CCNA Security Operations Questions — Page 1 of 4

MCQmedium

A security analyst is responding to a potential ransomware incident on a Windows server that is still running. The analyst needs to preserve forensic evidence for analysis. Which of the following actions should the analyst perform first, based on the order of volatility?

A.Capture a full memory dump of the server

B.Shut down the server to prevent further damage

C.Create a forensic disk image of the hard drive

D.Run a full antivirus scan on the system

AnswerA

Correct. Memory is the most volatile data and should be captured first to preserve evidence such as running processes, network connections, and malware in memory. Any delay or system shutdown may cause this data to be lost.

Why this answer

The order of volatility dictates that the most volatile data (memory) must be captured first because it contains critical evidence like running processes, network connections, and encryption keys that will be lost when the system is powered off. A full memory dump preserves this volatile data before any other actions that could alter the system state.

Exam trap

The trap here is that candidates often think shutting down the server is the safest first step to contain damage, but CompTIA tests the forensic principle that volatile data must be preserved before any containment or remediation actions.

Why the other options are wrong

Shutting down the server destroys volatile data in RAM, which is critical for ransomware analysis (e.g., encryption keys, running processes). The order of volatility dictates capturing memory first.

In a live ransomware incident, the order of volatility dictates that volatile data (memory) must be captured before non-volatile data (disk). Creating a disk image first risks losing critical evidence in memory, such as encryption keys or running processes.

Running a full antivirus scan modifies system files and memory, violating the order of volatility which prioritizes capturing volatile data (like memory) first to preserve evidence.

Practice this question →

MCQmedium

During malware response on a finance workstation, the system is still powered on and connected. The manager asks whether you can just reboot it to stop the issue. What is the best next step?

A.Reboot immediately to prevent any further damage from the suspected malware.

B.Capture volatile evidence and document the system state before containment actions.

C.Copy suspicious files to a shared drive and continue normal operations.

D.Run a full disk cleanup to remove temporary files and reduce risk.

AnswerB

This is the correct next step because evidence preservation comes before intrusive remediation when a system is still live. Memory, running processes, active network connections, and logged-on sessions may reveal malware behavior and scope. Documenting the time, state, and actions taken also supports the incident response process and helps preserve the integrity of later findings if the case requires internal review or legal action.

Why this answer

In incident response, the first priority when a system is still powered on is to capture volatile evidence (e.g., memory contents, running processes, network connections) before any containment actions like rebooting. Rebooting would destroy this critical data, which may be essential for forensic analysis and understanding the malware's behavior. The order of volatility (RFC 3227) dictates that volatile data must be collected first to preserve evidence integrity.

Exam trap

The trap here is that candidates may think rebooting is a quick fix to stop malware, but CompTIA emphasizes that preserving volatile evidence is the critical first step before any containment action, as rebooting destroys that evidence.

How to eliminate wrong answers

Option A is wrong because rebooting immediately destroys volatile evidence (e.g., RAM contents, active network connections, running processes) that could be crucial for forensic analysis and determining the malware's origin and impact. Option C is wrong because copying suspicious files to a shared drive could spread the malware to other systems on the network, violating containment principles and increasing risk. Option D is wrong because running a full disk cleanup would delete temporary files that might contain malware artifacts or evidence, and it does nothing to stop the active malware or preserve forensic data.

Practice this question →

MCQmedium

An organization's file server contains sensitive HR data. The security team discovers that permissions on a confidential folder have been altered. Which of the following security controls would MOST likely help determine the account responsible for this change?

A.Data loss prevention (DLP) system

B.Mandatory access control (MAC)

C.Audit logging

D.Host-based intrusion prevention system (HIPS)

AnswerC

Audit logging records user actions such as file access, modification, and permission changes. It provides a detailed trail that can be reviewed to identify the account responsible for altering permissions and the exact time of the change.

Why this answer

Audit logging is the correct answer because it records detailed information about who made changes to files and folders, including the account name, timestamp, and the specific permission alteration. By reviewing audit logs, the security team can trace the unauthorized permission change back to the responsible user account. This is a detective control that directly supports accountability and forensic investigation.

Exam trap

The trap here is that candidates often confuse a preventive control like MAC or HIPS with a detective control like audit logging, failing to recognize that only audit logs provide the specific account attribution needed for this scenario.

Why the other options are wrong

A DLP system monitors and prevents unauthorized data transfers, but it does not track or log permission changes on file servers.

Mandatory access control (MAC) is a policy model that enforces access based on labels and clearances, not a mechanism for auditing who changed permissions. It does not provide logs or accountability for changes.

A host-based intrusion prevention system (HIPS) monitors and blocks malicious activities on a single host, but it does not log or track permission changes to files or folders. It is not designed to provide an audit trail of who altered file permissions.

Practice this question →

MCQeasy

A SIEM correlation rule alerts when a single user account fails to authenticate 20 times in 5 minutes and then succeeds from the same source IP. What is the most likely reason the team should investigate this event?

A.The account was probably being used normally because the password was changed

B.The pattern may indicate password guessing or credential stuffing

C.The SIEM is misconfigured because all failed logons are false positives

D.The account is definitely malicious and should be deleted immediately

AnswerB

Repeated failed logons from the same account and source, followed by a successful logon, is a well-established signature of password guessing or credential stuffing. The attacker submits a large set of guesses, and when one finally matches, the success logon completes the pattern, indicating that a valid credential has been compromised. This correlation is not definitive proof, but it is a strong indicator that warrants immediate investigation and validation before considering containment or eradication.

Why this answer

The pattern of 20 rapid failed authentication attempts followed by a successful authentication from the same source IP is a classic indicator of a password guessing or credential stuffing attack. The attacker likely used a list of common passwords or previously compromised credentials, and the final success suggests they found a valid password. SIEM correlation rules are designed to detect such brute-force or spraying behaviors, and this event warrants immediate investigation to determine if the account is compromised.

Exam trap

The trap here is that candidates may dismiss the alert as a false positive due to a user forgetting their password, but the specific combination of rapid failures followed by success from the same IP is a textbook sign of a successful brute-force or credential stuffing attack, not normal user behavior.

How to eliminate wrong answers

Option A is wrong because a password change would not cause 20 rapid failures followed by a success from the same IP; normal usage does not exhibit this pattern, and password changes typically generate a single failure if the old password is used, not a burst of failures. Option C is wrong because failed logons are not inherently false positives; they are legitimate security events that can indicate attacks, and a properly configured SIEM should alert on such patterns to detect credential abuse.

Practice this question →

MCQmedium

Based on the exhibit, which improvement best aligns the current backup design with the stated recovery targets?

A.Keep the same design but extend backup retention from 30 days to 90 days.

B.Switch to frequent incremental or snapshot backups stored in a separate, immutable location with routine restore tests.

C.Share the backup administrator password in a team chat so any engineer can restore data during an outage.

D.Remove backup encryption so restores run faster during an emergency.

AnswerB

The business needs a much smaller RPO and a faster RTO than the current design can deliver. More frequent backups reduce the amount of data lost, while a separate immutable repository improves resilience against ransomware and storage failures. Regular restore tests confirm that the chosen method actually meets the recovery objective in practice, not just on paper.

Why this answer

The current backup design lacks off-site, immutable storage and routine restore testing, which are critical to meet recovery point and time objectives (RPO/RTO). Frequent incremental or snapshot backups in a separate, immutable location protect against ransomware and ensure data integrity, while routine restore tests verify that backups are actually recoverable when needed.

Exam trap

CompTIA often tests the misconception that simply extending retention or making backups faster (e.g., removing encryption) improves recovery, when in reality the key gaps are off-site immutability and restore testing to ensure recoverability against ransomware and operational errors.

How to eliminate wrong answers

Option A is wrong because extending retention to 90 days does not address the lack of off-site or immutable storage, nor does it improve recovery speed or reliability; it only keeps more data in the same vulnerable location. Option C is wrong because sharing the backup administrator password in a team chat violates the principle of least privilege and introduces a massive security risk, potentially allowing unauthorized access to backup systems. Option D is wrong because removing backup encryption would expose sensitive data in transit and at rest, violating confidentiality requirements and potentially compliance mandates, while any performance gain is negligible compared to the security loss.

Practice this question →

MCQmedium

After a suspicious laptop is imaged with a write blocker, the original drive is sealed and stored. Before a second analyst examines the image, what is the most important next step to preserve admissibility?

A.Mount the image read/write so the analyst can browse faster.

B.Copy the image to a USB drive for easier transport.

C.Document the transfer in the chain-of-custody log and verify the image hash still matches the acquisition value.

D.Rename the evidence file to match the case number.

AnswerC

Chain-of-custody documentation shows who handled the evidence, when it changed hands, and why. Verifying the image hash against the acquisition hash proves the data has not changed since collection. Together, these steps support integrity and admissibility in administrative, HR, or legal reviews. A well-maintained log plus matching hashes is the standard way to show the evidence remained untampered during transfer and analysis.

Why this answer

Before a second analyst accesses the image, the most critical step is to update the chain-of-custody log to document the transfer of custody and to verify the integrity of the image by comparing its current hash value against the original acquisition hash. This ensures that the evidence has not been altered or corrupted since it was first imaged, which is essential for maintaining admissibility in legal proceedings under rules such as the Federal Rules of Evidence.

Exam trap

CompTIA often tests the misconception that renaming or copying evidence is a valid step for preservation, when in fact the core legal requirement is maintaining integrity verification and chain-of-custody documentation before any further handling.

How to eliminate wrong answers

Option A is wrong because mounting the image read/write would modify the file system metadata (e.g., last access timestamps) and potentially alter the image, breaking the hash integrity and rendering the evidence inadmissible. Option B is wrong because copying the image to a USB drive without first verifying the hash and documenting the transfer in the chain-of-custody log introduces a gap in the custody trail and risks integrity loss; the copy must be verified against the original hash, not just moved. Option D is wrong because renaming the evidence file to match the case number is a procedural convenience but does not address the legal requirements of chain-of-custody documentation or hash verification, and could cause confusion if the original filename is needed for forensic tool compatibility.

Practice this question →

MCQmedium

A server room is located next to a chilled-water pipe, and facilities staff want the earliest possible warning if moisture starts leaking under the raised floor. Which control is the best fit?

A.Install water leak sensors tied into the environmental monitoring system.

B.Replace the badge reader with a biometric lock.

C.Add a security camera pointing at the server racks.

D.Move the servers onto a separate VLAN.

AnswerA

Water leak sensors placed along the chilled water pipe, under raised floor tiles, and near equipment racks detect conductive or optical changes from moisture and send alerts to the environmental monitoring system. This provides immediate warning before fluid reaches sensitive electronics, allowing operators to close isolation valves, shut down affected equipment, or dispatch maintenance. Because the pipe is the hazard source, sensing is the only mitigation that directly addresses the risk.

Why this answer

Water leak sensors are specifically designed to detect the presence of moisture, and when integrated into an environmental monitoring system, they provide immediate alerts (e.g., SNMP traps or email notifications) at the earliest sign of a leak. This allows facilities staff to respond before water damages server equipment under the raised floor, meeting the requirement for earliest possible warning.

Exam trap

The trap here is that candidates may confuse physical security controls (like cameras or biometric locks) with environmental monitoring controls, failing to recognize that only a dedicated moisture sensor provides the earliest automated detection of a water leak.

How to eliminate wrong answers

Option B is wrong because a biometric lock controls physical access to the server room but does not detect moisture or provide any warning about water leaks. Option C is wrong because a security camera pointed at server racks can visually confirm a leak only after it has occurred and become visible, which is not the earliest possible warning and lacks automated alerting.

Practice this question →

MCQmedium

A security analyst notices repeated failed login attempts to a critical database server from a single external IP address over the past hour. The analyst reviews the authentication logs and sees that the account name used in each attempt is 'admin'. Which of the following security controls should the analyst recommend to mitigate this type of attack with minimal impact on legitimate users?

A.Configure an account lockout policy to lock the 'admin' account after three failed attempts.

B.Implement a temporary block rule on the perimeter firewall for the source IP address.

C.Disable the 'admin' account until the source IP can be investigated.

D.Require multi-factor authentication on the 'admin' account for all remote logins.

AnswerB

Blocking the attacking IP at the firewall immediately halts the malicious traffic without affecting other users or accounts. This is a quick, low-impact containment measure that can be reversed if false positive, making it the best immediate response.

