10:00:02 patch-srv-12 service 'AcmePatchAgent' started by NT AUTHORITY\SYSTEM 10:00:05 patch-srv-12 DNS query: updates.acmecorp.com -> 198.51.100.44 10:00:05 patch-srv-12 outbound TLS connection to 198.51.100.44:443 10:00:07 SIEM rule 'possible beaconing every 15 minutes' triggered 10:15:03 patch-srv-12 DNS query: updates.acmecorp.com -> 198.51.100.44 10:15:03 patch-srv-12 outbound TLS connection to 198.51.100.44:443 10:15:04 EDR metadata: process hash matches approved vendor signature CMDB: Asset group = Patch Management Server; maintenance window = daily 10:00-10:30
Based on the exhibit, what is the most likely SOC conclusion and next action?
A scheduled alert fired on a server that repeatedly connects to a vendor update site at fixed intervals. The security team wants to know whether the alert represents a real threat or a harmless operational pattern.
Answer choices
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
Treat the activity as confirmed command-and-control traffic and isolate the server immediately.
Isolation would be appropriate if the destination or process were unrecognized or tampered with.
Classify the alert as a likely false positive, verify it against the maintenance record, and tune the rule.
The logs show a signed, approved patch agent on a server explicitly assigned to patch management, connecting to the vendor update host on a predictable schedule. That pattern matches normal operations rather than covert beaconing. The best SOC action is to validate the asset and change context, document the finding, and tune the detection logic or allowlist the known-good behavior.
Assume DNS poisoning is occurring and immediately flush the DNS cache on every endpoint.
DNS poisoning would need evidence of wrong name resolution or unexpected address changes, which is absent here.
Open a credential theft incident and reset all administrator passwords across the environment.
Nothing in the exhibit indicates account misuse, token theft, or suspicious authentication behavior from this host.
Common exam trap
Logging in proves the user can authenticate. It does not automatically mean the user is allowed to enter privileged or configuration mode. Watch for AAA authorization, privilege level and command authorization details.
Technical deep dive
This kind of question is testing the difference between identity and permission. A user may successfully log in to a router because authentication is working, but still fail to enter configuration mode because authorization is missing, misconfigured or mapped to a lower privilege level.
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SY0-701 questions linked to Security+ social engineering questions.
Practise SY0-701 questions linked to Security+ cryptography.
Practise SY0-701 questions linked to Security+ IAM questions.
Practise SY0-701 questions linked to Security+ risk management questions.
Practise SY0-701 questions linked to Security+ incident response questions.
Practise SY0-701 questions linked to Security+ malware questions.
Practise SY0-701 questions linked to Security+ vulnerability management questions.
Practise SY0-701 questions linked to Security+ security operations questions.
Practise SY0-701 questions linked to Security+ zero trust questions.
Practise SY0-701 questions linked to Security+ authentication factors questions.
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
Question 2
Question 3
Question 4
Question 5
Question 6
FAQ
Authentication checks who the user is.
The correct answer is: Classify the alert as a likely false positive, verify it against the maintenance record, and tune the rule. — This is most consistent with a false positive. The destination is the vendor’s update service, the timing matches a scheduled maintenance pattern, the process is signed, and the asset is classified as a patch management server. A SOC should validate the context, confirm the change window or automation job, and then tune the SIEM rule to reduce recurring noise. Escalating to containment would be disruptive and unsupported by the evidence. Why others are wrong: Option A is too aggressive because there is no sign of malware infrastructure or an unknown executable. Option C does not fit the evidence because the hostname resolves consistently to the same expected address, with no indication of hijacked DNS. Option D is unrelated; the logs do not show authentication anomalies, privilege abuse, or credential harvesting behavior.
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Sign in to join the discussion.