SY0-701 Security Operations Practice Test 9 — 15 Questions

Question 1

During a disaster recovery test, what is the most important thing to confirm about the backup?

Accepted Answer

That the data can be restored and is usable after recovery.. The most important thing to confirm about a backup during a disaster recovery test is that the data can be restored and is usable after recovery. This validates the integrity and completeness of the backup, ensuring that the recovery point objective (RPO) and recovery time objective (RTO) can be met. Simply verifying that backup files exist does not guarantee they are not corrupted or that the restoration process will succeed, which is why a full restore test is critical.

Answer

That the backup files exist in storage.

Answer

That the backup system uses encryption.

Answer

That the backup is stored on tape instead of disk.

Question 2

A SIEM reports a successful sign-in to a SaaS admin portal from a new country, followed three minutes later by multiple configuration changes to mailbox forwarding rules. The account owner says they were in the office and did not approve any changes. What should the analyst check next?

Accepted Answer

The identity provider and MFA logs to confirm whether the session was legitimately authenticated or hijacked.. The SIEM alert shows a successful sign-in from a new country followed by suspicious configuration changes, which is a classic indicator of session hijacking or credential theft. Checking the identity provider (IdP) and MFA logs allows the analyst to verify if the authentication was legitimate (e.g., from a known device/IP) or if the session token was stolen and reused, as MFA can be bypassed via token replay or consent phishing. This step directly addresses the core question of whether the session was authorized or compromised.

Answer

The office printer logs to see whether the user printed the mailbox rules.

Answer

The antivirus signature version on the user’s laptop only.

Answer

The DNS cache on the user’s laptop to find the forwarding rule target.

Question 3

A SIEM alert flags an interactive logon to a Windows file server from a service account that normally only runs scheduled tasks. The alert occurred at 01:12, but the maintenance window for that server is every Sunday at 02:00. The account also accessed a different server five minutes later. What should the analyst do first?

Accepted Answer

Correlate the activity with the change calendar, scheduled-task logs, and ticketing records before escalating.. The analyst must first gather context to determine if the alert is a false positive or a genuine security incident. The interactive logon at 01:12 is outside the scheduled maintenance window (Sunday 02:00), and the account’s subsequent access to another server warrants correlation with change calendars, scheduled-task logs, and ticketing records to verify if the activity was authorized. This step prevents unnecessary disruption while ensuring that any anomalous behavior is properly investigated before escalation.

Answer

Ignore the alert because service accounts often authenticate outside normal business hours.

Answer

Immediately disable the service account to stop any potential attacker activity.

Answer

Reimage the file server to remove any possible compromise.

Question 4

EDR flags encoded PowerShell launched by a spreadsheet application, followed by an attempt to access LSASS and outbound HTTPS traffic to a rare domain. What should the analyst do first from the EDR console?

Accepted Answer

Isolate the endpoint from the network while keeping it powered on. Isolating the endpoint from the network while keeping it powered on preserves volatile evidence (e.g., running processes, memory contents) and prevents the attacker from exfiltrating data or establishing further C2 communication. The EDR console allows immediate network isolation without losing the ability to perform live forensics or memory analysis. This aligns with the incident response priority of containment before eradication or recovery.

Answer

Reboot the endpoint to terminate the suspicious processes

Answer

Uninstall the spreadsheet application immediately

Answer

Block the rare domain and close the alert

Question 5

A firewall rule must be changed to allow a vendor update server. Which step best reduces the chance of an unexpected outage?

Accepted Answer

Document the change, get approval, and include a rollback plan.. Following a formal change management process—documenting the change, obtaining approval, and including a rollback plan—ensures that the firewall rule modification is reviewed for potential impacts, authorized by stakeholders, and can be reverted if it causes an outage. This structured approach minimizes the risk of unexpected downtime by validating the change in a controlled manner and providing a safety net.

Answer

Make the change directly in production without review to save time.

Answer

Disable the firewall temporarily while the update is tested.

Answer

Apply the rule but do not tell anyone so there is less paperwork.

Question 6

A new SIEM rule generates many alerts from a scheduled backup job that is known to be legitimate. What should the analyst do to improve alert quality?

Accepted Answer

Tune the rule to exclude the known backup activity pattern.. Tuning the SIEM rule to exclude the known backup activity pattern reduces false positives while preserving detection of actual threats. By creating an exception for the specific backup server's IP, schedule, or process hash, the analyst maintains visibility into anomalous behavior without being overwhelmed by noise.

Answer

Disable all logging for the backup server.

Answer

Ignore the alerts permanently because the job is approved.

Answer

Reimage the backup server to stop the alerts.

Question 7

A company laptop is collected as evidence in a suspected theft case. Which action best supports chain of custody?

Accepted Answer

Record each transfer with date, time, handler name, and signatures.. Chain of custody requires documenting every transfer of evidence with date, time, handler name, and signatures to maintain a verifiable record of who had possession of the laptop at all times. This ensures the evidence is admissible in court by proving it has not been tampered with or altered since collection. Without this documentation, the defense could argue the evidence was compromised, undermining the entire case.

Answer

Place the laptop on a desk until the investigator is available.

Answer

Reset the laptop so the legal team can access it more easily.

Answer

Remove the hard drive and connect it to a personal workstation.

Question 8

EDR flags encoded PowerShell launched by a spreadsheet application and an outbound HTTPS connection to a rare domain. Which two response actions are best to take from the EDR console first? Select two.

Accepted Answer

Isolate the endpoint from the network through the EDR platform. Isolating the endpoint from the network (A) is correct because it immediately stops the outbound HTTPS connection to the rare domain, preventing potential command-and-control (C2) data exfiltration or further payload download. Collecting a triage package or memory snapshot (B) is correct because the encoded PowerShell script and suspicious process chain are volatile artifacts that may be lost on reboot or remediation, and capturing them preserves forensic evidence for analysis.

