SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Compare the process name, parent process, and digital signature to the approved agent baseline.

  Why this is correct

  When a SIEM flags outbound traffic, examining the process name and parent process establishes the execution context; a patch agent like SCCM or WSUS will run from an expected parent and have a valid digital signature from the vendor. Matching these attributes against an approved baseline provides high-confidence evidence that the alert is a false positive, because unsigned or anomalous process trees are a common malware indicator.

• ✓

  Verify the destination domain and certificate chain against vendor documentation.

  Why this is correct

  A legitimate patch agent connects to vendor-controlled endpoints with certificates issued to that vendor, so checking the destination domain and certificate chain against official documentation confirms the traffic is expected. Malicious beaconing often uses hardcoded IPs, brand-impersonating domains, or self-signed certificates; the certificate chain validation adds cryptographic assurance that the endpoint is genuinely operated by the vendor.

• ✗

  Assume the traffic is benign because it happens on a fixed schedule.

  Why it's wrong here

  A fixed schedule is not a reliable indicator of legitimacy; many malware families use periodic beaconing to evade detection and maintain C2 channels. Security analysts must validate the source process, destination, and signature before dismissing the alert, rather than relying solely on timing patterns.

• ✗

  Suppress all alerts from the host permanently after this one event.

  Why it's wrong here

  Permanently suppressing alerts for a host after a single event eliminates visibility and may mask subsequent malicious activity, especially if the original alert was actually a false negative. Tuning should be minimal and evidence-based—ideally scoped to the specific process or destination—and should never be based on a one-time assumption that no further investigation is needed.

• ✗

  Stop collecting logs from the server so the same alert does not recur.

  Why it's wrong here

  Disabling log collection on the server is disruptive and degrades the security posture, making it harder to perform incident response or retrospectively analyze behavior. Instead of preventing future alerts, the analyst should validate the current alert and, if warranted, adjust the rule with a specific exception that still retains the log data for auditing.