

Reset the password and leave the account enabled so the user can keep working.

Answer

Delete the forwarding rule and monitor the account for a few hours.

Answer

Wait for the user to confirm the login before taking any action.

Question 13

An administrator wants to add a new vendor IP range to a firewall rule in production. What is the best change-management step to reduce risk?

Accepted Answer

Test and approve the change before implementing it in production.. Change management requires testing and approval before applying changes to production systems. Adding a new vendor IP range to a firewall rule without validation could inadvertently allow malicious traffic or block legitimate traffic, leading to a security breach or service disruption. Testing in a non-production environment or using a change window ensures the rule behaves as intended and aligns with the organization's security policy.

Answer

Apply the change immediately during peak business hours.

Answer

Allow the entire vendor subnet permanently without review.

Answer

Skip documentation to speed up the rollout.

Question 14

During malware containment, an analyst needs to preserve transient information from a compromised Windows workstation that is still running. Which action is MOST appropriate before shutdown or imaging?

Accepted Answer

Capture memory and live process information with approved response tools. Transient information such as running processes, network connections, and memory-resident malware is lost when the system is powered off. Capturing memory and live process data with approved forensic tools (e.g., FTK Imager, DumpIt, or WinPmem) preserves volatile evidence critical for incident analysis and attribution, in accordance with the order of volatility (RFC 3227).

Answer

Immediately unplug the workstation and carry it to the evidence room

Answer

Run a full antivirus scan to clean the machine before analysis

Answer

Clear the event logs so the malicious activity is easier to isolate

Question 15

EDR reports that a workstation launched PowerShell from a word processor, created a scheduled task named WinUpdateSvc, and began making repeated HTTPS connections to a rare external domain. The user is still logged in to several cloud apps. Which two response actions are best to initiate from the EDR console? Select two.

Accepted Answer

Isolate the endpoint from the network to stop further communication and lateral movement.. Isolating the endpoint from the network immediately stops the active HTTPS command-and-control (C2) communication and prevents lateral movement to other systems. Given the suspicious chain (word processor spawning PowerShell, creating a scheduled task, and connecting to a rare external domain), this is a strong indicator of a malware infection or unauthorized remote access. Isolation preserves the forensic state while cutting off the attacker's access.

Answer

Delete the scheduled task immediately so the host returns to normal operation.

Answer

Reimage the workstation from the golden image as the first response.

Answer

Ignore the alert because the PowerShell binary is built into Windows and therefore safe.