SY0-701 Security Operations Practice Question
Exhibit
Network and endpoint logs for workstation WS-204 10:12:08 DNS query from WS-204 to 10.20.1.15 for wpad.corp.local 10:12:09 HTTP request from WS-204 to 10.20.1.15 for /wpad.dat 10:12:10 Proxy auto-detect enabled in browser policy 10:12:11 Traffic from WS-204 now exits through proxy 10.20.1.15 Asset inventory: - 10.20.1.15 = CORP-PROXY01 - CORP-PROXY01 is listed as the approved outbound web proxy
Based on the exhibit, what is the most likely explanation for the alert?
⚠ Common exam trap
Test-takers frequently assume any DNS redirection to an internal IP indicates a man-in-the-middle attack or DNS poisoning, but they overlook that corporate proxies legitimately use this technique for security monitoring and content filtering.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The workstation has been redirected to an approved corporate proxy, so the event is expected.
The alert indicates that the workstation's DNS traffic is being redirected to an internal proxy server (10.0.0.53), which is a common configuration in corporate environments for content filtering and security monitoring. Since the destination IP (10.0.0.53) is within the organization's private IP range and the proxy is explicitly approved, this behavior is expected and not malicious. The event is consistent with a transparent proxy or DNS-based proxy redirection, where the workstation's DNS queries are intercepted and forwarded to the corporate proxy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The workstation has been redirected to an approved corporate proxy, so the event is expected.
Why this is correct
The exhibit shows the workstation resolving WPAD, retrieving the proxy auto-configuration file, and then sending traffic to the approved proxy listed in inventory. Those steps match normal browser proxy discovery, not malicious behavior. Because the destination is the known corporate proxy, the alert should be validated as legitimate and then tuned if it repeatedly fires on the same approved sequence.
- ✗
A DNS cache poisoning attack is in progress and the workstation is now using a rogue gateway.
Why it's wrong here
DNS cache poisoning would manifest as resolution of legitimate domains to attacker-controlled IP addresses, often causing connection failures or unexpected destinations. Here the workstation resolves WPAD and retrieves a PAC file, then connects to the corporate proxy listed in inventory; that target matches the sanctioned IP, so the path is not a rogue gateway. A rogue gateway operates at Layer 3 by intercepting default routes, not by configuring a browser proxy via WPAD.
- ✗
The endpoint is infected with malware that is hiding its traffic through encrypted tunnels.
Why it's wrong here
Malicious encrypted tunnels typically require evidence of an unusual process, a beaconing connection, or an exfiltration destination; none of those appear in the exhibit. Instead, the logs show the standard WPAD lookup and download of a PAC file, followed by a connection to the approved corporate proxy. TLS-protected malware traffic would not announce itself through proxy auto-discovery, and the endpoint is not communicating with a sinkholed or suspicious external IP.
- ✗
The workstation is under a denial-of-service attack because it sent repeated DNS lookups.
Why it's wrong here
A denial-of-service attack involves a sustained flood of requests aimed at exhausting a service, whereas this log captures only a brief, deterministic sequence of DNS queries for WPAD followed by a PAC fetch. Browser startup routinely generates this pattern, and the lookup count is negligible compared to DoS-scale traffic. There is no indication of resource exhaustion or distributed source behavior, so this is a false positive, not an attack.
Visual reference
Go deeper
Related to this question
Learn chapter
Log Monitoring and SIEM
Key term
Proxy
A proxy is an intermediary server that sits between a client and a destination server, forwarding requests and responses while providing security, privacy, and control.
Key term
DNS
DNS is the system that translates human-friendly domain names like example.com into machine-readable IP addresses so computers can find each other on a network.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.