Why this answer

Implementing a temporary block rule on the perimeter firewall for the source IP address directly stops the attack at the network boundary, preventing further authentication attempts without affecting legitimate users who are not using that IP. This approach is a form of dynamic IP blocking, which is a common mitigation for brute-force attacks targeting a single account from a specific external source.

Exam trap

The trap here is that candidates often choose account lockout policies (Option A) because they seem like a direct countermeasure to failed logins, but they fail to recognize that locking a critical shared account like 'admin' can cause a denial of service for legitimate users, whereas blocking the source IP is a more targeted and less disruptive control.

Why the other options are wrong

An account lockout policy would lock the 'admin' account after three failed attempts, but the attacker is using a single external IP and can simply wait for the lockout to expire or use a different account. This does not prevent the attack from the same IP and could lock out legitimate admins.

Disabling the 'admin' account would prevent legitimate administrative access entirely, causing significant operational disruption, and does not address the external IP source of the attack, which could simply switch to another account name.

While MFA adds security, it does not prevent the repeated failed login attempts from a single IP; the attack is already occurring and MFA would not stop the brute-force attempts themselves, only add a second factor if the password were guessed. The question asks to mitigate the attack with minimal impact on legitimate users, and MFA does not address the source IP or the ongoing attempts.

Practice this question →

MCQmedium

A security analyst detects unusual outbound traffic from a workstation that appears to be communicating with a known malicious IP address. The analyst immediately isolates the workstation from the network. Which of the following is the NEXT step in the incident response process according to NIST SP 800-61?

A.Eradication

B.Recovery

C.Containment

D.Lessons Learned

AnswerA

Eradication is the correct immediate next step after containment. The analyst must identify and eliminate the root cause of the malicious outbound traffic—such as removing malware binaries, terminating adversary-controlled processes, deleting persistence mechanisms like scheduled tasks or registry run keys, and revoking compromised credentials. Isolation alone only limits the threat's spread; without eradication, the infection remains dormant and can easily reinfect the host once reconnected.

Why this answer

According to NIST SP 800-61, the incident response process follows a sequence: Preparation, Detection & Analysis, Containment, Eradication, Recovery, and Lessons Learned. Since the analyst has already performed containment by isolating the workstation, the next step is Eradication, which involves removing the threat (e.g., malware, backdoors) from the affected system. This ensures the root cause is eliminated before moving to recovery.

Exam trap

The trap here is that candidates often confuse 'Containment' with the final isolation step, forgetting that NIST mandates a separate Eradication phase to eliminate the threat before recovery.

Why the other options are wrong

Recovery occurs after eradication and involves restoring systems to normal operation. Since the workstation has only been isolated (containment), eradication—removing the threat—must come next.

In NIST SP 800-61, containment is performed before eradication. The question states the workstation has already been isolated (containment), so the next step is eradication, not containment.

In NIST SP 800-61, the incident response process follows: Preparation, Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity (Lessons Learned). After containment (isolating the workstation), the next step is Eradication, not Lessons Learned. Lessons Learned occurs after Recovery.

Practice this question →

MCQmedium

A privileged account is used on a jump box at 02:15, and the SIEM shows multiple interactive logons from the same account to different servers within 10 minutes. The administrator says they used a password vault for the session. Which log source best confirms whether the access was authorized?

A.Privileged access management or password vault audit logs

B.DHCP lease logs from the jump box subnet

C.Printer server logs for the operations department

D.Web proxy logs for outbound browsing activity

AnswerA

Privileged access management (PAM) or password vault audit logs are the definitive source for validating the legitimacy of a privileged session initiated from a jump box. These logs record the exact time a credential was checked out, which user performed the checkout, which target system the credential was intended for, and whether the session was approved by a policy or an administrator. They also capture session timeouts, rotation events, and often include a reference to a recorded session replay, making them both the authorization and verification record for the 02:15 activity.

Why this answer

The privileged access management (PAM) or password vault audit logs are the definitive source because they record exactly when a password was checked out, which user performed the checkout, and the specific session ID or ticket associated with the jump box use. Since the administrator claims the password vault was used, these logs will show the checkout event at 02:15 and the subsequent interactive logons, confirming whether the vault authorized the session. No other log source can tie the authentication to the vault's approval process.

Exam trap

The trap here is that candidates assume DHCP logs or generic server logs can validate authentication authorization, when in fact only the PAM audit trail provides the cryptographic proof of vault-mediated access.

How to eliminate wrong answers

Option B is wrong because DHCP lease logs only record IP address assignments and timestamps for devices on the subnet; they do not capture authentication events, user identity, or whether a password vault was used, so they cannot confirm authorization. Option C is wrong because printer server logs only track print jobs and printer-related activity, which are irrelevant to interactive logons or privileged access management; they provide no data about authentication or vault usage.

Practice this question →

MCQmedium

After confirming malicious activity on a workstation, the incident lead wants the system cleaned up quickly. The analyst has not yet collected any volatile data. What should the analyst do before remediation begins?

A.Capture volatile evidence such as memory and running process information before changing the system.

B.Immediately uninstall every suspicious application and delete related files.

C.Restore the workstation from backup before documenting the incident.

D.Close the incident because the malicious activity has already been confirmed.

AnswerA

Volatile data disappears quickly and often contains the best clues about active malicious behavior, injected code, network connections, and open sessions. Capturing memory and process state before cleanup preserves that evidence for later analysis. Once remediation begins, many of those artifacts are lost or altered. In an incident response workflow, evidence collection should happen before eradication whenever the system is still available and safe to examine.

Why this answer

Volatile data (e.g., memory contents, running processes, network connections) is lost when the system is powered off or changed. The analyst must capture this evidence first to preserve forensic artifacts that can identify the root cause, scope, and indicators of compromise (IOCs) before remediation alters the system state.

Exam trap

The trap here is that candidates may prioritize speed of remediation over proper forensic procedure, forgetting that volatile data is the most time-sensitive evidence and must be collected before any system changes occur.

How to eliminate wrong answers

Option B is wrong because immediately uninstalling applications and deleting files destroys volatile evidence and may trigger anti-forensic mechanisms, preventing full analysis of the attack. Option C is wrong because restoring from backup overwrites the current system state, erasing all volatile and non-volatile evidence needed for investigation and legal proceedings. Option D is wrong because confirming malicious activity does not complete the incident response process; the analyst must still collect evidence, contain the threat, and perform root cause analysis before closure.

Practice this question →

MCQhard

Based on the exhibit, what is the most likely SOC conclusion and next action? A scheduled alert fired on a server that repeatedly connects to a vendor update site at fixed intervals. The security team wants to know whether the alert represents a real threat or a harmless operational pattern.

A.Treat the activity as confirmed command-and-control traffic and isolate the server immediately.

B.Classify the alert as a likely false positive, verify it against the maintenance record, and tune the rule.

C.Assume DNS poisoning is occurring and immediately flush the DNS cache on every endpoint.

D.Open a credential theft incident and reset all administrator passwords across the environment.

AnswerB

The logs show a signed, approved patch agent on a server explicitly assigned to patch management, connecting to the vendor update host on a predictable schedule. That pattern matches normal operations rather than covert beaconing. The best SOC action is to validate the asset and change context, document the finding, and tune the detection logic or allowlist the known-good behavior.

Why this answer

The scheduled alert firing at fixed intervals to a known vendor update site strongly suggests a legitimate update or heartbeat mechanism, not malicious C2 traffic. Option B correctly directs the analyst to verify against maintenance records (confirming the pattern is expected) and then tune the rule to reduce future false positives, which is the standard SOC workflow for benign scheduled activity.

Exam trap

The trap here is that candidates see 'scheduled alert' and 'fixed intervals' and immediately think of C2 beaconing, but the key differentiator is the destination being a known vendor update site, which points to a false positive rather than a threat.

How to eliminate wrong answers

Option A is wrong because isolating the server immediately for confirmed C2 traffic is premature; the traffic is to a known vendor update site at fixed intervals, which is the opposite of typical C2 behavior (which uses irregular patterns and often non-standard ports). Option C is wrong because DNS poisoning would cause traffic to unexpected IPs, not a known vendor site, and flushing DNS cache on every endpoint is an extreme, unnecessary action for a single scheduled alert. Option D is wrong because credential theft incidents involve unauthorized access or lateral movement, not a server making outbound connections to a vendor site; resetting all admin passwords would be a massive overreaction and disrupt operations without evidence.

Practice this question →

MCQeasy

An office loses power several times each month, causing servers to shut down without warning. Which control best helps keep the systems running long enough for a safe shutdown?

A.A UPS sized to support the equipment for a short period.

B.A better wallpaper design in the server room.

C.A stronger password for the power strip.

D.More user awareness training about turning monitors off.

AnswerA

A UPS is the best control because it provides temporary battery power during outages, giving systems time to continue running briefly or shut down cleanly. This reduces the chance of data loss and hardware damage. It is a common environmental safeguard for servers and other critical devices that must survive short power interruptions.

Why this answer

A UPS (Uninterruptible Power Supply) provides battery backup power to connected equipment, allowing servers to continue running for a short duration after a power loss. This gives administrators enough time to perform a safe, orderly shutdown, preventing data corruption and hardware damage from abrupt power loss.

Exam trap

The trap here is that candidates may confuse a UPS with a surge protector or power strip, thinking that any power-related device provides backup runtime, when only a UPS with battery storage can keep systems running after a power failure.

How to eliminate wrong answers

Option B is wrong because wallpaper design has no impact on power continuity or safe shutdown procedures; it is purely cosmetic. Option C is wrong because a stronger password for the power strip does not provide backup power or enable graceful shutdown; power strips do not manage power loss events. Option D is wrong because user awareness training about turning monitors off does not address the need for servers to remain powered during an outage; it focuses on energy savings, not uptime or safe shutdown.

Practice this question →

MCQmedium

After restoring a virtualized file server from backup, users can log in but the accounting application returns database consistency errors. What should you do next?

A.Declare the restore successful because the virtual machine boots and users can sign in.

B.Verify the restore in an isolated environment and confirm application-level integrity and permissions.

C.Increase the backup retention period and wait for the next scheduled full backup.

D.Delete the backup set to prevent confusion with the restored data.

AnswerB

This is the best next step because a restore is only useful if the data and application work as expected. Testing in an isolated environment lets you confirm database consistency, file permissions, application dependencies, and any version mismatches without risking production impact. That approach also helps determine whether the backup itself is valid or whether a separate application or storage issue is causing the errors.

Why this answer

The restore process must be validated beyond basic boot and login functionality. Database consistency errors indicate that the application-level data integrity was compromised during the restore, likely due to missing or inconsistent database files, permissions, or transaction logs. Verifying the restore in an isolated environment allows you to test application-specific integrity checks (e.g., DBCC CHECKDB for SQL Server) and confirm that file permissions and security descriptors are intact before returning the server to production.

Exam trap

The trap here is that candidates assume a successful VM boot and user login equate to a complete restore, overlooking the need to validate application-level data integrity and permissions in an isolated test environment.

How to eliminate wrong answers

Option A is wrong because declaring success based solely on VM boot and user login ignores the critical application-level integrity failure; database consistency errors mean the restore is incomplete or corrupted. Option C is wrong because increasing backup retention and waiting for the next full backup does not address the current data integrity issue and delays resolution. Option D is wrong because deleting the backup set would destroy the only source for a potential re-restore or forensic analysis, and it does not fix the consistency errors.

Practice this question →

MCQmedium

A web application was updated at 10:00. At 10:05, the SIEM reports a sharp rise in HTTP 500 errors and WAF blocks from the same source range. The application owner says customers are seeing failures only on the new checkout page. What is the best next step?

A.Close the incident because the WAF is blocking the suspicious traffic.

B.Correlate deployment, WAF, and application logs to determine whether the release or an attack caused the failures.

C.Disable all customer accounts until the failures disappear from the dashboard.

D.Increase the server's disk space and memory thresholds immediately.

AnswerB

This is the best next step because the timing strongly suggests either a bad deployment or an exploit attempt against the new checkout page. Correlating release records with WAF events and application logs helps determine whether the errors are caused by a coding defect, an input validation issue, or hostile traffic. That analysis lets the team respond appropriately instead of assuming the WAF alone has solved the problem.

Why this answer

The temporal correlation between the deployment at 10:00 and the spike in HTTP 500 errors and WAF blocks at 10:05 strongly suggests a causal relationship. The best next step is to correlate deployment logs, WAF logs, and application logs to determine whether the new checkout page code introduced a bug (causing 500 errors) or whether an attacker is exploiting a vulnerability in the new code (triggering WAF blocks). This diagnostic step avoids premature conclusions and ensures the root cause is identified before any remediation.

