SY0-701 Security Operations Practice Question
Exhibit
Microsoft 365 audit trail for user amaya@corp.example: 09:41 User clicked link from external message and signed into a lookalike portal 09:42 OAuth consent granted to app 'ExpenseReport-Helper' scopes=Mail.Read, offline_access, User.Read 09:44 Inbox rule created: if subject contains 'invoice' then forward to finance-relay@external.example 09:46 Refresh token issued from unfamiliar IP 203.0.113.88 09:51 Admin deleted inbox rule 09:52 Password changed successfully
Based on the exhibit, what is the most important next IR action?
⚠ Common exam trap
Many exam-takers assume changing the password is sufficient to stop an attacker, but they overlook that OAuth tokens and active sessions persist independently of password changes, allowing continued unauthorized access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Revoke active sessions and OAuth consent grants for the account.
The exhibit shows a compromised account with a suspicious inbox rule forwarding emails externally. The most critical next step is to revoke active sessions and OAuth consent grants to immediately terminate the attacker's access and prevent further data exfiltration, as changing the password alone does not invalidate existing OAuth tokens or active sessions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the password again and monitor the mailbox for a few days.
Why it's wrong here
A second password change does not revoke the malicious app consent or invalidate all active tokens. Monitoring alone leaves a persistence mechanism in place, so the attacker may still be able to access mail through OAuth grants or existing refresh tokens.
- ✓
Revoke active sessions and OAuth consent grants for the account.
Why this is correct
The password has already been changed and the inbox rule removed, but the audit trail shows an OAuth consent grant and a refresh token issued from an unfamiliar IP. Those tokens can continue to authorize access even after a password reset. Revoking active sessions and removing the malicious consent closes the persistent access path.
- ✗
Restore the deleted inbox rule from backup to preserve evidence.
Why it's wrong here
Restoring the deleted inbox rule from backup would immediately re-apply the malicious forwarding logic, causing any newly received emails to be silently exfiltrated to the attacker's address again. That action directly recreates the compromise artifact and escalates data loss risk, whereas the rule's original behavior is already captured in audit logs and mail flow records for forensic analysis. Evidence preservation requires preserving logs and exporting the rule's details, not re-introducing the active malicious configuration.
- ✗
Close the incident because the forwarding rule was removed.
Why it's wrong here
Closing the incident after only removing the forwarding rule is dangerous because the audit trail reveals an OAuth consent grant and a refresh token issued from an unfamiliar IP address. Those tokens grant persistent access to the mailbox independent of the account password, so even though the password was changed, the attacker can still authenticate via the refresh token and continue reading or forwarding mail. Incident closure requires eliminating every persistence mechanism; the OAuth consent and associated tokens must be revoked and verified before the incident can be considered remediated.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. The SOC has contained a mailbox compromise by resetting the password and revoking active sessions. Investigation shows the attacker created an automatic forwarding rule and added an OAuth consent grant. What should happen next to eradicate the threat?
medium- A.Notify all employees to be more careful with email before taking any technical steps.
- B.Delete the mailbox and create a new account for the user immediately.
- ✓ C.Remove the malicious forwarding rule and review or revoke suspicious OAuth app grants.
- D.Restore the user's messages from backup and reopen access without further review.
Why C: The immediate next step after containment is to remove the attacker's persistence mechanisms. The malicious forwarding rule (which exfiltrates emails via SMTP) and the OAuth consent grant (which provides persistent API access) must be removed to fully eradicate the threat. Simply resetting the password and revoking sessions does not remove these backdoors, as OAuth grants persist independently of user credentials.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.