SY0-701 Security Operations Practice Question

• A.Disable the user account immediately to prevent further access
• ✓ B.Contact the user to verify whether the authentication was legitimate
• C.Continuously monitor the account for additional suspicious activity
• D.Revoke all active sessions for the user account

Why B: The correct next step is to contact the user to verify whether the authentication was legitimate. Since the authentication was successful and the user has not reported suspicious activity, the analyst must first gather context from the user before taking any disruptive action. This aligns with the incident response process of validation and scoping before containment.

• A.Disable the domain admin account immediately and wait for the backup team to respond.
• ✓ B.Correlate the authentication event with the change ticket and the scheduled task details.
• C.Escalate the alert as confirmed compromise because the login occurred after hours.
• D.Delete the scheduled task so it cannot be used again.

Why B: Option B is correct because the alert involves a domain admin authentication from a jump host at an unusual time, but the scheduled task was created during a change window. Correlating the authentication event with the change ticket and the scheduled task details allows the SOC analyst to verify if the activity was authorized, preventing unnecessary incident response. This step aligns with the incident response process of validating alerts before taking action.

• A.Reset the password and leave the account enabled so the user can keep working.
• ✓ B.Disable the account and revoke active sessions and tokens.
• C.Delete the forwarding rule and monitor the account for a few hours.
• D.Wait for the user to confirm the login before taking any action.

Why B: Option B is correct because the combination of failed MFA prompts followed by a successful login and immediate creation of an external mailbox forwarding rule is a classic indicator of account compromise (e.g., adversary-in-the-middle or token theft). Disabling the account and revoking active sessions and tokens stops the attacker from maintaining access and prevents further data exfiltration via the forwarding rule, which is the most urgent containment step in incident response.

• A.Ignore the alert because the login eventually succeeded.
• ✓ B.Temporarily disable the account and open an incident for investigation.
• C.Reset the password only and close the alert.
• D.Reboot the user's laptop to clear any malicious activity.

Why B: Option B is correct because the alert shows a classic indicator of account compromise: multiple failed logins followed by a successful authentication from an unusual location. The account owner's denial of the login confirms unauthorized access, so the immediate priority is to contain the threat by disabling the account and opening an incident for formal investigation. This aligns with the NIST SP 800-61 incident response process, specifically the containment phase before eradication or recovery.

• A.Immediately disable the account and wait for the employee to return.
• ✓ B.Verify the login context with the user or manager and review recent authentication history.
• C.Close the alert as a false positive because the user is on vacation.
• D.Reimage the user’s workstation before checking any logs.

Why B: Option B is correct because the first step in incident response is to verify the alert's validity and gather context before taking action. The analyst should review the SIEM logs for authentication details (e.g., source IP, geolocation, timestamp) and confirm with the user or manager whether the login was expected. This aligns with the NIST SP 800-61 incident response process, which emphasizes triage and validation before containment.

• ✓ A.Export the relevant identity and audit logs before making changes, so the original event trail is preserved.
• ✓ B.Revoke the suspicious API key or active session token, so the attacker loses immediate access.
• C.Delete the mailbox forwarding rule and empty the trash folder, so the attacker cannot read old messages.
• D.Reimage the admin workstation immediately, because the issue must have started on the endpoint.
• E.Disable all company email for every user until the account investigation is finished.

Why A: Option A is correct because exporting identity and audit logs before any changes preserves the original event trail, which is critical for forensic analysis and chain of custody. If logs are altered or rotated after the fact, evidence of the attacker's actions (e.g., API key creation from an unfamiliar IP) could be lost or overwritten, hindering the investigation.

• A.Stop the investigation because the forwarding rule was deleted.
• ✓ B.Reset credentials and verify there are no other persistence methods before recovery.
• C.Close the ticket and tell the user to be more careful next time.
• D.Wait one week before taking any action so the attacker does not notice.

Why B: After removing a mailbox forwarding rule, the team must reset the compromised account's credentials and verify that no other persistence mechanisms (e.g., additional forwarding rules, OAuth app grants, or mailbox delegation) remain. This ensures the attacker cannot regain access using cached credentials or alternate backdoors, which is critical before returning the account to production.

• A.Close the incident because the password reset removed the attacker from the environment.
• ✓ B.Remove mailbox persistence, revoke all tokens and app consent, then monitor for reentry.
• C.Reimage the user's laptop before reviewing mailbox settings.
• D.Restore the mailbox from backup to remove the forwarding rule and keep the user productive.

Why B: Option B is correct because after containing a compromised account (e.g., disabling it or resetting its password), the attacker may still have established persistence mechanisms such as mailbox forwarding rules, OAuth app consent grants, or session tokens that survive a password reset. Removing these artifacts and revoking all tokens and app consents ensures the attacker cannot regain access via delegated permissions or persistent mailbox rules. Monitoring for reentry is critical to detect any residual access or new compromise attempts.