Exam trap

The trap here is that candidates may assume WAF blocks always indicate an attack and choose Option A, failing to recognize that a recent deployment could introduce bugs that cause both 500 errors and false positive WAF triggers.

How to eliminate wrong answers

Option A is wrong because closing the incident while customers are actively experiencing failures on the new checkout page ignores the business impact and the possibility that the WAF blocks are a symptom of a misconfigured release, not a successful defense. Option C is wrong because disabling all customer accounts is an extreme, disruptive action that would cause massive business harm without any evidence that accounts are compromised; the issue is isolated to a single page and likely a code or configuration problem. Option D is wrong because increasing disk space and memory thresholds does not address HTTP 500 errors or WAF blocks; these are application-layer or security-layer issues, not resource exhaustion problems.

Practice this question →

Multi-Selectmedium

EDR flags a word processor that launched encoded PowerShell and then made an outbound HTTPS connection to a rare domain. Which two actions should the analyst take first from the EDR console? Select two.

Select 2 answers

A.Isolate the endpoint from the network to stop further communication and lateral movement.

B.Collect a live response package or volatile data from the host before remediation begins.

C.Uninstall the word processor immediately because it is the process that launched PowerShell.

D.Reboot the laptop right away to clear the encoded PowerShell process from memory.

E.Whitelist the rare domain temporarily to see whether the connection is business-related.

AnswersA, B

This is the primary containment action because the host shows behavior consistent with active compromise and command execution. Network isolation limits attacker reach, preserves the current state, and reduces the chance of credential theft or lateral movement. EDR-based isolation is fast, reversible, and appropriate before more invasive remediation steps.

Why this answer

Isolating the endpoint from the network immediately stops the outbound HTTPS connection to the rare domain, preventing data exfiltration and blocking potential lateral movement. This is a critical first step in containment, as the encoded PowerShell and rare domain strongly suggest a malicious payload or C2 communication.

Exam trap

The trap here is that candidates may prioritize remediation (uninstalling or rebooting) over containment and evidence preservation, failing to recognize that isolation and data collection are the mandated first steps in incident response according to NIST SP 800-61.

Practice this question →

MCQmedium

A SIEM analyst reviews authentication logs and sees the following pattern over 15 minutes: 68 different user accounts each had one failed login attempt from the same source IP, followed by no lockouts, and then one of the accounts successfully authenticated from that same IP using a valid password. What is the most likely explanation?

A.A brute-force attack against a single account using many password guesses.

B.A password spraying attack using common passwords across many accounts.

C.A replay attack using captured authentication traffic.

D.A successful SSO federation event after a directory sync delay.

AnswerB

This pattern matches password spraying because the attacker tests a small number of common guesses against many accounts to avoid lockouts.

Why this answer

The pattern of 68 different user accounts each experiencing a single failed login attempt from the same source IP, followed by one successful authentication from that IP using a valid password, is the classic signature of a password spraying attack. In password spraying, the attacker tries a small number of common passwords (often just one) against many accounts to avoid triggering account lockout policies, which typically lock an account after a small number of consecutive failures (e.g., 3–5 attempts). The single success indicates the attacker found an account using a weak or common password.

Exam trap

CompTIA often tests the distinction between brute-force (many passwords, one account) and password spraying (one password, many accounts), and the trap here is that candidates see 'failed login attempts' and immediately assume brute-force without noticing the unique pattern of one failure per account.

How to eliminate wrong answers

Option A is wrong because a brute-force attack against a single account would show many failed attempts for that one account (e.g., dozens or hundreds), not one failure each across 68 different accounts. Option C is wrong because a replay attack would involve capturing and retransmitting valid authentication traffic (e.g., Kerberos tickets or NTLM hashes), not a pattern of failed logins followed by a single success; replay attacks do not generate failed login events from the attacker's perspective. Option D is wrong because an SSO federation event after a directory sync delay would not produce 68 failed logins from the same IP; SSO events typically show a single successful authentication via a token or assertion (e.g., SAML response), not a spray of failures.

Practice this question →

MCQmedium

Security receives a company laptop used in an insider theft investigation. A manager wants the device moved to another office for review by legal staff. Which action best supports chain of custody?

A.Power on the laptop to confirm the user profile and recent activity before transport.

B.Place it in a labeled evidence bag, record the collector, time, location, and condition, and require signatures for each transfer.

C.Remove the drive and clone it without documenting the collection process.

D.Email a photo of the laptop to legal and leave the original on a desk.

AnswerB

Chain of custody depends on proving who handled the evidence, when, where, and in what condition. Documenting the device at collection, sealing it appropriately, and recording every transfer creates a defensible record that supports legal review. This approach reduces the risk of tampering claims and helps establish that the laptop was preserved from the moment it was seized until it reaches legal or forensic personnel.

Why this answer

It follows the formal chain of custody process required for evidence handling. Placing the laptop in a labeled evidence bag with documented collector, time, location, and condition, along with requiring signatures for each transfer, ensures the integrity and admissibility of evidence by creating an unbroken audit trail. This aligns with NIST SP 800-86 and forensic best practices for maintaining custody of digital evidence.

Exam trap

CompTIA often tests the misconception that simply securing the device or performing preliminary analysis is sufficient, but the trap here is that any action altering the device state or lacking formal documentation breaks the chain of custody, even if the intent is to preserve evidence.

How to eliminate wrong answers

Option A is wrong because powering on the laptop alters system state, modifies timestamps, and can trigger encryption or anti-forensic mechanisms, thereby breaking the chain of custody and potentially destroying volatile evidence. Option C is wrong because removing the drive and cloning it without documenting the collection process violates chain of custody requirements; proper documentation of each step, including drive removal and cloning, is essential for evidence integrity. Option D is wrong because emailing a photo and leaving the original on a desk fails to secure the device, does not document transfer or condition, and provides no chain of custody, making the evidence inadmissible.

Practice this question →

MCQeasy

A user reports a suspicious pop-up on a workstation and the SOC suspects malware. Which action should the responder take first to contain the threat?

A.Disconnect the workstation from the network

B.Wipe the workstation immediately

C.Return the workstation to the user after restarting it

D.Wait until the next patch cycle to see if the issue disappears

AnswerA

Disconnecting the workstation from the network is the immediate containment step in incident response. It severs the host's ability to communicate with any command-and-control (C2) infrastructure, preventing the malware from receiving instructions, exfiltrating data, or using the host to pivot and move laterally to other systems. Unlike disruptive actions, isolation preserves the current state of memory and disk, allowing forensic evidence to be collected intact while stopping the attack's spread.

Why this answer

Disconnecting the workstation from the network immediately isolates the suspected malware, preventing it from communicating with command-and-control (C2) servers, spreading laterally to other hosts, or exfiltrating data. This is the first step in the NIST incident response containment phase, as it stops network-based propagation without destroying forensic evidence.

Exam trap

CompTIA often tests the misconception that immediate eradication (wiping) is the first step, but the correct order is containment first to stop the spread, then eradication and recovery.

How to eliminate wrong answers

Option B is wrong because wiping the workstation destroys volatile data and forensic artifacts (e.g., memory dumps, logs, malware binaries) that are critical for analysis and attribution. Option C is wrong because restarting the workstation may allow malware to execute persistence mechanisms or trigger destructive payloads, and returning it to the user risks further compromise. Option D is wrong because waiting for the next patch cycle leaves the threat active, allowing the malware to spread, escalate privileges, or cause data loss, violating the principle of timely containment.

Practice this question →

Matchinghard

Match each SOC alert artifact to the most useful investigation pivot. Each pivot should help determine whether the alert is a true incident, a false positive, or part of a broader campaign.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Check whether the pattern matches password spraying across accounts rather than a brute-force attempt on one user.

Pivot to parent-child process trees and script-block telemetry on the endpoint.

Compare the query pattern and periodicity for possible DNS tunneling or beaconing.

Correlate with scheduled tasks, recent file creation, and account activity for staging or exfiltration.

Review token/session logs and conditional-access telemetry to see whether a hijacked session or relay attack occurred.

Why these pairings

Each artifact is matched to a pivot that directly aids in verifying the alert's validity, whether by checking reputation, correlating with threat intelligence, or comparing against normal behavior.

Practice this question →

MCQmedium

A security analyst receives an alert that a user's workstation is communicating with a known malicious IP address during off-hours. The analyst reviews the firewall logs and confirms the connection was established. Which of the following should the analyst perform NEXT to contain the threat?

A.Disable the user's account immediately.

B.Isolate the workstation from the network.

C.Run a full antivirus scan on the workstation.

D.Notify the user's manager of the policy violation.

AnswerB

Isolating the workstation stops all network communication, including the connection to the malicious IP. This is a direct containment action that prevents further exfiltration, command-and-control activity, or lateral spread.

Why this answer

Isolating the workstation from the network (Option B) is the immediate containment step because it stops the active communication with the known malicious IP address, preventing further data exfiltration, lateral movement, or command-and-control (C2) activity. This aligns with the NIST incident response framework's containment phase, which prioritizes stopping the threat before investigation or remediation. Disabling the user account (A) does not stop the network-level communication if the malware is running as a service or using cached credentials, and running a scan (C) or notifying management (D) are post-containment actions.

Exam trap

CompTIA often tests the distinction between containment and remediation, trapping candidates who choose to run an antivirus scan (Option C) first, when the correct incident response order is to isolate the host to stop the active threat before any scanning or notification.

Why the other options are wrong

Disabling the user's account does not stop the active network communication from the compromised workstation to the malicious IP; the threat remains active on the network.

Running a full antivirus scan is a detection and remediation step, not a containment step. The immediate priority is to stop communication with the malicious IP, which isolation achieves; scanning can occur after containment.

Notifying the user's manager of a policy violation does not directly contain the threat; the workstation is still communicating with a malicious IP, and containment (e.g., isolation) is the immediate priority.

Practice this question →

MCQmedium

A security analyst in a SOC receives an alert indicating that a large volume of data was transferred from a user's workstation to an external IP address at 2:00 AM. The analyst suspects a data exfiltration attack. According to incident response best practices, what should the analyst do FIRST?

A.Block the external IP address at the firewall.

B.Review the user's login and activity logs.

C.Contact the user to inquire about the transfer.

D.Restore the workstation from a known good backup.

AnswerB

Reviewing logs is the correct first step. It allows the analyst to verify the alert, see if the user was logged in, identify the process responsible for the transfer, and gather details necessary for informed decision-making.

Why this answer

In incident response, the first step is to gather evidence and understand the scope of the incident. Reviewing the user's login and activity logs (e.g., Windows Event Logs, authentication logs, and process creation logs) allows the analyst to verify if the user was actually logged in at 2:00 AM, identify any anomalous behavior (e.g., use of unauthorized tools or unusual file access patterns), and determine whether the data transfer was initiated by the user or by malware. This aligns with the NIST SP 800-61 incident response lifecycle, specifically the identification and analysis phase, where initial triage focuses on log review before taking containment actions.

Exam trap

The trap here is that candidates often jump to immediate containment (blocking the IP) or recovery (restoring from backup) without first verifying the alert through log analysis, which is a fundamental incident response principle emphasized in the SY0-701 exam.

Why the other options are wrong

Blocking the external IP at the firewall is a containment step that should be taken after verifying the alert is a true positive. The first step is to gather more information to confirm the incident, not to take immediate action that could disrupt legitimate traffic.

Contacting the user immediately may alert a potential insider threat or disrupt forensic preservation; the analyst should first gather objective evidence from logs to confirm the incident before involving personnel.

Restoring from backup is a containment/recovery step that occurs after the incident has been confirmed and analyzed; it is premature before verifying the alert and gathering evidence.

Practice this question →

Matchinghard

Match each detection pattern to the most likely security issue. Each item has one best match.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Living-off-the-land or fileless malware execution

DNS tunneling or command-and-control beaconing

Password spraying or credential stuffing that succeeded

Compromised privileged credentials with persistence and post-exploitation activity

Why these pairings

Repeated login failures indicate brute-force; Outbound connections to malicious IPs suggest C2; Large data transfers at odd hours indicate exfiltration; Random DNS subdomains are typical of tunneling; Conflicting ARP replies show spoofing; Multiple ICMP requests from many sources indicate DDoS.

Practice this question →

MCQmedium

After a ransomware incident, management learns the attacker's stolen domain admin credentials were used to delete recent online backups from the same backup network. Which backup strategy would have most reduced the chance of permanent backup loss?

A.Nightly incremental backups stored on the same file server as production data.

