SY0-701 Security Operations Practice Question
Exhibit
Email security investigation for user amiller - User submitted credentials on a fake sign-in page at 08:22 - Password was reset at 08:35 - Active sessions were revoked at 08:36 - Mailbox audit now shows: * Inbox rule: 'FinanceDocs' forwards any message with 'invoice' to external address redacted@proton.example * OAuth consent granted to unknown application 'QuickDocs Sync' * Deleted Items folder contains no suspicious messages Help desk confirms the user still has access to the mailbox after reset.
Based on the exhibit, what should the team do next after the account has been contained?
⚠ Common exam trap
A common mix-up: candidates assume a password reset fully evicts an attacker, overlooking that OAuth tokens and mailbox rules provide persistent access independent of the account password.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove mailbox persistence, revoke all tokens and app consent, then monitor for reentry.
After containing a compromised account (e.g., disabling it or resetting its password), the attacker may still have established persistence mechanisms such as mailbox forwarding rules, OAuth app consent grants, or session tokens that survive a password reset. Removing these artifacts and revoking all tokens and app consents ensures the attacker cannot regain access via delegated permissions or persistent mailbox rules. Monitoring for reentry is critical to detect any residual access or new compromise attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Close the incident because the password reset removed the attacker from the environment.
Why it's wrong here
Resetting the password alone does not terminate attacker-controlled OAuth application grants or sessions that were already issued. In an Exchange Online or Microsoft 365 compromise, the threat actor often retains access through a persistent forwarding rule, mailbox API permissions, or refresh tokens that survive a password rotation. The incident cannot be closed until those persistence artifacts are discovered and removed, because the attacker may still read mail or re-authenticate via delegated access.
- ✓
Remove mailbox persistence, revoke all tokens and app consent, then monitor for reentry.
Why this is correct
The exhibit shows post-compromise persistence through a forwarding rule and unauthorized OAuth consent. After containment, the team must eradicate those artifacts, revoke any remaining tokens or sessions, and verify that no attacker-controlled application retains access. That sequence moves the response from containment into eradication and prepares the account for safe recovery and monitoring.
- ✗
Reimage the user's laptop before reviewing mailbox settings.
Why it's wrong here
Reimaging the laptop treats the wrong vector: the exhibited indicators (mailbox forwarding rule and unauthorized OAuth consent) are cloud-side artifacts, not evidence of malware on the endpoint. Even if the laptop is rebuilt, the forwarding rule would still redirect mail and the attacker's app consent would remain valid, allowing continued access via graph or mail APIs. Endpoint reimaging should only be considered if forensic evidence indicates a local infection, which is not supported by the exhibit.
- ✗
Restore the mailbox from backup to remove the forwarding rule and keep the user productive.
Why it's wrong here
A mailbox restore is an overly broad and ineffective remediation because it can reintroduce archived or hidden content, disrupt user workflows, and may not remove attacker-created app consents or tokens that are stored in Entra ID, not in the mailbox. The forwarding rule is only one of several persistence mechanisms; restoring a backup does not revoke OAuth grants or revoke sessions, so the attacker could still access the tenant through the registered application. Proper response requires targeted removal of the rule and revocation of all tokens and consent, not a data recovery operation.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Persistence
Persistence is the set of techniques attackers use to maintain long-term access to a compromised system even after reboots or credential changes.
Key term
OAuth
OAuth is an open standard for access delegation that allows users to grant third-party applications limited access to their resources without sharing their credentials.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.