SY0-701 Security Operations Practice Test 9 — 15 Questions

Question 1

An employee reports a ransomware note on a file server. The server is still powered on, shares are still being accessed, and management wants service restored as quickly as possible. What should the incident response team do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the server from the network while keeping it powered on. The correct first step is to isolate the server from the network while keeping it powered on. This preserves volatile evidence (e.g., memory, running processes, network connections) that is critical for forensic analysis and understanding the ransomware's entry vector. Powering off would destroy this data, and restoring from backup prematurely could reintroduce the infection or miss evidence needed to prevent recurrence.

Answer

Power off the server immediately to stop all attacker activity

Answer

Start restoring from backup before collecting any logs or memory data

Answer

Delete the ransomware note and suspicious files to reduce business disruption

Question 2

Several Windows servers were built from the same image, and all of them use the same local Administrator password. What is the best operational hardening change?

Accepted Answer

Implement a tool that automatically sets unique local admin passwords on each server.. Using a tool like Local Administrator Password Solution (LAPS) automates the rotation of unique, complex passwords for each server's local administrator account. This eliminates the risk of lateral movement if one server's credentials are compromised, as each machine has a distinct password stored securely in Active Directory.

Answer

Keep the shared password but store it in a spreadsheet with restricted access.

Answer

Remove all administrator accounts from the servers.

Answer

Change the password manually once a year on one server only.

Question 3

EDR flags a workstation because a word processor launched an unusual script and then contacted a rare external domain. What is the best immediate action?

Accepted Answer

Isolate the workstation from the network using the EDR tool.. Isolating the workstation with the EDR tool is the best immediate action because it contains the potential compromise by cutting off network communication, preventing lateral movement or data exfiltration while preserving forensic evidence. The combination of an unusual script execution from a word processor and a connection to a rare external domain strongly suggests a possible malware infection or remote access trojan (RAT) that requires immediate containment.

Answer

Wait for another alert before taking any action.

Answer

Delete the word processor immediately.

Answer

Reboot the workstation to see if the behavior happens again.

Question 4

During a disaster recovery test, what is the most important thing to confirm about the backup?

Accepted Answer

That the data can be restored and is usable after recovery.. The most important thing to confirm about a backup during a disaster recovery test is that the data can be restored and is usable after recovery. This validates the integrity and completeness of the backup, ensuring that the recovery point objective (RPO) and recovery time objective (RTO) can be met. Simply verifying that backup files exist does not guarantee they are not corrupted or that the restoration process will succeed, which is why a full restore test is critical.

Answer

That the backup files exist in storage.

Answer

That the backup system uses encryption.

Answer

That the backup is stored on tape instead of disk.

Question 5

A SIEM reports a successful sign-in to a SaaS admin portal from a new country, followed three minutes later by multiple configuration changes to mailbox forwarding rules. The account owner says they were in the office and did not approve any changes. What should the analyst check next?

Accepted Answer

The identity provider and MFA logs to confirm whether the session was legitimately authenticated or hijacked.. The SIEM alert shows a successful sign-in from a new country followed by suspicious configuration changes, which is a classic indicator of session hijacking or credential theft. Checking the identity provider (IdP) and MFA logs allows the analyst to verify if the authentication was legitimate (e.g., from a known device/IP) or if the session token was stolen and reused, as MFA can be bypassed via token replay or consent phishing. This step directly addresses the core question of whether the session was authorized or compromised.

Answer

The office printer logs to see whether the user printed the mailbox rules.

Answer

The antivirus signature version on the user’s laptop only.

Answer

The DNS cache on the user’s laptop to find the forwarding rule target.

Question 6

A SIEM alert flags an interactive logon to a Windows file server from a service account that normally only runs scheduled tasks. The alert occurred at 01:12, but the maintenance window for that server is every Sunday at 02:00. The account also accessed a different server five minutes later. What should the analyst do first?

Accepted Answer

Correlate the activity with the change calendar, scheduled-task logs, and ticketing records before escalating.. The analyst must first gather context to determine if the alert is a false positive or a genuine security incident. The interactive logon at 01:12 is outside the scheduled maintenance window (Sunday 02:00), and the account’s subsequent access to another server warrants correlation with change calendars, scheduled-task logs, and ticketing records to verify if the activity was authorized. This step prevents unnecessary disruption while ensuring that any anomalous behavior is properly investigated before escalation.

Answer

Ignore the alert because service accounts often authenticate outside normal business hours.

Answer

Immediately disable the service account to stop any potential attacker activity.

Answer

Reimage the file server to remove any possible compromise.

Question 7

EDR flags encoded PowerShell launched by a spreadsheet application, followed by an attempt to access LSASS and outbound HTTPS traffic to a rare domain. What should the analyst do first from the EDR console?

Accepted Answer

Isolate the endpoint from the network while keeping it powered on. Isolating the endpoint from the network while keeping it powered on preserves volatile evidence (e.g., running processes, memory contents) and prevents the attacker from exfiltrating data or establishing further C2 communication. The EDR console allows immediate network isolation without losing the ability to perform live forensics or memory analysis. This aligns with the incident response priority of containment before eradication or recovery.

Answer

Reboot the endpoint to terminate the suspicious processes

Answer

Uninstall the spreadsheet application immediately

Answer

Block the rare domain and close the alert

Question 8

A firewall rule must be changed to allow a vendor update server. Which step best reduces the chance of an unexpected outage?