B.Immutable backups stored in a separate repository or offline location.

C.Hypervisor snapshots only, because they are always safer than backups.

D.Longer retention on the same backup share to keep more versions available.

AnswerB

Immutable backups in a separate repository or offline location are the correct defense because they make recovery data both tamper-proof and network-isolated. Object locking (e.g., S3 Object Lock with WORM mode) or filesystem-level immutable flags (such as chattr +i on Linux) prevent deletion or modification even by accounts with administrative privileges, as the data is retained until an explicitly set retention period expires. Offline media like rotated tape or an air-gapped storage array ensures that the ransomware cannot reach the repository via the production network or lateral movement. This design adheres to the 3-2-1 rule and satisfies CISA/NIST guidance for ransomware-resilient backups.

Why this answer

Immutable backups stored in a separate repository or offline location prevent deletion or modification by an attacker, even with domain admin credentials. This is because immutability enforces a write-once-read-many (WORM) policy, often implemented via object lock (e.g., S3 Object Lock) or a physical air gap, ensuring that backups cannot be altered or deleted before their retention period expires. In this scenario, the attacker's ability to delete online backups from the same network is mitigated because the immutable repository is isolated and resistant to credential-based tampering.

Exam trap

The trap here is that candidates may assume longer retention or same-server backups are sufficient, but the key is that immutability and isolation (air gap) are required to prevent an attacker with elevated credentials from deleting backups, which is a core concept tested in SY0-701 Domain 3.0 (Security Operations).

How to eliminate wrong answers

Option A is wrong because nightly incremental backups stored on the same file server as production data are vulnerable to the same ransomware attack and credential compromise, as the attacker can delete or encrypt them using the same domain admin credentials. Option C is wrong because hypervisor snapshots are not always safer than backups; they are typically stored on the same storage array as the VMs and can be deleted by an attacker with administrative access to the hypervisor, and they lack the isolation and immutability features of dedicated backup solutions. Option D is wrong because longer retention on the same backup share does not protect against deletion; the attacker can still delete all versions from the same share using the stolen credentials, as retention policies do not enforce immutability or separation.

Practice this question →

MCQmedium

An ERP database is backed up nightly to a NAS that remains online and is managed with the same admin group as production servers. After a ransomware incident, management wants the most effective change to improve recovery assurance without redesigning the whole environment. What should be implemented?

A.Increase the NAS capacity so more backup jobs can be stored.

B.Add another full backup each night to create more copies on the same NAS.

C.Use an offline or immutable backup copy and perform regular restore tests.

D.Compress the backup files to reduce network usage during the nightly job.

AnswerC

An offline or immutable backup reduces the chance that ransomware can encrypt or delete recovery data, and restore testing proves that the backups actually work. This combination improves resilience more effectively than simply storing more data on the same always-online system.

Why this answer

An offline or immutable backup copy ensures that ransomware cannot encrypt or delete the backup data, and regular restore tests verify that the backups are actually recoverable. This directly addresses the core requirement of improving recovery assurance without redesigning the environment, as it protects the backup from the same attack vector that compromised the production servers and the NAS managed by the same admin group.

Exam trap

The trap here is that candidates often assume more copies or more storage (options A and B) improve recovery assurance, but they fail to recognize that all copies on the same online, writable NAS are equally vulnerable to ransomware encryption or deletion, making isolation and immutability the key differentiators.

How to eliminate wrong answers

Option A is wrong because increasing NAS capacity only stores more backup jobs but does not protect existing backups from being encrypted or deleted by ransomware if the NAS remains online and accessible to the same admin group. Option B is wrong because adding another full backup to the same NAS creates more copies that are all equally vulnerable to the same ransomware attack, offering no isolation or protection. Option D is wrong because compressing backup files reduces network usage but does not improve recovery assurance; compressed files on the same online NAS are still susceptible to encryption or deletion by ransomware.

Practice this question →

MCQmedium

A security analyst observes a pattern where an account exhibits multiple failed login attempts from an IP address in a foreign country, followed by a successful login from the same account but from a different IP address in another foreign country minutes later. The analyst wants to deploy a control that can automatically detect and alert on this type of anomalous user behavior, even if the individual login events are not blocked by existing rules. Which of the following security controls is BEST suited for this task?

A.Geofencing

B.Account lockout policy

C.User Behavior Analytics (UBA)

D.SIEM correlation rules

AnswerC

UBA establishes baselines of normal user activity and uses analytics to detect anomalies such as a series of failed logins followed by a successful login from a new geographic region. It is designed to identify suspicious behavioral patterns that other controls might miss.

Why this answer

User Behavior Analytics (UBA) is the best control because it uses machine learning to establish a baseline of normal user behavior (e.g., typical login locations, times, and IP ranges) and then detects anomalies such as a rapid sequence of failed logins from one foreign country followed by a successful login from another foreign country. Unlike static rules, UBA can identify this pattern as suspicious even if each individual login event is not blocked by existing rules, triggering an alert for further investigation.

Exam trap

The trap here is that candidates often choose geofencing because they focus on the 'foreign country' aspect, but they miss that the question requires detection of a behavioral pattern (failed then successful logins from different locations), not just location-based blocking.

Why the other options are wrong

Geofencing blocks or allows access based on geographic location, but it does not analyze sequential behavior patterns like multiple failed logins from one country followed by a successful login from another. It would block the second login if the country is restricted, but it cannot detect the anomalous sequence of events.

An account lockout policy would block further attempts after a threshold of failed logins, but it would not detect or alert on the anomalous pattern of failed logins from one foreign IP followed by a successful login from another foreign IP, as the successful login occurs after the lockout threshold may have reset or not been reached.

SIEM correlation rules require predefined patterns to trigger alerts, but the question describes anomalous behavior that may not have a known pattern. UBA is better suited because it uses machine learning to establish a baseline and detect deviations without predefined rules.

Practice this question →

MCQmedium

After restoring a virtual file server from last night’s backup, users can browse shares, but finance reports that several spreadsheet edits from yesterday are missing. What should the administrator verify next before declaring the restore successful?

A.Whether the backup job used the correct restore point and included the needed transaction logs.

B.Whether the file server antivirus signatures are fully up to date.

C.Whether the share permissions were tightened during the restore.

D.Whether the virtual machine has enough CPU and memory allocated.

AnswerA

This is the best next verification because the missing spreadsheet edits suggest the restore point may be older than the required recovery window, or application-related log data may not have been captured. Confirming the exact backup set, restore timestamp, and transaction log coverage helps determine whether the restore actually meets the business recovery objective. It also shows whether the issue is incomplete backup scope or simple user expectation mismatch.

Why this answer

The missing spreadsheet edits indicate that the backup may have been taken before those changes were committed. The administrator must verify that the restore point includes the necessary transaction logs (e.g., from a VSS-aware backup or application-consistent snapshot) to recover the most recent data. Without these logs, any edits made after the last full backup are lost, so confirming the correct restore point and log inclusion is the next logical step before declaring success.

Exam trap

The trap here is that candidates assume a successful restore of shares means all data is intact, overlooking the critical distinction between crash-consistent and application-consistent backups and the role of transaction logs in recovering recent changes.

How to eliminate wrong answers

Option B is wrong because antivirus signature updates are unrelated to data loss from a backup restore; they address malware protection, not file version recovery. Option C is wrong because share permissions control access rights, not the content or version of files; tightening permissions during restore would not cause missing edits. Option D is wrong because CPU and memory allocation affect performance, not the integrity or completeness of restored data; insufficient resources might slow access but cannot cause specific edits to vanish.

Practice this question →

MCQmedium

The email security team receives a suspicious invoice attachment from a vendor. The attachment is not blocked by signature-based detection, but the team wants to observe its behavior in a safe environment before delivery to users. What tool best fits this requirement?

A.Sandboxing the attachment in an isolated analysis environment

B.Network access control for unmanaged devices

C.A data loss prevention rule on outbound email

D.An intrusion prevention system placed on the Wi-Fi network

AnswerA

A sandbox detonates the attachment in a virtualized, isolated environment, executing the file while monitoring system calls, network connections, and file-system modifications for indicators of compromise. This dynamic analysis reveals malicious behavior that static inspection might miss, such as obfuscated macros or exploit payloads. Because the environment is isolated, any malicious payload is contained and cannot affect production hosts, and the resulting behavioral telemetry can be used to update detection signatures before the email reaches users.

Why this answer

A sandbox provides an isolated, controlled environment where the suspicious attachment can be executed and monitored for malicious behavior without risking the production network. This allows the security team to observe dynamic indicators such as file system changes, registry modifications, or outbound connections that signature-based detection might miss. The goal is to analyze the attachment's true intent before deciding whether to deliver it to users.

Exam trap

The trap here is that candidates may confuse signature-based detection with behavioral analysis, thinking that a signature-based tool (like an IPS or antivirus) can analyze unknown threats, when in fact only a sandbox can safely execute and observe the behavior of a suspicious file.

How to eliminate wrong answers

Option B is wrong because Network Access Control (NAC) is used to enforce security policies on devices attempting to connect to the network, not to analyze the behavior of email attachments. Option C is wrong because a Data Loss Prevention (DLP) rule on outbound email is designed to prevent sensitive data from leaving the organization, not to observe the behavior of an incoming attachment. Option D is wrong because an Intrusion Prevention System (IPS) on the Wi-Fi network monitors and blocks malicious network traffic in real time, but it cannot execute or sandbox an email attachment to observe its behavior.

Practice this question →

Multi-Selectmedium

A firewall rule was changed in production to allow a new vendor IP range, and payroll users immediately lost access to an internal service. Which two change-management practices would have reduced the risk of this outage? Select two.

Select 2 answers

A.Test the rule in a staging environment with representative traffic before production deployment.

B.Require a rollback or backout plan that can quickly restore the previous rule set.

C.Make the change during the busiest business hour so the team can observe the effect immediately.

D.Remove logging on the firewall so only the new rule is visible during troubleshooting.

E.Skip approval because the vendor was already known to the organization.

AnswersA, B

Staging validation helps reveal rule-order problems, unintended blocks, and missing dependencies before users are affected. A representative test environment is especially important for firewall changes because small syntax or sequencing errors can have large business impacts. Testing reduces the chance that a production change will break unrelated services.

Why this answer

Testing the firewall rule in a staging environment with representative traffic allows you to validate that the new vendor IP range does not inadvertently block or conflict with existing rules before impacting production. This practice catches misconfigurations—such as an overly broad permit that shadows a deny rule for payroll users—without risking service disruption. Staging mirrors production ACL logic, so you can verify that the rule order and match criteria (e.g., source IP, destination port) behave as intended.

Exam trap

The trap here is that candidates often think testing in staging is unnecessary if the change seems small, or they confuse 'testing' with 'monitoring in production'—but the question specifically asks for practices that reduce risk before the outage occurs.

Practice this question →

MCQmedium

A nightly patch script restarts services on 40 Linux servers. Security does not want an administrator to log in interactively, and the script should only have the permissions needed to install approved patches and restart those services. What is the best design?

A.Run the script with a dedicated automation account that has only the required sudo permissions

B.Use the root account for every scheduled execution to avoid permission errors

C.Hard-code the administrator password in the script so it never prompts

D.Ask each server owner to manually patch their system during the maintenance window

AnswerA

Using a dedicated automation account bound to a narrowly scoped sudoers policy is the correct application of least privilege. This approach grants only the specific commands the patch script needs—such as systemctl restart and package manager updates—while preventing interactive login and any access beyond the maintenance task. Because the account is non-human and non-interactive, its credentials can be securely stored in a vault or secrets manager, and its actions are fully auditable through the sudo and auditd logs. This design minimizes the blast radius if the account is compromised and ensures unattended patching remains compliant with defense-in-depth practices.

Why this answer

It follows the principle of least privilege by using a dedicated automation account with only the specific sudo permissions needed to install approved patches and restart services. This prevents interactive login (as the account is configured for non-interactive use) and ensures the script cannot perform unauthorized actions, aligning with security best practices for automated tasks.

Exam trap

The trap here is that candidates may assume root is necessary for scheduled tasks to avoid permission errors, overlooking that dedicated accounts with specific sudo rules can achieve the same goal with far less risk.

How to eliminate wrong answers

Option B is wrong because using the root account for every scheduled execution violates the principle of least privilege, granting full system access to the script, which increases the risk of accidental or malicious damage. Option C is wrong because hard-coding the administrator password in the script is a severe security risk; it exposes credentials in plaintext, allowing anyone with file read access to compromise the account, and it does not address the requirement to prevent interactive login.

