SY0-701 Security Operations Practice Test 9 — 15 Questions

Question 1

A help desk ticket confirms that a user entered corporate credentials into a fake sign-in page. Minutes later, the security team finds a new mailbox forwarding rule and evidence that the attacker added backup MFA codes. After disabling the account, what should the team do next to support containment and recovery?

Accepted Answer

Revoke active sessions and reset the compromised credentials.. Option C is correct because after disabling a compromised account, the immediate next step is to revoke all active sessions and reset the credentials. This ensures the attacker cannot maintain access via existing tokens or session cookies, and the new password invalidates any cached or stolen credentials. This aligns with the NIST SP 800-61 incident response containment phase, which prioritizes cutting off active attacker access before further investigation.

Answer

Wait for the user to confirm the behavior before taking any further steps.

Answer

Reimage the user's laptop before reviewing the account activity.

Answer

Close the ticket because MFA was enabled and should have prevented access.

Question 2

Based on the exhibit, which temporary control best reduces risk until the patch is released?

Accepted Answer

Place the service behind a reverse proxy or WAF and restrict access with source IP allow lists.. Option B is correct because placing the service behind a reverse proxy or Web Application Firewall (WAF) with source IP allow lists provides a temporary compensating control that reduces the attack surface until the vendor releases a patch. The reverse proxy or WAF can inspect and filter malicious traffic, while IP allow lists restrict access to trusted sources only, mitigating the risk of exploitation without removing the service entirely.

Answer

Increase scan frequency to daily and leave the service exposed.

Answer

Disable TLS so the traffic can be inspected more easily.

Answer

Move administrative access to the same 443 listener as user traffic.

Question 3

Based on the exhibit, which change best moves the ERP recovery design toward meeting both recovery targets?

Accepted Answer

Add a warm standby database with 15-minute log shipping and scheduled failover tests.. Option B is correct because adding a warm standby database with 15-minute log shipping significantly reduces the recovery point objective (RPO) to near-zero and, combined with scheduled failover tests, ensures the recovery time objective (RTO) is met. This directly addresses the gap between the current backup-only approach and the required recovery targets, as log shipping provides near-continuous data protection and failover testing validates the recovery process.

Answer

Increase the full backup frequency to every night and keep the same recovery process.

Answer

Move backup media to the same server to reduce transfer time.

Answer

Eliminate differential backups and rely only on weekly full backups.

Question 4

The SOC has contained a mailbox compromise by resetting the password and revoking active sessions. Investigation shows the attacker created an automatic forwarding rule and added an OAuth consent grant. What should happen next to eradicate the threat?

Accepted Answer

Remove the malicious forwarding rule and review or revoke suspicious OAuth app grants.. Option C is correct because the immediate next step after containment is to remove the attacker's persistence mechanisms. The malicious forwarding rule (which exfiltrates emails via SMTP) and the OAuth consent grant (which provides persistent API access) must be removed to fully eradicate the threat. Simply resetting the password and revoking sessions does not remove these backdoors, as OAuth grants persist independently of user credentials.

Answer

Notify all employees to be more careful with email before taking any technical steps.

Answer

Delete the mailbox and create a new account for the user immediately.

Answer

Restore the user's messages from backup and reopen access without further review.

Question 5

Based on the exhibit, which change best helps the company meet its recovery objectives after a ransomware event?

Accepted Answer

Move backups to an immutable, offline or logically isolated repository and test restores regularly.. Option B is correct because ransomware often encrypts or deletes accessible backups. An immutable, offline, or logically isolated repository prevents attackers from modifying or deleting backup data, ensuring a clean recovery point. Regularly testing restores validates that the backups are functional and meet recovery objectives (RTO/RPO). This aligns with the 3-2-1 backup rule and NIST SP 800-184 guidance for ransomware recovery.

Answer

Increase the retention period on the existing NAS backups to one year.

Answer

Store the backup administrator password in a shared team spreadsheet so more staff can restore data quickly.

Answer

Replace the nightly full backup with a longer full backup window to capture more data each day.

Question 6

Based on the exhibit, what is the most likely conclusion after correlating the logs?

A configuration-management task ran from a jump host and generated repeated login alerts on target servers. The SOC wants to determine whether this is malicious activity or approved automation.

