SY0-701 Security Operations Practice Question
A SOC analyst confirms that an employee entered credentials into a phishing site and that the mailbox now shows a new forwarding rule sending messages to an external address. The account is still signed in on a laptop and a mobile phone. What is the best next action?
⚠ Common exam trap
Many exam-takers think waiting for the user to log out (Option A) is acceptable because the user is still signed in, but in security operations, you must assume the attacker has active access and act immediately to revoke sessions rather than relying on user behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Revoke active sessions and force a password reset for the account.
The immediate priority is to contain the compromised account by terminating all active sessions (revoking OAuth tokens, clearing SAML sessions) and forcing a password reset to prevent further unauthorized access. The mailbox forwarding rule indicates the attacker has established persistence, and the active sessions on the laptop and mobile phone mean the attacker could still be using the account. Revoking sessions ensures the attacker cannot continue exfiltration or lateral movement, while the password reset invalidates the stolen credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wait for the user to log out naturally before taking action.
Why it's wrong here
Waiting for the user to log out naturally leaves the attacker's authenticated session active indefinitely, allowing continued access to the mailbox, potential data exfiltration, and lateral movement. The session token remains valid until logout or an idle timeout, and the attacker can actively use it to read emails, send messages, or modify folder settings. Immediate termination of all active sessions is essential to cut off the attacker's current access path.
- ✓
Revoke active sessions and force a password reset for the account.
Why this is correct
Revoking active sessions immediately invalidates any authentication tokens, cookies, or session identifiers the attacker may have captured, cutting off their current access to the mailbox. Forcing a password reset ensures that the compromised password is no longer valid, preventing the attacker from re-authenticating even if they attempt to log in again. This dual action directly addresses both the active session compromise and the credential compromise, which is essential for containing the incident.
- ✗
Archive the mailbox and close the ticket after notifying the user.
Why it's wrong here
Archiving the mailbox preserves the data for forensic review but does nothing to invalidate the attacker's active sessions or revoke the compromised credentials. It also fails to detect or remove any forwarding rules, delegate access, or inbox rules the attacker may have created, leaving a persistent foothold. Closing the ticket without remediation allows the compromise to continue, increasing the risk of further data exposure and making recovery more difficult.
- ✗
Delete the forwarding rule only and consider the incident closed.
Why it's wrong here
Deleting the forwarding rule only removes one indicator of compromise while ignoring the fact that the attacker may still have valid session tokens or the user's password. Without revoking active sessions and forcing a password reset, the attacker can easily re-create the forwarding rule or access the mailbox directly. Additionally, the attacker might have set up other persistence mechanisms such as mailbox delegation or client-side rules, which remain undetected and continue to pose a threat.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
OAuth
OAuth is an open standard for access delegation that allows users to grant third-party applications limited access to their resources without sharing their credentials.
Key term
Persistence
Persistence is the set of techniques attackers use to maintain long-term access to a compromised system even after reboots or credential changes.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.