Practice this question →

MCQmedium

An internal finance application has an RTO of 2 hours and an RPO of 30 minutes. Current backups restore in about 6 hours because the team must rebuild the server from scratch. Which change best aligns the recovery design to the business requirement?

A.Add a warm standby or replicated recovery system that can be brought online within the RTO

B.Keep the same design and simply increase backup retention

C.Switch to weekly full backups only

D.Reduce logging on the application server to improve restore speed

AnswerA

A warm standby keeps a replicated copy of the application and its data on standby infrastructure that is powered on and ready. On failure, you can redirect traffic and promote the standby in minutes, which directly satisfies the 2-hour RTO. Because replication continuously updates the recovery point, the RPO is kept small, and you avoid the long rebuild and restore process from backup media.

Why this answer

The business requires an RTO of 2 hours and an RPO of 30 minutes, but current backups take 6 hours to restore because the server must be rebuilt from scratch. Adding a warm standby or replicated recovery system allows the application to be brought online within the RTO by maintaining a pre-configured, partially synchronized environment that can be activated quickly, reducing recovery time from hours to minutes. This aligns the recovery design with the business continuity requirements by meeting both the RTO and RPO targets.

Exam trap

The trap here is that candidates may think increasing backup frequency or retention solves the RTO problem, but RTO is about recovery time, not data loss tolerance (RPO), and only a pre-staged recovery system like a warm standby can reduce the time to bring the application online.

How to eliminate wrong answers

Option B is wrong because increasing backup retention only extends the history of backups, not the speed of recovery; it does nothing to address the 6-hour restore time that violates the 2-hour RTO. Option C is wrong because switching to weekly full backups only increases the RPO to up to 7 days, far exceeding the required 30-minute RPO, and does not improve restore speed. Option D is wrong because reducing logging on the application server may slightly decrease backup size but does not eliminate the need to rebuild the server from scratch, and it can compromise audit trails and security monitoring.

Practice this question →

MCQeasy

An investigator needs a copy of a suspect laptop drive for analysis without changing the original media. What should be used?

A.A simple file copy of the user folder

B.A full forensic image taken with a write blocker

C.A compressed archive of the desktop contents

D.The original drive mounted normally on the investigator machine

AnswerB

This is the best answer because a forensic image creates a bit-for-bit copy of the drive while a write blocker prevents accidental changes to the original media. That combination preserves evidentiary integrity and allows the investigator to analyze the copy safely. It is the standard approach when the original disk may later be needed in court or for formal review.

Why this answer

A full forensic image taken with a write blocker is the correct method because it creates a bit-for-bit copy of the entire drive, including all partitions, unallocated space, and metadata, without altering the original media. The write blocker hardware or software ensures that no write commands reach the suspect drive, preserving its integrity for legal and evidentiary purposes. This approach is required by forensic standards such as NIST SP 800-86 and ensures the copy is admissible as evidence.

Exam trap

The trap here is that candidates confuse a simple file copy or archive with a forensically sound image, overlooking the need for a bit-for-bit copy and write protection to preserve evidence integrity.

How to eliminate wrong answers

Option A is wrong because a simple file copy of the user folder only captures visible files, not deleted data, file system metadata, or unallocated space, and it does not prevent writes to the original drive. Option C is wrong because a compressed archive of the desktop contents similarly omits critical forensic artifacts like slack space, partition tables, and hidden data, and it does not use a write blocker to protect the original media. Option D is wrong because mounting the original drive normally on the investigator machine allows the operating system to write to the drive (e.g., updating timestamps, logs, or file system metadata), which alters the evidence and violates forensic best practices.

Practice this question →

MCQeasy

Employees in a server room often prop the door open while carrying equipment. What control best helps detect and prevent this behavior?

A.Install a door-ajar alarm and use a self-closing door mechanism.

B.Add more desk chairs outside the server room for convenience.

C.Increase the screen brightness on the monitoring workstation.

D.Move backup tapes to a nearby shelf for easier access.

AnswerA

A door-ajar alarm combined with a self-closing mechanism directly addresses the problem by alerting staff when the door is left open and reducing the chance that it stays open. This is a practical physical security control because it supports both detection and prevention. It helps protect restricted areas without relying only on user behavior.

Why this answer

A door-ajar alarm provides immediate notification when the door is left open, while a self-closing door mechanism physically ensures the door closes automatically after each use. Together, they directly address the behavior of propping the door open by both detecting the violation and preventing it from remaining open, which is critical for maintaining physical security controls in a server room.

Exam trap

The trap here is that candidates may choose a convenience-based option (like adding chairs or moving tapes) thinking it addresses the root cause, but the question specifically asks for a control that both detects and prevents the behavior, which only a combination of a door-ajar alarm and a self-closing mechanism achieves.

How to eliminate wrong answers

Option B is wrong because adding more desk chairs outside the server room does not detect or prevent the door from being propped open; it only addresses convenience, not security. Option C is wrong because increasing screen brightness on the monitoring workstation has no effect on door position or access control; it is a display setting unrelated to physical security. Option D is wrong because moving backup tapes to a nearby shelf does not prevent or detect the door being propped open; it only changes storage location and could even increase risk by placing sensitive media outside the secure area.

Practice this question →

Multi-Selectmedium

A SIEM alert shows five failed logins to a SaaS admin portal from one IP, followed by a successful login from a new city three minutes later. Which two actions are the best next steps for the analyst to validate the event before containment? Select two.

Select 2 answers

A.Review the identity provider and MFA logs to confirm the successful login came from the same account and device context.

B.Correlate the source IP with corporate VPN, CASB, or known cloud egress ranges.

C.Immediately disable the SaaS platform for every user until the investigation is finished.

D.Reimage the user’s laptop immediately to remove any possible malware.

E.Delete the failed login records to reduce noise in the SIEM.

AnswersA, B

This is the best first validation step because identity provider logs can confirm whether the login sequence used the expected MFA method, device, and authentication path. It helps distinguish suspicious access from legitimate use, such as a new browser session or a reauthentication event. Correlating the alert with authoritative identity logs also reduces reliance on a single SIEM record and improves triage accuracy.

Why this answer

Reviewing the identity provider (IdP) and MFA logs allows the analyst to verify whether the successful login originated from the same user account and device context as the failed attempts. This step is critical to determine if the successful login was an attacker who bypassed MFA or a legitimate user who eventually succeeded, providing evidence of account compromise or a false positive.

Exam trap

The trap here is that candidates may rush to containment (Option C) without first performing validation steps, failing to recognize that the question specifically asks for actions to 'validate the event before containment'.

Practice this question →

MCQmedium

An investigator must collect data from a suspected insider-threat laptop so the evidence could be used in an HR and legal review. Which action best preserves admissibility?

A.Boot the laptop normally and browse the user's files for clues

B.Create a forensic image through a write blocker and record hashes before and after acquisition

C.Copy the user's documents to a USB drive and continue the investigation later

D.Take screenshots of the desktop and delete the original drive contents afterward

AnswerB

This is the correct preservation method because it avoids altering the original disk and creates verifiable integrity checks. Using a write blocker prevents writes to the source media, and hashes document that the image matches the evidence. Detailed chain-of-custody records then support admissibility in HR, disciplinary, or legal proceedings.

Why this answer

Creating a forensic image through a write blocker ensures the original evidence is not altered, preserving its integrity for admissibility in HR and legal proceedings. Recording hashes before and after acquisition allows verification that the image is an exact, unmodified copy, which is critical for chain of custody and meeting legal standards such as Daubert or Federal Rules of Evidence.

Exam trap

The trap here is that candidates may think booting normally or copying files is sufficient for evidence collection, but the exam emphasizes that any action that modifies the original media breaks the chain of custody and makes evidence inadmissible in legal proceedings.

How to eliminate wrong answers

Option A is wrong because booting the laptop normally modifies the system (e.g., writes to the page file, updates timestamps, and alters registry keys), which can destroy volatile evidence and render the data inadmissible due to lack of integrity. Option C is wrong because copying user documents to a USB drive without using a write blocker or imaging tool alters file metadata (e.g., last access times) and does not capture deleted files or slack space, breaking the forensic soundness required for legal review. Option D is wrong because taking screenshots only captures a superficial view and does not preserve the full disk state, while deleting the original drive contents destroys the primary evidence, making it impossible to verify or challenge the screenshots later.

Practice this question →

MCQmedium

During morning SIEM review, an analyst sees 37 failed SSH logins followed by a successful login to a Linux server from a jump host. The account belongs to a configuration-management service account, and the activity occurred inside the normal maintenance window. What should the analyst do next to determine whether the alert is a true positive or a false positive?

A.Immediately isolate the Linux server from the network and begin recovery.

B.Correlate the event with the approved maintenance ticket and automation job logs.

C.Reset the service account password before reviewing any additional evidence.

D.Disable SSH on the server until the next patch cycle is complete.

AnswerB

Matching the authentication pattern to a change ticket and automation logs is the best validation step. It confirms whether the repeated failures and successful login were produced by an approved task rather than malicious activity. This is the most efficient way to distinguish a true positive from an expected operational event without disrupting a legitimate maintenance process.

Why this answer

The analyst should correlate the failed SSH logins with the approved maintenance ticket and automation job logs to verify if the activity is expected. The failed logins followed by a successful login from a jump host during a maintenance window are consistent with a configuration-management tool (e.g., Ansible, Puppet) retrying authentication. This correlation confirms whether the alert is a true positive (unauthorized access) or a false positive (routine automation).

Exam trap

The trap here is that candidates assume any failed logins followed by a success indicate a brute-force attack, but the context of a maintenance window and a service account points to legitimate automation retries, not malicious activity.

How to eliminate wrong answers

Option A is wrong because immediately isolating the Linux server is premature and disruptive; the activity occurred during a maintenance window and may be legitimate automation, so isolation should only occur after confirming malicious intent. Option C is wrong because resetting the service account password without reviewing evidence could break legitimate automation jobs and does not address the need to determine if the alert is a true or false positive. Option D is wrong because disabling SSH on the server is an overreaction that would block all remote administration, including legitimate maintenance, and is not a diagnostic step.

Practice this question →

MCQmedium

A SOC analyst is investigating an alert triggered when a user clicked a link in an email. The email appeared to be from a trusted vendor and included a PDF attachment with a macro, but the user did not run the macro. Upon reviewing the email headers, the analyst notices that the sender's domain is a common misspelling of the vendor's legitimate domain. Which of the following is the most direct indicator that this email is a phishing attempt?

A.The macro embedded in the PDF attachment

B.The misspelled sender domain in the email headers

C.The alert generated by the user clicking the link

D.The email appeared to be from a known vendor

AnswerB

This is the strongest indicator because it directly shows the email's origin is fraudulent. Attackers register domains that are visually similar to legitimate ones to trick users. The domain mismatch confirms the email is not from the vendor.

Why this answer

The misspelled sender domain in the email headers is the most direct indicator of a phishing attempt because it reveals the attacker's use of domain spoofing or a lookalike domain to impersonate a trusted vendor. This is a classic social engineering technique that bypasses the user's visual inspection, and since the user did not run the macro, the macro itself is not an active threat. The email headers provide forensic evidence of the domain mismatch, which is a definitive sign of phishing regardless of user actions.

Exam trap

CompTIA often tests the distinction between a potential threat (like an unexecuted macro) and an actual indicator of an attack (like a spoofed domain in headers), trapping candidates who focus on the payload rather than the evidence of impersonation.

Why the other options are wrong

The macro was not executed by the user, so it is not a direct indicator of phishing in this alert; the misspelled domain is a more immediate red flag.

The alert is a consequence of the user's action, not a direct indicator of phishing. The question asks for the most direct indicator that the email itself is a phishing attempt, and the alert is a system response, not a characteristic of the email.

The email appearing to be from a known vendor is not a direct indicator of phishing; attackers often spoof trusted names. The misspelled domain in the headers is the actual evidence of impersonation.

Practice this question →

MCQeasy

A workstation is suspected of malware infection, and it is still powered on and connected to the network. Which action best preserves volatile evidence before the system is shut down?

A.Immediately power off the workstation to stop any malicious activity.

B.Capture memory and note running processes before taking further action.

C.Run a full antivirus scan before documenting anything.

D.Delete temporary files to reduce the chance of reinfection.

AnswerB

Volatile data such as memory, active network connections, and running processes can disappear if the system is powered down. Capturing that information first preserves evidence that may show malware behavior, injected code, or command-and-control activity. This is a core incident-response practice when the system is still live.

