SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The workstation user says the activity looks normal and no files were encrypted.

  Why it's wrong here

  A user's subjective assessment that the activity looks normal is anecdotal and cannot override objective network telemetry. Beaconing often uses benign-looking or intermittent traffic that easily passes casual observation, and the lack of file encryption does not rule out reconnaissance, data exfiltration, or command-and-control traffic that never installs ransomware. Analysts need to correlate process execution, parent-child relationships, and destination reputation rather than rely on user reassurance or incident-specific artifacts.

• ✗

  The source IP appears on a blocklist, so the alert must be malicious.

  Why it's wrong here

  The presence of a source IP on a blocklist indicates a prior association with malicious activity, but it does not prove that current traffic is hostile, especially when the IP is reused across hosts or networks. Blocklists are often stale or generated from automated systems that can produce false positives, such as shared hosting addresses or dynamic consumer ranges. A definitive verdict requires inspecting the actual payloads, TLS metadata, and whether the connection pattern aligns with a known legitimate application or agent.

• ✓

  Process lineage and signed agent logs show the patch client initiated the traffic on schedule.

  Why this is correct

  Process lineage and agent logs provide strong proof that the traffic came from the approved patch client. When the destination is a known vendor service and the timing matches the expected update schedule, the repeated connections are likely normal behavior. This is exactly the kind of evidence analysts should use to validate a detection instead of escalating a benign operational pattern.

• ✗

  The workstation has antivirus installed, which means outbound beaconing is impossible.

  Why it's wrong here

  Antivirus software is a host-based control that relies on signatures and behavioral heuristics, and it does not independently inspect TLS-encrypted outbound traffic or process-level network activity. Modern malware, including fileless variants and living-off-the-land binaries, can evade AV while maintaining persistent beaconing. Moreover, the presence of AV does not address firewall policies or other network defenses, so the absence of a local detection does not preclude an active command-and-control channel.