SY0-701 Security Operations Practice Question
A SIEM reports a successful sign-in to a SaaS admin portal from a new country, followed three minutes later by multiple configuration changes to mailbox forwarding rules. The account owner says they were in the office and did not approve any changes. What should the analyst check next?
⚠ Common exam trap
The trap here is that candidates may focus on endpoint indicators (antivirus, DNS) or unrelated logs (printer) instead of recognizing that the core issue is authentication integrity, which must be verified through identity provider and MFA logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The identity provider and MFA logs to confirm whether the session was legitimately authenticated or hijacked.
The SIEM alert shows a successful sign-in from a new country followed by suspicious configuration changes, which is a classic indicator of session hijacking or credential theft. Checking the identity provider (IdP) and MFA logs allows the analyst to verify if the authentication was legitimate (e.g., from a known device/IP) or if the session token was stolen and reused, as MFA can be bypassed via token replay or consent phishing. This step directly addresses the core question of whether the session was authorized or compromised.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The identity provider and MFA logs to confirm whether the session was legitimately authenticated or hijacked.
Why this is correct
Because the sign-in succeeded and configuration changes followed quickly, the key question is whether the session was legitimately established or taken over. Identity provider logs, MFA approvals, token issuance, and session details can confirm whether the login came from the owner or from a stolen credential/session. This is the most direct way to validate the alert before taking disruptive action.
- ✗
The office printer logs to see whether the user printed the mailbox rules.
Why it's wrong here
Office printer logs capture physical output jobs and are stored on the print server or printer itself. They cannot indicate whether mailbox rules were configured, because mailbox rules reside in Microsoft Exchange Online or the SaaS mail system, not in local print queues. Even if a user had printed a rules document, it would not validate the authenticity of the remote SaaS sign-in session or prove that the session wasn't hijacked, making printer logs irrelevant to this investigation.
- ✗
The antivirus signature version on the user’s laptop only.
Why it's wrong here
Checking only the antivirus signature version on the user's laptop tells you whether the endpoint's malware definitions are current, which is a separate concern from cloud authentication. It does not include the identity provider's authentication request log, MFA challenge response, token issuance details, or the network source of the sign-in, so it cannot confirm whether the session was legitimately established or stolen. An attacker could have phished credentials and used them from an anomalous IP while the user's laptop remains physically clean, so AV status alone neither validates nor disproves session hijacking.
- ✗
The DNS cache on the user’s laptop to find the forwarding rule target.
Why it's wrong here
The DNS cache on the user's laptop maps domains to IP addresses for previously resolved hosts and may include microsoftonline.com or other IdP endpoints, but it does not store mailbox configuration changes. A forwarding rule target is an email address configured in the cloud mailbox's server-side transport rules, not a DNS name that would be cached locally, so looking up DNS cannot reveal where messages are being forwarded. Moreover, DNS cache evidence would not prove whether the original sign-in was legitimate or hijacked, so it fails to answer the central question of session authenticity.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.