SY0-701 Security Operations Practice Question
A SIEM alert shows a workstation connecting to the same unknown internet address every 15 minutes, even after business hours. The device belongs to an employee who is on vacation. What is the best next step for the analyst?
⚠ Common exam trap
A common mix-up: candidates assume periodic connections are always benign (e.g., Windows Update or NTP sync) and dismiss the alert, failing to recognize that the regularity, unknown destination, and user-on-vacation context are red flags for malicious C2 activity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Treat the alert as potentially malicious and check endpoint and proxy logs for more context.
The alert describes a persistent outbound connection to an unknown external IP address at regular intervals, which is a classic indicator of beaconing behavior often associated with malware command-and-control (C2) traffic. The fact that the connection occurs after business hours and the workstation's user is on vacation increases suspicion, as legitimate scheduled tasks or updates would typically not run under those conditions. Checking endpoint and proxy logs provides the necessary context to determine if the traffic is benign (e.g., a misconfigured service) or malicious (e.g., C2 communication).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dismiss the alert because periodic connections are always normal for workstations.
Why it's wrong here
Periodic outbound connections can indeed reflect benign activity such as software updates, telemetry heartbeats, or license checks, but the alert explicitly flags an unknown destination, and that unknown factor—not the timing—is what requires investigation. Dismissing on periodicity alone ignores that C2 beaconing often uses regular, predictable intervals specifically to blend in with normal traffic. A correct response is to validate the destination reputation and correlate with endpoint logs before deciding anything about the alert.
- ✓
Treat the alert as potentially malicious and check endpoint and proxy logs for more context.
Why this is correct
Treating the alert as potentially malicious is the appropriate first response because an unknown destination contacted at regular intervals is a classic beaconing signature used by command-and-control (C2) malware. Checking endpoint logs can reveal the executable or script initiating the connection, while proxy logs provide the full URL, TLS SNI, and destination categorization needed to assess reputation. This non-destructive correlation gives the analyst the context required to determine whether the traffic is a true positive or a benign service, and it preserves forensic data for later investigation.
- ✗
Immediately delete the workstation account from the directory service.
Why it's wrong here
Immediately deleting the workstation account from the directory service is destructive and premature, as it locks out the entire user environment and can destroy attribution data such as group memberships that might later help correlate the alert. Moreover, account deletion does not terminate the existing network connection or stop the malicious process from continuing to run on the endpoint, so it fails as a containment measure. The proper step is to isolate the host at the network layer and investigate evidence before taking any irreversible account action.
- ✗
Shut down the entire office network until the analyst can review the alert.
Why it's wrong here
Shutting down the entire office network is a disproportionate and highly disruptive action that takes down production systems for all users and applications based on a single unconfirmed alert. A broader network shutdown also deprives the analyst of live evidence, such as active connections and process memory, while doing nothing to identify the root cause. Incident response best practice is to contain the affected workstation individually—for example by disconnecting its switch port or using EDR isolation—and then analyze logs with minimal business impact.
Go deeper
Related to this question
Learn chapter
Log Monitoring and SIEM
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.