Accepted Answer

This is a likely false positive caused by approved automation, so the alert should be correlated with the change window.. Option B is correct because the logs show repeated login attempts from a jump host, which is a common pattern for configuration-management tools (e.g., Ansible, Puppet) that execute tasks across multiple servers. The SOC should correlate these events with the approved change window to confirm they are part of legitimate automation, not malicious activity. Failed logins alone do not indicate a brute-force attack, as automation scripts may retry connections or use cached credentials that occasionally fail due to network latency or credential rotation.

Answer

This is a true brute-force attack because any failed login must be malicious.

Answer

This indicates DNS poisoning because both servers were contacted from the same source IP.

Answer

This is proof of ransomware spreading laterally over SMB.

Question 7

Based on the exhibit, what is the best immediate action for the SOC or IR team?

A finance workstation shows evidence of a macro-launched script, followed by file renaming and lateral SMB traffic to two other hosts. The team has not yet determined the full scope of the incident.

Accepted Answer

Isolate the host from the network and revoke its remote access to stop further spread.. The exhibit shows a macro-launched script, file renaming, and lateral SMB traffic to two other hosts, indicating active lateral movement. Isolating the host (e.g., via network access control or disabling the switch port) immediately stops the spread of the malware to other systems, preserving the ability to investigate without further compromise. This aligns with the first step in incident response: containment before eradication or recovery.

Answer

Restore the workstation from backup immediately before preserving any evidence.

Answer

Run a vulnerability scan against the subnet to see whether the malware exploited an unpatched service.

Answer

Notify users to ignore the issue until the next maintenance window because the incident is likely self-limiting.

Question 8

Based on the exhibit, what is the best eradication decision for the server compromise?

Accepted Answer

Rebuild the server from a trusted image and restore only known-good data after evidence is preserved.. Option C is correct because a server compromise implies that the attacker may have achieved persistence through modified binaries, kernel modules, or rootkits that cannot be reliably removed by simple remediation steps. Rebuilding from a trusted image ensures that all malicious artifacts are eliminated, and restoring only known-good data from backups (after forensic preservation) prevents reintroduction of compromised files. This aligns with the CompTIA incident response process, where eradication must remove all traces of the threat, and rebuilding is the safest approach for a confirmed compromise.

Answer

Restart sshd and monitor the system for another login attempt.

Answer

Manually delete the cron entry and reverse the SSH change on the live server.

Answer

Increase the SIEM retention period and keep the current server online.

Question 9

A SOC analyst reviews email platform logs for a finance user account. At 08:12, the user successfully signs in from Denver. At 08:15, the same account signs in from a residential ISP in another state. At 08:16, the mailbox creates a new external forwarding rule and deletes the original alert message. The user says they did not set up forwarding. What is the best assessment?

Accepted Answer

True positive indicating likely account compromise and unauthorized mailbox abuse.. The rapid succession of logins from geographically distant locations (Denver and a different state via a residential ISP) within three minutes, followed immediately by creation of an external forwarding rule and deletion of the original alert message, is a classic indicator of account takeover. The user's denial of setting up forwarding confirms the activity is unauthorized. This pattern aligns with attacker behavior: after compromising credentials, they establish persistence (forwarding) and cover tracks (deleting alerts).

Answer

False positive caused by normal mailbox synchronization behavior across devices.

Answer

Benign activity because the user successfully authenticated with valid credentials and no malware was detected.

Answer

A denial-of-service event because the attacker is attempting to overwhelm the mail system.

Question 10

A scan keeps reporting the same medium-severity TLS configuration issue on a public web server. The application owner says the vendor software cannot be changed until next quarter, but they can place the service behind a reverse proxy that enforces stronger cipher settings. How should the issue be handled in the vulnerability management process?

Accepted Answer

Record an exception, document the compensating control, and set a review or remediation date. Option B is correct because the vulnerability management process requires that when a vulnerability cannot be immediately remediated, compensating controls must be formally documented as an exception with a scheduled remediation date. In this scenario, the reverse proxy enforces stronger cipher settings, effectively mitigating the TLS misconfiguration at the network edge, which is a valid compensating control. Recording the exception ensures auditability and prevents the finding from being prematurely closed while the vendor software remains vulnerable.