Answer

Uninstall the spreadsheet application immediately

Answer

Reboot the endpoint to clear the suspicious script

Answer

Wait for a second alert before taking any action

Question 9

After restoring a virtual file server from backup, users can open shares, but the accounting application shows the previous day's transactions are missing. Which two steps should the administrator take next? Select two.

Accepted Answer

Verify whether the backup included application-consistent data and transaction logs. The accounting application's missing transactions indicate the backup may not have captured application-consistent data, such as open transaction logs or database writes. Without application consistency (e.g., using Volume Shadow Copy Service or a database-aware backup agent), the restore point may reflect a crash-consistent state where recent transactions were lost. Verifying the backup type ensures the administrator understands whether the data is recoverable from transaction logs or requires a separate application-level restore.

Answer

Leave the server as is because file shares are accessible

Answer

Delete the current backup set to avoid restoring the wrong version again

Answer

Reimage the server immediately without checking the restore point

Question 10

After a file server is restored from backup, users can open the share, but the business wants to be sure the recovery was successful. What should the administrator verify next?

Accepted Answer

That representative files open correctly and the restored data matches the required recovery point.. Verifying that representative files open correctly and match the required recovery point (RPO) confirms data integrity and completeness, not just that the restore process ran without errors. This aligns with the backup validation principle of performing a data integrity check, such as comparing file hashes or checking timestamps, to ensure the restored data is usable and meets the business's recovery objectives.

Answer

Only that the restore completed without any error message.

Answer

That the server has enough free disk space for future growth.

Answer

That the backup software icon appears green on the console.

Question 11

An employee reports a ransomware note on a finance laptop. The laptop is still powered on, connected to Wi-Fi, and the user says they were just working in a spreadsheet. Management wants the fastest safe response that also preserves evidence. What should the responder do first?

Accepted Answer

Isolate the laptop from the network while keeping it powered on for volatile evidence collection.. The immediate priority is to contain the ransomware while preserving volatile evidence (e.g., memory contents, running processes, network connections) that could be critical for forensic analysis. Powering off the laptop (Option A) would destroy volatile data and may allow the ransomware to persist or trigger additional encryption on reboot. Isolating the network connection stops the ransomware from communicating with its command-and-control server or spreading laterally, while keeping the system powered on allows a responder to capture memory with tools like FTK Imager or LiME before performing a controlled shutdown.

Answer

Shut the laptop down immediately to prevent further encryption activity.

Answer

Ask the user to close all open applications and log off normally.

Answer

Start deleting suspicious files to reduce the impact of the ransomware.

Question 12

EDR shows encoded PowerShell launched by a word processor and an outbound connection to a rare domain. What is the best immediate containment action?

Accepted Answer

Isolate the endpoint from the network using the EDR console.. Isolating the endpoint from the network using the EDR console is the best immediate containment action because it stops the outbound connection to the rare domain, preventing potential command-and-control (C2) communication or data exfiltration. The encoded PowerShell launched by a word processor strongly suggests a malicious macro or exploit, and isolating the host contains the threat without disrupting the entire network. This aligns with the incident response priority of containment before eradication or recovery.

Answer

Uninstall the word processor from every workstation.

Answer

Wait to see whether more alerts appear before responding.

Answer

Send a notice to all users reminding them not to open attachments.

Question 13

A SIEM alert shows a payroll administrator account signed in at 02:10 from a country the employee has never visited. The employee says they are on vacation at home and did not travel. What should the analyst do first?

Accepted Answer

Verify the login context with the user or manager and review recent authentication history.. The first step in incident response is to verify the alert's validity and gather context before taking action. The analyst should review the SIEM logs for authentication details (e.g., source IP, geolocation, timestamp) and confirm with the user or manager whether the login was expected. This aligns with the NIST SP 800-61 incident response process, which emphasizes triage and validation before containment.

Answer

Immediately disable the account and wait for the employee to return.

Answer

Close the alert as a false positive because the user is on vacation.

Answer

Reimage the user’s workstation before checking any logs.

Question 14

Based on the exhibit, which improvement best aligns the current backup design with the stated recovery targets?

Accepted Answer

Switch to frequent incremental or snapshot backups stored in a separate, immutable location with routine restore tests.. The current backup design lacks off-site, immutable storage and routine restore testing, which are critical to meet recovery point and time objectives (RPO/RTO). Frequent incremental or snapshot backups in a separate, immutable location protect against ransomware and ensure data integrity, while routine restore tests verify that backups are actually recoverable when needed.

Answer

Keep the same design but extend backup retention from 30 days to 90 days.

Answer

Share the backup administrator password in a team chat so any engineer can restore data during an outage.

Answer

Remove backup encryption so restores run faster during an emergency.

Question 15

Based on the exhibit, what is the most likely SOC conclusion and next action?

A scheduled alert fired on a server that repeatedly connects to a vendor update site at fixed intervals. The security team wants to know whether the alert represents a real threat or a harmless operational pattern.

Accepted Answer

Classify the alert as a likely false positive, verify it against the maintenance record, and tune the rule.. The scheduled alert firing at fixed intervals to a known vendor update site strongly suggests a legitimate update or heartbeat mechanism, not malicious C2 traffic. Option B correctly directs the analyst to verify against maintenance records (confirming the pattern is expected) and then tune the rule to reduce future false positives, which is the standard SOC workflow for benign scheduled activity.

Answer

Treat the activity as confirmed command-and-control traffic and isolate the server immediately.

Answer

Assume DNS poisoning is occurring and immediately flush the DNS cache on every endpoint.

Answer

Open a credential theft incident and reset all administrator passwords across the environment.