Accepted Answer

Document the change, get approval, and include a rollback plan.. Following a formal change management process—documenting the change, obtaining approval, and including a rollback plan—ensures that the firewall rule modification is reviewed for potential impacts, authorized by stakeholders, and can be reverted if it causes an outage. This structured approach minimizes the risk of unexpected downtime by validating the change in a controlled manner and providing a safety net.

Answer

Make the change directly in production without review to save time.

Answer

Disable the firewall temporarily while the update is tested.

Answer

Apply the rule but do not tell anyone so there is less paperwork.

Question 9

A new SIEM rule generates many alerts from a scheduled backup job that is known to be legitimate. What should the analyst do to improve alert quality?

Accepted Answer

Tune the rule to exclude the known backup activity pattern.. Tuning the SIEM rule to exclude the known backup activity pattern reduces false positives while preserving detection of actual threats. By creating an exception for the specific backup server's IP, schedule, or process hash, the analyst maintains visibility into anomalous behavior without being overwhelmed by noise.

Answer

Disable all logging for the backup server.

Answer

Ignore the alerts permanently because the job is approved.

Answer

Reimage the backup server to stop the alerts.

Question 10

A company laptop is collected as evidence in a suspected theft case. Which action best supports chain of custody?

Accepted Answer

Record each transfer with date, time, handler name, and signatures.. Chain of custody requires documenting every transfer of evidence with date, time, handler name, and signatures to maintain a verifiable record of who had possession of the laptop at all times. This ensures the evidence is admissible in court by proving it has not been tampered with or altered since collection. Without this documentation, the defense could argue the evidence was compromised, undermining the entire case.

Answer

Place the laptop on a desk until the investigator is available.

Answer

Reset the laptop so the legal team can access it more easily.

Answer

Remove the hard drive and connect it to a personal workstation.

Question 11

EDR flags encoded PowerShell launched by a spreadsheet application and an outbound HTTPS connection to a rare domain. Which two response actions are best to take from the EDR console first? Select two.

Accepted Answer

Isolate the endpoint from the network through the EDR platform. Isolating the endpoint from the network (A) is correct because it immediately stops the outbound HTTPS connection to the rare domain, preventing potential command-and-control (C2) data exfiltration or further payload download. Collecting a triage package or memory snapshot (B) is correct because the encoded PowerShell script and suspicious process chain are volatile artifacts that may be lost on reboot or remediation, and capturing them preserves forensic evidence for analysis.

Answer

Uninstall the spreadsheet application immediately

Answer

Reboot the endpoint to clear the suspicious script

Answer

Wait for a second alert before taking any action

Question 12

After restoring a virtual file server from backup, users can open shares, but the accounting application shows the previous day's transactions are missing. Which two steps should the administrator take next? Select two.

Accepted Answer

Verify whether the backup included application-consistent data and transaction logs. The accounting application's missing transactions indicate the backup may not have captured application-consistent data, such as open transaction logs or database writes. Without application consistency (e.g., using Volume Shadow Copy Service or a database-aware backup agent), the restore point may reflect a crash-consistent state where recent transactions were lost. Verifying the backup type ensures the administrator understands whether the data is recoverable from transaction logs or requires a separate application-level restore.

Answer

Leave the server as is because file shares are accessible

Answer

Delete the current backup set to avoid restoring the wrong version again

Answer

Reimage the server immediately without checking the restore point

Question 13

After a file server is restored from backup, users can open the share, but the business wants to be sure the recovery was successful. What should the administrator verify next?

Accepted Answer

That representative files open correctly and the restored data matches the required recovery point.. Verifying that representative files open correctly and match the required recovery point (RPO) confirms data integrity and completeness, not just that the restore process ran without errors. This aligns with the backup validation principle of performing a data integrity check, such as comparing file hashes or checking timestamps, to ensure the restored data is usable and meets the business's recovery objectives.

Answer

Only that the restore completed without any error message.

Answer

That the server has enough free disk space for future growth.

Answer

That the backup software icon appears green on the console.

Question 14

An employee reports a ransomware note on a file server. The server is still powered on, shares are still being accessed, and management wants service restored as quickly as possible. What should the incident response team do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the laptop from the network while keeping it powered on for volatile evidence collection.. The immediate priority is to contain the ransomware while preserving volatile evidence (e.g., memory contents, running processes, network connections) that could be critical for forensic analysis. Powering off the laptop (Option A) would destroy volatile data and may allow the ransomware to persist or trigger additional encryption on reboot. Isolating the network connection stops the ransomware from communicating with its command-and-control server or spreading laterally, while keeping the system powered on allows a responder to capture memory with tools like FTK Imager or LiME before performing a controlled shutdown.

Answer

Shut the laptop down immediately to prevent further encryption activity.

Answer

Ask the user to close all open applications and log off normally.

Answer

Start deleting suspicious files to reduce the impact of the ransomware.

Question 15

EDR shows encoded PowerShell launched by a word processor and an outbound connection to a rare domain. What is the best immediate containment action?

Accepted Answer

Isolate the endpoint from the network using the EDR console.. Isolating the endpoint from the network using the EDR console is the best immediate containment action because it stops the outbound connection to the rare domain, preventing potential command-and-control (C2) communication or data exfiltration. The encoded PowerShell launched by a word processor strongly suggests a malicious macro or exploit, and isolating the host contains the threat without disrupting the entire network. This aligns with the incident response priority of containment before eradication or recovery.

Answer

Uninstall the word processor from every workstation.

Answer

Wait to see whether more alerts appear before responding.

Answer

Send a notice to all users reminding them not to open attachments.