Why this answer

Volatile evidence, such as the contents of RAM (running processes, network connections, open files), is lost when the system is powered off. Capturing a memory dump and recording running processes preserves this critical data for forensic analysis, allowing investigators to identify malware artifacts (e.g., injected code, hidden processes) that exist only in memory. This aligns with the NIST SP 800-86 forensic procedure of prioritizing volatile data collection before system shutdown.

Exam trap

CompTIA often tests the misconception that immediate shutdown stops malware activity, but the trap here is that volatile evidence is lost on power-off, and the correct forensic priority is to capture memory and process data first.

How to eliminate wrong answers

Option A is wrong because immediately powering off the workstation destroys volatile evidence (RAM contents, network state, running processes) and may cause malware to lose its in-memory footprint, hindering forensic analysis. Option C is wrong because running a full antivirus scan modifies the system state (e.g., quarantining files, altering file timestamps) and can overwrite or destroy volatile evidence before it is captured. Option D is wrong because deleting temporary files actively destroys potential evidence (e.g., malware droppers, logs) and does not preserve volatile data like memory or process lists.

Practice this question →

MCQmedium

A SIEM alert shows 300 failed logins against the same VPN account from one source IP over 12 minutes, followed by a successful login from that same IP and a spike in mailbox access. The user says they did not initiate the session. What is the most likely cause?

A.A brute-force attack that eventually guessed the correct password

B.A password-spraying attempt against many different accounts

C.A normal VPN reconnect after a brief network outage

D.A false positive caused by email synchronization

AnswerA

The sequence of hundreds of failed authentication attempts against a single VPN account, followed by a successful login and immediate anomalous mailbox activity, is the classic signature of an online brute-force attack. Automated tools iterate through password lists or character combinations until one succeeds; after gaining access, the attacker exfiltrates or reads mail. The correlation of failure count, success, and post-authentication behavior confirms the credentials were compromised.

Why this answer

The sequence of 300 failed logins from a single source IP against one VPN account, followed by a successful login and abnormal mailbox access, is the classic pattern of a brute-force attack. The attacker systematically tried many passwords until they guessed the correct one, then used the compromised credentials to access the user's mailbox. The user's denial confirms the session was unauthorized, ruling out legitimate reconnection or synchronization.

Exam trap

The trap here is that candidates may confuse a brute-force attack with password spraying, but the key differentiator is the single target account versus many accounts, and the high volume of failures against that one account.

How to eliminate wrong answers

Option B is wrong because password spraying targets many different accounts with a few common passwords, not 300 attempts against a single account. Option C is wrong because a normal VPN reconnect after a brief network outage would not generate 300 failed logins; it would typically succeed on the first or second attempt after the outage resolves. Option D is wrong because email synchronization does not cause failed logins against a VPN account; it uses existing authenticated sessions and would not produce a spike in mailbox access from a new IP.

Practice this question →

Multi-Selectmedium

After restoring a virtual file server from backup, users can log in and browse shares, but finance says the last day's edits are missing. Which two steps should the administrator take before declaring recovery complete? Select two.

Select 2 answers

A.Verify the restore point meets the required recovery point objective and the business expects the data loss window.

B.Check whether application transaction logs or application-consistent snapshots need to be replayed.

C.Rebuild the server from scratch without checking the backup timestamp.

D.Disable all backup jobs until the next maintenance window.

E.Change the DNS records so users point to a different server name.

AnswersA, B

This is important because a restore can technically succeed while still missing more data than the business can tolerate. The RPO defines how much data loss is acceptable. Confirming the restore point against that expectation helps determine whether the backup strategy met recovery requirements or whether additional recovery work is needed.

Why this answer

The Recovery Point Objective (RPO) defines the maximum acceptable data loss. If the restore point is from before the last day's edits, the administrator must confirm that this data loss window is acceptable to the business. Option B is correct because application-consistent backups often require replaying transaction logs (e.g., SQL Server VSS writer logs) to bring the database to the latest committed state; skipping this step leaves the data incomplete.

Exam trap

The trap here is that candidates may assume a successful file-level restore is complete, overlooking the need to verify RPO alignment and replay application-specific transaction logs for consistency.

Practice this question →

MCQmedium

A monthly scan finds a critical remote-code-execution vulnerability on an internet-facing VPN appliance. The vendor has not released a patch for six weeks, but the service must stay online. Which short-term action is the best risk treatment?

A.Accept the risk and wait for the next scheduled scan cycle.

B.Apply compensating controls such as strict access filtering, MFA, enhanced logging, and alerting.

C.Disable all logging so the appliance performs better under load.

D.Ignore the issue until the vendor confirms the vulnerability is being actively exploited.

AnswerB

When a patch is unavailable, the best short-term treatment is to reduce exposure and add monitoring. Tight access control, MFA, and logging do not remove the vulnerability, but they can meaningfully lower the likelihood of exploitation and improve detection. This is the correct operational response when the service must remain online and a permanent fix is not yet available.

Why this answer

When a patch is unavailable for a critical vulnerability, compensating controls reduce risk without taking the service offline. For an internet-facing VPN appliance, strict access filtering (e.g., limiting source IPs via ACLs), enforcing MFA, and enabling enhanced logging/alerting can mitigate exploitation attempts while maintaining availability. This aligns with the risk treatment strategy of risk reduction through controls rather than acceptance, avoidance, or transfer.

Exam trap

The trap here is that candidates may think accepting risk (Option A) is acceptable for a critical vulnerability, but CompTIA expects you to recognize that compensating controls are the appropriate short-term treatment when a patch is unavailable and the service must remain online.

How to eliminate wrong answers

Option A is wrong because accepting the risk and waiting for the next scan cycle leaves the organization exposed to active exploitation of a critical RCE vulnerability, which is unacceptable for an internet-facing service. Option C is wrong because disabling logging removes visibility into potential attacks, hindering incident detection and response, and does not address the vulnerability itself. Option D is wrong because ignoring the issue until active exploitation is confirmed violates the principle of proactive security; waiting for proof of exploitation increases the likelihood of a breach and potential damage.

Practice this question →

MCQeasy

A SOC analyst notices that log timestamps from different servers do not line up during an investigation. What should be implemented to improve event correlation?

A.A more aggressive password policy for all users.

B.Network Time Protocol time synchronization across systems.

C.Longer user account names to make records easier to read.

D.Disabling centralized logging to reduce duplication.

AnswerB

Time synchronization is essential for reliable logging because incident responders need events to appear in the correct order. If servers use different clocks, correlations can become misleading and slow the investigation. NTP keeps system time aligned so SIEM alerts, authentication records, and host logs can be compared accurately across multiple systems.

Why this answer

Network Time Protocol (NTP) synchronizes clocks across systems to a common time source, ensuring log timestamps align for accurate event correlation. Without NTP, timestamps from different servers can drift, making it impossible to reconstruct the sequence of events during an investigation. This is a foundational requirement for effective security monitoring and incident response.

Exam trap

The trap here is that candidates may confuse operational security controls (like password policies or naming conventions) with the technical infrastructure needed for accurate log correlation, overlooking NTP as a fundamental prerequisite for time-based analysis.

How to eliminate wrong answers

Option A is wrong because a more aggressive password policy (e.g., complexity, expiration) addresses authentication security, not time synchronization or log correlation. Option C is wrong because longer user account names improve readability but have no effect on timestamp alignment or event correlation. Option D is wrong because disabling centralized logging would eliminate the single repository where logs are aggregated, making correlation even harder and increasing duplication of analysis effort.

Practice this question →

MCQeasy

Based on the exhibit, which change best improves secure administration for the scheduled task?

A.Keep the Administrator account and leave the task running only when a user is logged on.

B.Move the script to the desktop so it is easier for technicians to monitor manually.

C.Use a dedicated service account with only the required permissions and allow the task to run whether or not anyone is logged on.

D.Disable the task and have staff run the script manually whenever they remember to do it.

AnswerC

A dedicated service account with least privilege reduces the risk of credential misuse and limits what the task can access if it is abused. Allowing the task to run whether a user is logged on or not makes the automation reliable for scheduled maintenance. This is a common secure-administration improvement for repeatable scripts.

Why this answer

Using a dedicated service account with minimal required permissions follows the principle of least privilege, reducing the attack surface. Allowing the task to run whether or not anyone is logged on ensures the scheduled task executes reliably without depending on a user session, which is essential for automated administrative tasks. This approach also avoids the security risks of using the built-in Administrator account, which has excessive privileges and is a common target for attackers.

Exam trap

The trap here is that candidates may think making the script easier to access (Option B) or using the built-in Administrator account (Option A) are acceptable, but CompTIA tests the principle of least privilege and the importance of dedicated service accounts for automated tasks to avoid credential theft and ensure reliable execution.

How to eliminate wrong answers

Option A is wrong because keeping the Administrator account violates least privilege and leaving the task to run only when a user is logged on introduces a dependency on an interactive session, which can cause the task to fail if no user is logged in at the scheduled time. Option B is wrong because moving the script to the desktop does not improve security; it actually increases risk by placing the script in a user-accessible location where it could be modified or executed by unauthorized users, and it does not address the need for secure, automated execution. Option D is wrong because disabling the task and relying on manual execution defeats the purpose of automation, introduces human error, and increases the likelihood of missed or delayed administrative actions, which is not a secure or reliable administration practice.

Practice this question →

MCQmedium

A firewall ACL must be modified in production to allow a vendor update server. The team wants to minimize the chance of accidentally blocking payroll traffic. Which change-management step is best before applying the rule?

A.Apply the rule immediately and monitor the help desk for complaints.

B.Test the proposed rule in a staged policy set and keep a rollback plan ready.

C.Remove all deny rules temporarily so the vendor traffic can pass cleanly.

D.Disable logging during the change to avoid slowing down the firewall.

AnswerB

Testing the rule in a staged or cloned policy set helps confirm that the ACL logic, rule order, and source and destination matching behave as intended before production exposure. A rollback plan provides a fast recovery path if the change still causes an unexpected impact. Together, these practices reduce the likelihood of disrupting payroll traffic and align with safe, controlled change management in operational environments.

Why this answer

Testing the proposed rule in a staged policy set allows the team to verify that the new ACL entry does not inadvertently match and drop payroll traffic before it is applied to the production firewall. Keeping a rollback plan ready ensures that if the rule causes unexpected blocking, the previous ACL can be restored immediately, minimizing downtime. This aligns with the change-management principle of validating changes in a controlled environment to prevent service disruption.

Exam trap

The SY0-701 exam often tests the misconception that immediate application with monitoring is sufficient, but the trap is that this reactive approach ignores the risk of silently blocking critical traffic until complaints arise, which is unacceptable in a production environment.

How to eliminate wrong answers

Option A is wrong because applying the rule immediately without prior testing or rollback planning violates change-management best practices and risks accidentally blocking payroll traffic if the ACL logic is flawed; monitoring the help desk is reactive, not proactive. Option C is wrong because removing all deny rules temporarily would expose the network to unauthorized traffic, defeating the purpose of the firewall and violating the principle of least privilege; it does not address the specific need to allow vendor traffic while protecting payroll.

Practice this question →

MCQmedium

A billing application has an RTO of 2 hours and an RPO of 30 minutes. The current recovery method requires rebuilding the VM from scratch and then restoring last night's backup, which takes over six hours. Which solution best meets the stated recovery objectives?

A.Keep the current backup schedule and shorten the documentation for the restore procedure.

B.Switch to weekly full backups and manually verify them after business hours.

C.Store backups on the same production host so restores are faster.

D.Use a warm standby replica with frequent log shipping or near-continuous replication.

AnswerD

A warm standby with frequent log shipping is the best fit because it reduces both data loss and restoration time. The standby already has the operating system and application environment in place, so failover is much faster than rebuilding from scratch. Frequent log shipping narrows the recovery point to within the required 30 minutes, making the design aligned with both business objectives.

Why this answer

A warm standby replica with frequent log shipping or near-continuous replication can achieve an RPO of 30 minutes or less by minimizing data loss, and an RTO of 2 hours by allowing rapid failover to the replica. This directly addresses the current recovery method's failure to meet the RTO (6+ hours vs. 2 hours) and RPO (last night's backup vs. 30 minutes). Technologies like SQL Server log shipping or VMware vSphere replication provide near-continuous data synchronization, enabling recovery within the stated objectives.

Exam trap

The trap here is that candidates may think faster backups or better documentation (Option A or C) can solve the RTO/RPO gap, but they fail to recognize that the core issue is the recovery method itself—rebuilding from scratch—which cannot be fixed by incremental improvements to backup speed or storage location.

