20+ practice questions focused on Security Operations — one of the most tested topics on the Security+ SY0-701 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Security Operations PracticeA security operations analyst is tuning a SIEM correlation rule designed to detect brute-force password attacks against domain user accounts. The current rule generates an alert when a single user account has more than 10 failed logon attempts within a 5-minute window. The SOC team is overwhelmed by thousands of alerts each day, the vast majority of which are triggered by legitimate users who accidentally mistype their passwords. Which of the following modifications to the rule would most effectively reduce false positives while still detecting actual brute-force attacks?
Explanation: Increasing the failed attempt threshold to 20 attempts within the same 5-minute window reduces false positives from legitimate users while still detecting brute-force attacks, which typically produce many more failures in a short period. Option B would suppress all single-source brute-force attacks, creating significant false negatives.
A security analyst is reviewing the perimeter firewall logs. The analyst observes repeated TCP SYN packets from a single external IP address (203.0.113.50) to multiple internal IP addresses on TCP port 3389. The packets are sent with a consistent 50-millisecond interval. There are no subsequent SYN-ACK or RST packets from the internal hosts in the logs. The analyst suspects this is a reconnaissance scan. Which of the following additional log sources would provide the most definitive evidence to confirm this suspicion?
Explanation: A network-based IDS placed behind the firewall can analyze traffic that passes through the firewall and detect patterns consistent with a SYN scan, such as multiple SYN packets from a single source to multiple destinations without corresponding SYN-ACK or RST responses. It correlates the consistent interval and targeting of port 3389 to provide strong evidence of reconnaissance. However, if the firewall drops the packets before they reach internal hosts, an IDS behind the firewall would not see them. Since the firewall logs show the SYNs, the packets may be forwarded, allowing the IDS to observe them. Among the options, the IDS is the most definitive source for confirming the scan.
A digital forensics analyst is investigating a suspected insider threat. The analyst has acquired a laptop used by the suspect. The analyst needs to obtain a forensic image of the hard drive without altering any data. The laptop is running and logged into the suspect's user account. Which of the following is the most appropriate first step for the analyst to take?
Explanation: To preserve the hard drive without alteration, the analyst must perform a true hard shutdown that removes all power sources (AC and battery) or forces a power-off (e.g., by holding the power button). Simply unplugging AC power on a laptop leaves it running on battery, so the system can continue writing to the disk. In this scenario, none of the listed options correctly describes the first step, as the proper action (remove battery/AC or forced power-off) is absent.
A firewall rule was added directly in production to allow a new vendor IP range, and an internal service stopped responding because the new rule was placed above an existing deny rule. Which two change-management practices would have reduced the risk? Select two.
Explanation: Testing the rule in a staging environment that mirrors production allows you to verify the rule's behavior—specifically its placement relative to existing deny rules—without risking service disruption. In a firewall rulebase, rules are processed top-down, and a new permit rule placed above a deny rule can inadvertently match and permit traffic that was previously denied, or conversely, block traffic if the rule is misordered. Staging testing would have revealed that the new rule's position caused the internal service to stop responding, enabling adjustment before production deployment. Additionally, requiring peer review and approval with a documented rollback plan ensures that changes are independently checked for issues like rule ordering and provides a quick way to revert the change if something goes wrong, minimizing impact on the internal service.
A privileged cloud administrator account shows two suspicious events: an API key was created from an unfamiliar IP address, and a mailbox forwarding rule was added five minutes later. The account is still active and may be in attacker control. Which two actions should the analyst take first to preserve evidence while limiting additional abuse? Select two.
Explanation: Exporting identity and audit logs before making changes preserves the original event trail, which is critical for forensic analysis and chain of custody. Revoking the suspicious API key or active session token immediately stops the attacker's access without deleting or altering the logs, thus limiting additional abuse while preserving evidence. Deleting the forwarding rule or disabling email could destroy evidence and should not be performed before the logs are exported.
+15 more Security Operations questions available
Practice all Security Operations questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Security Operations. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Security Operations questions on the SY0-701 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Security Operations is tested as part of the Security+ SY0-701 blueprint. Practicing with targeted Security Operations questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free SY0-701 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Security Operations is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Security Operations practice session with instant scoring and detailed explanations.
Start Security Operations Practice →