Answer

Close the finding as fixed because the reverse proxy reduces the risk

Answer

Mark the finding as a false positive and remove it from future scans

Answer

Ignore the finding until the vendor releases a new version

Question 11

Based on the exhibit, what is the most likely explanation for the alert?

Accepted Answer

The workstation has been redirected to an approved corporate proxy, so the event is expected.. The alert indicates that the workstation's DNS traffic is being redirected to an internal proxy server (10.0.0.53), which is a common configuration in corporate environments for content filtering and security monitoring. Since the destination IP (10.0.0.53) is within the organization's private IP range and the proxy is explicitly approved, this behavior is expected and not malicious. The event is consistent with a transparent proxy or DNS-based proxy redirection, where the workstation's DNS queries are intercepted and forwarded to the corporate proxy.

Answer

A DNS cache poisoning attack is in progress and the workstation is now using a rogue gateway.

Answer

The endpoint is infected with malware that is hiding its traffic through encrypted tunnels.

Answer

The workstation is under a denial-of-service attack because it sent repeated DNS lookups.

Question 12

A SIEM rule flags a Linux server because it makes outbound HTTPS connections to the same cloud IP every 15 minutes. The server runs an approved patch agent that should check in on a regular schedule. Which two checks best validate whether the alert is a false positive? Select two.

Accepted Answer

Compare the process name, parent process, and digital signature to the approved agent baseline.. Option A is correct because comparing the process name, parent process, and digital signature against the approved agent baseline directly validates that the traffic originates from the legitimate patch agent and not from malware masquerading as the agent. This is a standard host-based validation technique to confirm the source process integrity before investigating network alerts.

Answer

Assume the traffic is benign because it happens on a fixed schedule.

Answer

Suppress all alerts from the host permanently after this one event.

Answer

Stop collecting logs from the server so the same alert does not recur.

Question 13

A legacy application server has a critical vulnerability, but the vendor will not release a fix for 30 days. Which two compensating controls are the best short-term risk reduction steps? Select two.

Accepted Answer

Restrict access to the server to known admin IPs or a jump host.. Option A is correct because restricting access to the server to known admin IPs or a jump host reduces the attack surface by limiting who can reach the vulnerable service. This network-layer control (e.g., using ACLs or firewall rules) prevents exploitation from untrusted sources while the vendor patch is pending. It is a classic compensating control that buys time without modifying the application itself.

Answer

Document the issue and wait for the vendor patch without making any changes.

Answer

Open the service to more networks so monitoring tools can see it better.

Answer

Disable logging to reduce the performance overhead caused by the vulnerability.

Question 14

An IDS raises an alert for a possible SQL injection attack against an internal reporting portal. The web server logs show the source IP belongs to the company's vulnerability scanner, and the requests match the scanner's normal test pattern. What is the most appropriate analyst action?

Accepted Answer

Mark the alert as a likely false positive after verifying the scanner schedule and source IP.. Option B is correct because the IDS alert matches the known behavior of the company's vulnerability scanner, which is a legitimate and scheduled security tool. Verifying the scanner schedule and source IP confirms the traffic is authorized, making the alert a false positive. Analysts should correlate IDS alerts with asset inventories and change management records to avoid unnecessary incident response actions.

Answer

Treat the alert as a confirmed breach and begin password resets for all portal users.

Answer

Block the scanner IP permanently to prevent future alerts from the same host.

Answer

Quarantine the reporting server because IDS alerts always indicate active exploitation.

Question 15

A SIEM alert shows a workstation connecting to the same unknown internet address every 15 minutes, even after business hours. The device belongs to an employee who is on vacation. What is the best next step for the analyst?

Accepted Answer

Treat the alert as potentially malicious and check endpoint and proxy logs for more context.. Option B is correct because the alert describes a persistent outbound connection to an unknown external IP address at regular intervals, which is a classic indicator of beaconing behavior often associated with malware command-and-control (C2) traffic. The fact that the connection occurs after business hours and the workstation's user is on vacation increases suspicion, as legitimate scheduled tasks or updates would typically not run under those conditions. Checking endpoint and proxy logs provides the necessary context to determine if the traffic is benign (e.g., a misconfigured service) or malicious (e.g., C2 communication).

Answer

Dismiss the alert because periodic connections are always normal for workstations.

Answer

Immediately delete the workstation account from the directory service.

Answer

Shut down the entire office network until the analyst can review the alert.