SY0-701 Security Operations Practice Question
Exhibit
Change window: approved 01:00-02:00 01:11:44 jump01 ssh to appsrv02 as configsvc from 10.1.10.20 01:11:47 jump01 ssh to appsrv03 as configsvc from 10.1.10.20 01:12:01 appsrv02 auth.log 2 failed password attempts for configsvc, then success with SSH key 01:12:04 appsrv03 auth.log 1 failed password attempt for configsvc, then success with SSH key 01:12:10 SIEM rule 'brute force against privileged account' triggered CMDB / automation note: configsvc is restricted to Ansible playbooks launched only from jump01 during maintenance windows
Based on the exhibit, what is the most likely conclusion after correlating the logs?
A configuration-management task ran from a jump host and generated repeated login alerts on target servers. The SOC wants to determine whether this is malicious activity or approved automation.
⚠ Common exam trap
Candidates often assume any failed login attempt is malicious, but the SY0-701 exam tests the ability to correlate logs with operational context (e.g., change windows, known source IPs) to identify false positives from legitimate automation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
This is a likely false positive caused by approved automation, so the alert should be correlated with the change window.
The logs show repeated login attempts from a jump host, which is a common pattern for configuration-management tools (e.g., Ansible, Puppet) that execute tasks across multiple servers. The SOC should correlate these events with the approved change window to confirm they are part of legitimate automation, not malicious activity. Failed logins alone do not indicate a brute-force attack, as automation scripts may retry connections or use cached credentials that occasionally fail due to network latency or credential rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
This is a true brute-force attack because any failed login must be malicious.
Why it's wrong here
A true brute-force attack is characterized by a high volume of repeated authentication failures from a single source and often targets multiple accounts or systems. In this exhibit, only a small number of failed logins occur, and they are intermingled with successful key-based authentications, which is more consistent with a script retrying credentials than an attacker attempting to guess passwords. Approved automation can produce transient failures, especially if a stored secret was recently rotated, so the alert must be correlated with the change window and known account usage before declaring a compromise.
- ✓
This is a likely false positive caused by approved automation, so the alert should be correlated with the change window.
Why this is correct
The alert lines up with an approved maintenance window, a known jump host, and a documented configuration-management account that should only be used by automation. The mixed failed-and-successful logins are consistent with scripts negotiating authentication rather than an intruder guessing passwords. The SOC should confirm the change record, document the benign cause, and adjust correlation rules if this pattern recurs.
- ✗
This indicates DNS poisoning because both servers were contacted from the same source IP.
Why it's wrong here
DNS poisoning would redirect a client to a malicious server, but the exhibit shows authentication events on the legitimate target servers, not anomalous IP resolutions or unexpected certificate errors. The fact that both servers were contacted from the same source IP is expected for a jump host or centralized management server, and it does not by itself imply DNS tampering. Furthermore, the successful logins are key-based, which a DNS poisoning attack could not produce unless the attacker already had the private key, so this explanation is both incomplete and inconsistent with the evidence.
- ✗
This is proof of ransomware spreading laterally over SMB.
Why it's wrong here
Ransomware spreading laterally over SMB typically uses Windows file-sharing protocols (SMB) to copy payloads, deploy services, or execute remote tools like PsExec, and it leaves traces of file encryption or process injection. The exhibit, however, shows SSH administrative access—likely port 22—with failed and successful key-based logins, which does not match SMB-based lateral movement. There is no indication of encrypted files, ransom notes, or SMB session activity, and the authentication pattern is benignly explained by configuration-management automation running during a maintenance window.
Go deeper
Related to this question
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.