How to eliminate wrong answers

Option A is wrong because shortening documentation does not reduce the actual time to rebuild the VM and restore the backup, so it cannot meet the 2-hour RTO. Option B is wrong because weekly full backups increase the RPO to up to 7 days, far exceeding the required 30 minutes, and manual verification after hours does not improve recovery speed. Option C is wrong because storing backups on the same production host creates a single point of failure and does not address the fundamental issue of slow rebuild and restore times; it also violates the 3-2-1 backup rule.

Practice this question →

MCQmedium

A SIEM correlates VPN authentication logs and sees 14 different user accounts receive one failed login attempt each from the same source IP during a 5-minute window. A few minutes later, one of those accounts successfully authenticates from that same IP. Which attack is most likely?

A.Brute-force attack against a single account using many passwords.

B.Password spraying using a common password against many accounts.

C.Replay attack using previously captured authentication traffic.

D.ARP poisoning used to intercept local network traffic.

AnswerB

Password spraying is a low-and-slow technique that tests one common password (for example, 'Autumn2024!') against a broad list of usernames, keeping attempts per account below threshold to trigger no lockout. The correlation of 14 distinct VPN authentication failures followed by one success is exactly the signature of a spray, where the attacker cycles through accounts with a single guess each round. This method evades per-account brute-force detection and relies on weak password reuse across the environment.

Why this answer

The SIEM observed 14 different user accounts each receiving a single failed login attempt from the same source IP within a 5-minute window, followed by one account successfully authenticating. This pattern is characteristic of password spraying, where an attacker tries a common password (e.g., 'Password123') against many accounts to avoid triggering account lockouts, then leverages a successful guess. The single failure per account avoids the threshold for brute-force detection, and the eventual success confirms a guessed credential.

Exam trap

The trap here is that candidates confuse password spraying with brute-force attacks, failing to recognize that the key differentiator is the number of accounts targeted versus the number of passwords attempted per account.

How to eliminate wrong answers

Option A is wrong because a brute-force attack targets a single account with many password attempts, not multiple accounts with one attempt each. Option C is wrong because a replay attack requires capturing and retransmitting valid authentication traffic (e.g., a Kerberos TGT or NTLM hash), which would not produce failed login attempts from the same IP. Option D is wrong because ARP poisoning is a Layer 2 attack used to intercept local traffic on a switched network, not to generate VPN authentication logs with failed and successful logins from a single source IP.

Practice this question →

Multi-Selectmedium

A Windows server is still running after suspected compromise. Before it is powered down, which two volatile data sources should be collected first? Select two.

Select 2 answers

A.A memory capture or RAM image from the live system.

B.A snapshot of active network connections and listening ports.

C.A full disk image from the powered-off server.

D.A hardware inventory report from the asset management database.

E.A screenshot of the server’s desktop wallpaper for reference.

AnswersA, B

A memory capture is one of the most important volatile data sources because it can reveal running malware, injected code, encryption keys, live network sessions, and command history not stored on disk. Once the system is powered off, this information is lost. Capturing RAM early gives investigators the best chance to reconstruct the attacker’s activity.

Why this answer

A memory capture (RAM image) preserves volatile data that is lost on power-down, including running processes, open network connections, encryption keys, and malware that exists only in memory. This is critical for forensic analysis of a live system suspected of compromise, as it captures the system state at the time of collection.

Exam trap

The trap here is that candidates often confuse the order of volatility and select a disk image (Option C) as a first step, not realizing that volatile data like RAM and network connections must be collected before powering down the system.

Practice this question →

MCQmedium

A security analyst receives multiple alerts indicating that several users in the finance department clicked a malicious link in an email. The analyst has confirmed the email subject line and sender address. Which of the following is the BEST first step to contain the incident?

A.Block the sender's email address at the email gateway.

B.Disable the users' accounts.

C.Perform a forensic analysis of the emails.

D.Delete the emails from the users' mailboxes.

AnswerA

Implementing a sender block at the email gateway (MTA) immediately suppresses messages from the malicious address before they reach the internal mail servers, unlike client-side rules. This leverages gateway filtering policies and can be combined with sender reputation scoring to proactively stop related spoofed or lookalike domains. This containment step halts the attack vector at the ingress point, preventing additional users from receiving the phishing payload while the investigation continues.

Why this answer

Blocking the sender's email address at the email gateway is the best first step because it immediately prevents further malicious emails from that sender from reaching any users, containing the incident at the perimeter. This action stops the spread of the attack without disrupting user productivity or requiring time-consuming analysis, aligning with the priority of containment in incident response.

Exam trap

The trap here is that candidates confuse containment with eradication or investigation, choosing to delete emails (Option D) or analyze them (Option C) first, when the immediate priority is to stop the attack vector at the gateway to prevent further compromise.

Why the other options are wrong

Disabling users' accounts is a more disruptive step that should be taken after containing the email threat at the gateway. The immediate priority is to block the malicious email source to prevent further users from clicking the link, not to disable accounts of users who already clicked.

Deleting emails from mailboxes does not prevent users from clicking similar future emails from the same sender, nor does it block the sender's ability to send more malicious emails. Containment requires blocking at the gateway to stop all emails from that sender.

Practice this question →

MCQmedium

During a restore test, a technician brings back a file server successfully, but the application team discovers that the database is missing the last 12 hours of transactions. Management says the business can tolerate only one hour of data loss. What should be changed first?

A.Reduce the restore point objective by storing more copies of the same backup.

B.Implement application-consistent backups or transaction log backups more frequently.

C.Extend the retention period so the full backup is kept for 90 days.

D.Shorten the recovery time objective by using faster storage for the server.

AnswerB

Implementing application-consistent backups or transaction log backups more frequently directly reduces the recovery point objective (RPO) by shortening the interval between captured changes. Application-consistent backups ensure the database is in a valid state, while transaction log backups record every committed transaction, enabling point-in-time recovery to a precise moment. If the maximum tolerated data loss is one hour, capturing transaction logs every 15 minutes satisfies that target, whereas nightly full backups alone could lose up to 24 hours of data.

Why this answer

The core issue is that the database is missing 12 hours of transactions, which exceeds the business's tolerance of one hour of data loss. This indicates that the Recovery Point Objective (RPO) is not being met. Implementing application-consistent backups or more frequent transaction log backups ensures that the database state can be recovered to a point within the acceptable loss window, directly addressing the RPO gap.

Exam trap

The trap here is confusing Recovery Point Objective (RPO) with Recovery Time Objective (RTO), leading candidates to select options that improve restore speed (RTO) or backup retention rather than addressing the frequency of backups needed to limit data loss.

How to eliminate wrong answers

Option A is wrong because reducing the Restore Point Objective (RPO) by storing more copies of the same backup does not change the frequency of backups; it only increases redundancy, which does not reduce data loss. Option C is wrong because extending the retention period (e.g., keeping full backups for 90 days) addresses how long backups are kept, not how recent the recoverable data is, so it does not solve the RPO issue. Option D is wrong because shortening the Recovery Time Objective (RTO) by using faster storage focuses on how quickly the server can be restored, not on minimizing data loss, which is an RPO concern.

Practice this question →

MCQmedium

A help desk ticket confirms that a user entered corporate credentials into a fake sign-in page. Minutes later, the security team finds a new mailbox forwarding rule and evidence that the attacker added backup MFA codes. After disabling the account, what should the team do next to support containment and recovery?

A.Wait for the user to confirm the behavior before taking any further steps.

B.Reimage the user's laptop before reviewing the account activity.

C.Revoke active sessions and reset the compromised credentials.

D.Close the ticket because MFA was enabled and should have prevented access.

AnswerC

After disabling the account, the next step is to cut off any valid sessions and reset the credential set so the attacker cannot continue using stolen access. Because the compromise includes mailbox changes and MFA backup code manipulation, session revocation and credential reset are essential containment and recovery tasks.

Why this answer

After disabling a compromised account, the immediate next step is to revoke all active sessions and reset the credentials. This ensures the attacker cannot maintain access via existing tokens or session cookies, and the new password invalidates any cached or stolen credentials. This aligns with the NIST SP 800-61 incident response containment phase, which prioritizes cutting off active attacker access before further investigation.

Exam trap

The trap here is that candidates assume MFA is a silver bullet and overlook that attackers can register their own MFA devices or use session hijacking, making credential reset alone insufficient without session revocation.

How to eliminate wrong answers

Option A is wrong because waiting for user confirmation delays containment and allows the attacker to continue using the account, potentially exfiltrating data or moving laterally. Option B is wrong because reimaging the user's laptop is premature and unnecessary; the compromise is credential-based, not a local system infection, and reviewing account activity first is critical to understand the scope. Option D is wrong because MFA does not prevent credential theft or session hijacking; the attacker added backup MFA codes, bypassing the protection, and closing the ticket ignores the active threat.

Practice this question →

Multi-Selectmedium

A company-owned laptop is being transferred from the incident site to the evidence locker for a theft investigation. Which two actions best support chain of custody during transport? Select two.

Select 2 answers

A.Place the device in a tamper-evident evidence bag or seal

B.Document the device serial number, date, time, collector, and each handoff

C.Leave the device unsealed so legal staff can inspect it quickly

D.Boot the laptop to confirm the user’s files are still present

E.Use a personal note app instead of formal transfer documentation

AnswersA, B

Place the device in a tamper-evident evidence bag or seal. A tamper-evident seal or bag provides a physical barrier that visibly records any unauthorized opening, and the seal's unique serial number allows the package to be tracked. Sealing the laptop prevents accidental changes to data and preserves the device's state for forensic examination, which is essential for maintaining the evidence's integrity from the scene to the lab. Without such a seal, there is an unbroken opportunity for undetected tampering, undermining the legal admissibility of the evidence.

Why this answer

Placing the device in a tamper-evident evidence bag or seal provides a physical barrier that immediately reveals any unauthorized access during transport. This is a foundational chain-of-custody control that preserves the integrity of the evidence by making tampering detectable, which is critical for admissibility in legal proceedings.

Exam trap

The trap here is that candidates may think booting the laptop is necessary to verify data presence, but this action actually violates forensic preservation principles by altering the system state and potentially destroying evidence.

Practice this question →

MCQmedium

After restoring a virtual file server from backup, users can browse folders, but an accounting application reports missing recent transactions. What should the administrator do next?

A.Mark the restore complete because the file server is reachable

B.Verify the restore in an isolated test environment and compare application data consistency

C.Immediately run a new full backup over the restored server

D.Disable the accounting application permanently to prevent further inconsistency

AnswerB

Restoring into an isolated lab environment allows you to boot the recovered virtual machine without affecting production traffic, then run application-level integrity checks on the accounting data. Compare database row counts, checksums, or last transaction timestamps against a known-good baseline, and validate that transaction logs are consistent with the application's journal. This confirms the backup is not just restorable, but that the application can operate on the recovered data, making it the only definitive validation of a successful restore.

Why this answer

The correct next step is to verify the restore in an isolated test environment and compare application data consistency. Although the file server is reachable and folders appear intact, the accounting application's missing recent transactions indicate that the restored data may be stale or incomplete. Testing in isolation ensures the application's database or transaction logs are consistent with the backup point before returning the server to production, preventing data corruption or loss.

Exam trap

The trap here is that candidates assume file server accessibility equals a successful restore, overlooking the critical distinction between file-level availability and application-level data consistency, which is a common focus in CompTIA SY0-701 Security Operations questions.

How to eliminate wrong answers

Option A is wrong because marking the restore complete based solely on file server reachability ignores application-level data integrity; the accounting application's missing transactions prove the restore is incomplete or inconsistent. Option C is wrong because immediately running a new full backup over the restored server would overwrite the current state without validating data consistency, potentially preserving corruption or missing data in the backup chain. Option D is wrong because disabling the accounting application permanently is an extreme, unnecessary action that does not address the root cause of data inconsistency and disrupts business operations.

Practice this question →

MCQhard

Based on the exhibit, which temporary control best reduces risk until the patch is released?

A.Increase scan frequency to daily and leave the service exposed.

B.Place the service behind a reverse proxy or WAF and restrict access with source IP allow lists.

C.Disable TLS so the traffic can be inspected more easily.

D.Move administrative access to the same 443 listener as user traffic.

AnswerB

The service must stay online, but the patch is unavailable, so the best temporary measure is to reduce exposure. A reverse proxy or WAF can filter malicious requests, and source IP allow lists shrink the reachable attack surface. Together, those controls act as an effective compensating measure until the vendor fix is released and can be applied.

