SY0-701 Security Operations Practice Question
A security analyst is reviewing web server logs after a user reports that the company website displayed an error message containing raw database queries. The log shows repeated requests to the product search page with the following parameter: `?id=1 OR 1=1`. Which of the following should the analyst do FIRST to confirm the nature of the suspected attack?
⚠ Common exam trap
The trap here is that candidates may jump to containment (blocking or isolating) or scanning without first using existing logs to confirm the attack, failing to follow the incident response principle of 'verify before act'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify the request details against the web application firewall logs.
The analyst should first verify the request details against the web application firewall (WAF) logs to confirm whether the WAF detected and blocked the SQL injection attempt. The parameter `?id=1 OR 1=1` is a classic SQL injection payload, and WAF logs provide immediate evidence of whether the request was flagged, allowed, or blocked, enabling the analyst to correlate the user's report with actual security controls before taking further action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a vulnerability scan against the web server.
Why it's wrong here
While a vulnerability scan could eventually identify the SQL injection flaw, it is not the immediate first step. The analyst needs to quickly determine if the attack was successful or blocked, which is better done via log correlation.
When this WOULD be correct
A vulnerability scan would be the correct first step when the question states that the analyst needs to proactively identify all potential vulnerabilities in the web application before any attack is reported, such as during a routine security assessment.
- ✗
Block the source IP address in the firewall.
Why it's wrong here
Blocking the IP may be a later containment step, but it does not help confirm the nature of the attack. The IP could be spoofed or belong to a legitimate user whose session was hijacked. Confirmation via WAF logs is needed first.
When this WOULD be correct
A question where the analyst has already confirmed a SQL injection attack and needs to immediately stop the attack from a specific IP while preserving evidence. For example: 'After confirming a SQL injection attack in progress, which action should the analyst take FIRST to mitigate the immediate threat?'
- ✓
Verify the request details against the web application firewall logs.
Why this is correct
Checking the WAF logs is the authoritative first step because they contain the full HTTP transaction metadata, including headers, request body, and the WAF's decision (e.g., rule match, blocked, or allowed). By correlating the web server access log timestamps and request IDs with WAF events, the analyst can definitively confirm whether the SQLi payload was actually blocked or reached the application. This evidence-based verification determines the incident scope and prevents wasting time on false positives. Without this correlation, any further action—including containment or scanning—could be based on an unverified assumption that the attack succeeded.
- ✗
Isolate the web server from the network immediately.
Why it's wrong here
Isolating the web server immediately is an overreaction at this stage because the WAF logs may show the request was already blocked, making network isolation unnecessary and causing avoidable business disruption. Moreover, cutting the server off from the network without first confirming the attack's success can destroy volatile evidence such as active network connections, memory contents, and real-time user sessions that are critical for forensics. Even if isolation later becomes necessary, it must follow the incident response plan's containment phase, which begins only after log correlation confirms a true positive. Premature isolation also prevents the analyst from observing an ongoing attack, which is essential for understanding the attacker's methods.
When this WOULD be correct
A question where the web server is actively being exploited (e.g., showing signs of data exfiltration or ransomware) and the analyst must contain the threat immediately to prevent further damage. For example: 'An IDS alerts on outbound database traffic from the web server; what should the analyst do FIRST?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Verify the request details against the web application firewall logs.Correct answer▾
Why this is correct
Checking the WAF logs is the authoritative first step because they contain the full HTTP transaction metadata, including headers, request body, and the WAF's decision (e.g., rule match, blocked, or allowed). By correlating the web server access log timestamps and request IDs with WAF events, the analyst can definitively confirm whether the SQLi payload was actually blocked or reached the application. This evidence-based verification determines the incident scope and prevents wasting time on false positives. Without this correlation, any further action—including containment or scanning—could be based on an unverified assumption that the attack succeeded.
✗Run a vulnerability scan against the web server.Wrong answer — click to see why▾
Why this is wrong here
Running a vulnerability scan is a secondary step after confirming the attack; the analyst first needs to verify the request details in the WAF logs to determine if the attack was blocked or reached the server.
★ When this WOULD be the correct answer
A vulnerability scan would be the correct first step when the question states that the analyst needs to proactively identify all potential vulnerabilities in the web application before any attack is reported, such as during a routine security assessment.
Why candidates choose this
Candidates may think a vulnerability scan is the standard first step for any security issue, but in this incident response scenario, confirming the attack details takes precedence over scanning.
✗Block the source IP address in the firewall.Wrong answer — click to see why▾
Why this is wrong here
Blocking the source IP address in the firewall is a reactive measure that does not confirm the nature of the attack; it only prevents further requests from that IP. The analyst needs to first verify the attack type by correlating logs with the WAF.
★ When this WOULD be the correct answer
A question where the analyst has already confirmed a SQL injection attack and needs to immediately stop the attack from a specific IP while preserving evidence. For example: 'After confirming a SQL injection attack in progress, which action should the analyst take FIRST to mitigate the immediate threat?'
Why candidates choose this
Candidates may think blocking the IP is a quick first step to stop the attack, but the question asks to 'confirm the nature' of the attack, not to mitigate it.
✗Isolate the web server from the network immediately.Wrong answer — click to see why▾
Why this is wrong here
Isolating the web server immediately is premature because the analyst has not yet confirmed the nature of the attack. The log entry suggests a SQL injection attempt, but the first step should be to verify the attack using WAF logs, not to take drastic containment actions that could disrupt services.
★ When this WOULD be the correct answer
A question where the web server is actively being exploited (e.g., showing signs of data exfiltration or ransomware) and the analyst must contain the threat immediately to prevent further damage. For example: 'An IDS alerts on outbound database traffic from the web server; what should the analyst do FIRST?'
Why candidates choose this
Candidates may think that any suspicious activity requires immediate isolation to prevent harm, but they overlook the need for confirmation before taking disruptive actions. The urgency of the error message (raw database queries) can trigger a 'contain first, ask later' mindset.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Wireless Security Protocols
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
SQL
SQL is a standard programming language used to manage, query, and manipulate relational databases by issuing commands like SELECT, INSERT, UPDATE, and DELETE.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.