SY0-701 Security Operations Practice Question
After restoring a virtual file server from last night’s backup, users can browse shares, but finance reports that several spreadsheet edits from yesterday are missing. What should the administrator verify next before declaring the restore successful?
⚠ Common exam trap
It's easy for candidates to assume a successful restore of shares means all data is intact, overlooking the critical distinction between crash-consistent and application-consistent backups and the role of transaction logs in recovering recent changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Whether the backup job used the correct restore point and included the needed transaction logs.
The missing spreadsheet edits indicate that the backup may have been taken before those changes were committed. The administrator must verify that the restore point includes the necessary transaction logs (e.g., from a VSS-aware backup or application-consistent snapshot) to recover the most recent data. Without these logs, any edits made after the last full backup are lost, so confirming the correct restore point and log inclusion is the next logical step before declaring success.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Whether the backup job used the correct restore point and included the needed transaction logs.
Why this is correct
This is the best next verification because the missing spreadsheet edits suggest the restore point may be older than the required recovery window, or application-related log data may not have been captured. Confirming the exact backup set, restore timestamp, and transaction log coverage helps determine whether the restore actually meets the business recovery objective. It also shows whether the issue is incomplete backup scope or simple user expectation mismatch.
- ✗
Whether the file server antivirus signatures are fully up to date.
Why it's wrong here
Antivirus signature freshness is a security baseline, but it does not cause or explain missing spreadsheet edits after a restore. Since users can already browse the shares, the problem is not malware-related or a blocking issue. The restore's data completeness depends on backup scope and recovery point, not on the AV definition version installed on the restored VM.
- ✗
Whether the share permissions were tightened during the restore.
Why it's wrong here
Share permissions control whether users can see or modify files, yet the users can already access the shares—so visibility is intact. Tightened permissions would generate access-denied errors, not silently delete or omit files from the restored data. A restore typically preserves the original ACLs, and any permission drift would be a separate authorization problem, not the reason for missing spreadsheet edits.
- ✗
Whether the virtual machine has enough CPU and memory allocated.
Why it's wrong here
Insufficient CPU or memory might make the restored VM slow or unresponsive, but it would not remove files or roll back changes from the spreadsheet. The fact that users can browse the shares indicates the VM is functioning at a basic level, so resource starvation is not the immediate concern. The missing data is a direct result of the backup/recovery process, not of compute capacity or allocation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.