Why this answer

Placing the service behind a reverse proxy or Web Application Firewall (WAF) with source IP allow lists provides a temporary compensating control that reduces the attack surface until the vendor releases a patch. The reverse proxy or WAF can inspect and filter malicious traffic, while IP allow lists restrict access to trusted sources only, mitigating the risk of exploitation without removing the service entirely.

Exam trap

CompTIA often tests the misconception that increasing monitoring (scan frequency) is a sufficient compensating control, when in fact it does not prevent exploitation—only detection is improved.

How to eliminate wrong answers

Option A is wrong because increasing scan frequency does not reduce risk; it only detects potential issues sooner, leaving the vulnerable service exposed to active exploitation. Option C is wrong because disabling TLS removes encryption, exposing all traffic to interception and tampering, which violates confidentiality and integrity, and does not address the underlying vulnerability. Option D is wrong because moving administrative access to the same 443 listener as user traffic increases the attack surface by merging management and user channels, making it easier for an attacker to target administrative functions.

Practice this question →

MCQmedium

An investigator receives a suspect laptop drive that may be used in court. Which approach best supports a forensically sound image while protecting the original media?

A.Mount the drive read-write so the investigator can browse it quickly.

B.Use a hardware write blocker and create a bit-by-bit forensic image with hashes.

C.Copy only the user profile folders with a file manager to save time.

D.Boot the laptop normally and use backup software to duplicate the disk.

AnswerB

This is the best practice because a hardware write blocker prevents any accidental writes to the source drive, and a bit-by-bit image captures the exact data structure for analysis. Hashing the source or image before and after acquisition provides integrity verification, which is essential when evidence may be challenged later. Together, these steps protect the original media and support chain of custody and courtroom admissibility.

Why this answer

Forensic best practice requires preserving the original media in an unaltered state. A hardware write blocker physically prevents any write commands from reaching the drive, ensuring the original evidence is not modified. Creating a bit-by-bit forensic image (e.g., with `dd` or FTK Imager) captures the entire drive, including slack space and unallocated sectors, and generating cryptographic hashes (SHA-256 or MD5) before and after imaging verifies the image's integrity for court admissibility.

Exam trap

The trap here is that candidates may think booting the laptop or using a file manager is acceptable for a quick preview, but any write access—even seemingly harmless metadata updates—renders the evidence inadmissible under Daubert or Frye standards.

How to eliminate wrong answers

Option A is wrong because mounting the drive read-write allows the operating system to write metadata (e.g., timestamps, directory entries) to the drive, altering the original evidence and breaking the chain of custody. Option C is wrong because copying only user profile folders with a file manager omits critical data such as deleted files, file system metadata, and unallocated space, which may contain evidence; it also modifies file access times. Option D is wrong because booting the laptop normally writes temporary files, logs, and registry changes to the drive, and backup software typically does not create a bit-for-bit copy, altering the original media and compromising forensic soundness.

Practice this question →

Multi-Selecteasy

A network analyst reviews packet captures from a subnet where users intermittently lose access to the gateway. Which two findings would most strongly indicate ARP spoofing? Select two.

Select 2 answers

A.Repeated unsolicited ARP replies map the gateway IP to a different MAC address.

B.Several hosts suddenly send gateway traffic to the same unexpected MAC address.

C.Extra DNS traffic appears during the lunch hour.

D.A switch port negotiates a slower speed than usual.

E.The wireless network name appears in a site survey.

AnswersA, B

Repeated unsolicited ARP replies are a classic sign of spoofing on a LAN. In normal operation, hosts send ARP replies only in response to requests; a gratuitous ARP reply announcing the gateway IP with an attacker's MAC address forces all hosts to update their ARP cache to that malicious mapping. This lets the attacker intercept or modify traffic intended for the gateway, enabling man-in-the-middle attacks.

Why this answer

ARP spoofing involves an attacker sending forged ARP replies to associate the gateway's IP address with the attacker's MAC address. Repeated unsolicited ARP replies mapping the gateway IP to a different MAC address is a classic indicator, as legitimate ARP replies are normally solicited by requests. This causes traffic intended for the gateway to be redirected to the attacker, enabling interception or disruption.

Exam trap

CompTIA often tests the distinction between ARP spoofing (unsolicited ARP replies) and ARP cache poisoning (where the attacker responds faster than the legitimate host), and candidates may confuse extra DNS traffic or physical issues with ARP-based attacks.

Practice this question →

MCQmedium

A security analyst at a financial firm notices a significant increase in DNS queries from an internal server to a rarely visited external domain. The queries are for unusual subdomain names that contain encoded data. The server is not a DNS server and does not typically generate outbound traffic. Which of the following is the MOST appropriate immediate action for the analyst to take?

A.Block all outbound DNS traffic from the server immediately.

B.Isolate the server from the network to prevent further data loss.

C.Create a firewall rule to log all further DNS queries from the server.

D.Run an antivirus scan on the server.

AnswerB

Isolation effectively stops the ongoing DNS tunneling by severing the server’s network connectivity. This contains the incident, prevents additional data exfiltration, and provides a controlled environment for further forensic analysis. It aligns with standard incident response procedures.

Why this answer

The server is exhibiting signs of a DNS data exfiltration attack, where encoded data is being tunneled through DNS queries to an external domain. Isolating the server immediately stops the data loss and prevents further compromise, which is the most critical first step in incident response. Blocking traffic or scanning alone would not halt the active exfiltration, and logging without action allows continued data theft.

Exam trap

The trap here is that candidates choose to log or scan first, mistaking detection for containment, but the SY0-701 emphasizes immediate isolation to stop data loss in active exfiltration scenarios.

Why the other options are wrong

Blocking all outbound DNS traffic immediately could disrupt legitimate services and does not address the potential data exfiltration already occurring; isolation is preferred to stop the threat without impacting other systems.

Creating a firewall rule to log further DNS queries is a passive monitoring step that does not immediately stop the potential data exfiltration or compromise. Given the evidence of encoded data in DNS queries, the priority is to contain the threat by isolating the server, not just logging additional activity.

Running an antivirus scan is a reactive, slower step that does not immediately stop potential data exfiltration via DNS tunneling. The server is already compromised and actively sending data, so isolation is needed first.

Practice this question →

Multi-Selecthard

A Linux operations team must run a nightly maintenance script on 70 servers to rotate logs and restart one service. Security will not allow interactive SSH logins, and the script should only have the permissions required for those two commands. Which two configuration choices best meet the requirement? Select two.

Select 2 answers

A.Create a dedicated automation account and restrict it in sudoers to the exact commands needed.

B.Place the automation account in the root group so it can restart services everywhere.

C.Use SSH key authentication with a restricted shell or forced command for the automation account.

D.Copy the administrator's personal password into the script so the job can log in unattended.

E.Approve the job through email one time, then allow the script to run with no restrictions forever.

AnswersA, C

A dedicated account makes auditing clear, and sudoers restrictions enforce least privilege for only the approved commands.

Why this answer

Creating a dedicated automation account and restricting it in sudoers to the exact commands needed (e.g., `/usr/sbin/logrotate` and `/usr/bin/systemctl restart <service>`) enforces the principle of least privilege. This ensures the account can only execute the specific maintenance tasks without granting interactive SSH access or unnecessary permissions.

Exam trap

The trap here is that candidates often assume placing an account in a privileged group (like root) is acceptable for automation, but CompTIA tests the principle of least privilege, requiring exact command restriction rather than broad group membership.

Practice this question →

MCQmedium

A system administrator must run a weekly maintenance script that stops and restarts two services on 50 Linux servers. Security says the job must not use an interactive login and should have only the permissions needed for that task. What is the best approach?

A.Use the root account for the scheduled job so it always succeeds.

B.Create a dedicated account with sudo rights limited to the required service commands.

C.Ask an administrator to log in manually each week and run the script.

D.Store the administrator password in the script so the task can authenticate automatically.

AnswerB

Creating a dedicated, non-interactive service account and granting it only the sudo commands the script requires (for example, `/usr/bin/systemctl restart myservice` with `NOPASSWD`) allows the scheduled job to run unattended while strictly limiting its blast radius. In the `/etc/sudoers` file, you can specify the exact command path and permitted arguments, so even a compromised script cannot pivot to a root shell or modify system files outside those commands. This design follows least privilege and provides a clear audit trail because `sudo` logs which user executed which command. It is a standard, secure pattern for automated operational tasks.

Why this answer

It follows the principle of least privilege by creating a dedicated service account with sudo rights restricted to only the specific service management commands (e.g., systemctl restart serviceA.service && systemctl restart serviceB.service). This avoids using the root account (which has unrestricted access) and eliminates the need for interactive logins or embedded credentials, while still allowing the scheduled job (e.g., via cron) to run non-interactively.

Exam trap

The trap here is that candidates may assume root is necessary for service management on Linux, but sudo with carefully scoped commands provides the same functionality without granting full root privileges.

How to eliminate wrong answers

Option A is wrong because using the root account for a scheduled job violates the principle of least privilege and unnecessarily exposes the entire system to potential compromise if the script is tampered with. Option C is wrong because requiring manual interactive login each week defeats automation, introduces human error risk, and does not scale to 50 servers. Option D is wrong because storing the administrator password in the script is a severe security risk (credential exposure) and violates the requirement to avoid interactive login, as the password would be visible in plaintext or easily reversible.

Practice this question →

MCQmedium

An administrator pushed a firewall rule change to allow a new vendor IP range during business hours. Minutes later, payroll users lost access to an internal service. Which change management practice would have best reduced the impact?

A.Apply changes directly in production so they take effect as quickly as possible.

B.Test the change in a staging environment and include a rollback plan in the request.

C.Avoid documenting the change until after the maintenance window ends.

D.Use verbal approval from the payroll manager instead of the normal ticket process.

AnswerB

This is the best practice because staging validation can reveal unintended access impacts before production is touched. A rollback plan gives operators a fast, documented way to restore service if the change breaks something critical. Together, testing and rollback planning reduce outage duration and support safer operational hardening by making the change controlled, reviewable, and reversible.

Why this answer

Testing the change in a staging environment first would have revealed any unintended side effects, such as ACL conflicts that blocked payroll traffic. Including a rollback plan ensures that if the change causes issues in production, the administrator can quickly revert the firewall rule to restore service. This aligns with the change management process of minimizing impact through controlled testing and contingency planning.

Exam trap

The trap here is that candidates may think speed of implementation (Option A) is more important than safety, but CompTIA emphasizes that change management processes, including testing and rollback, are critical to prevent production outages.

How to eliminate wrong answers

Option A is wrong because applying changes directly in production without prior testing increases the risk of disrupting services, as seen when the new vendor IP range inadvertently blocked payroll users. Option C is wrong because avoiding documentation until after the maintenance window violates change management best practices and makes it difficult to identify or revert the change when an incident occurs. Option D is wrong because using verbal approval bypasses the formal change control process, leaving no audit trail and increasing the chance of unauthorized or uncoordinated changes that can cause outages.

Practice this question →

MCQmedium

A public web application is seeing bursts of requests that contain SQL metacharacters, encoded script tags, and attempts to POST to administrative endpoints. The team wants a control that can inspect HTTP traffic and block the malicious requests before they reach the app. What should be deployed?

A.A web application firewall in front of the application

B.An endpoint detection and response agent on the web server only

C.A data loss prevention rule on the email gateway

D.A network access control system for user authentication

AnswerA

A web application firewall (WAF) inspects inbound HTTP/S traffic at Layer 7, parsing request bodies, headers, and query strings for attack signatures such as SQL injection or cross-site scripting payloads. Deployed inline in front of the application, it can filter and block malicious bursts before the web server processes them, and many WAFs also provide rate limiting and bot mitigation to handle traffic spikes. This is precisely the control designed to stop application-layer injection attempts.

Why this answer

A web application firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at the application layer (Layer 7), analyzing request payloads for SQL metacharacters, encoded script tags (XSS), and unauthorized POST attempts to administrative endpoints. By deploying a WAF in front of the web application, malicious traffic is filtered and blocked before it reaches the application server, providing a proactive security control against common web attacks such as SQL injection and cross-site scripting.

Exam trap

The trap here is that candidates may confuse a WAF with a network firewall or an IDS/IPS, but the question specifically mentions HTTP traffic inspection and blocking of application-layer attacks (SQLi, XSS), which is the precise domain of a WAF, not a general network firewall or host-based EDR.

How to eliminate wrong answers

Option B is wrong because an endpoint detection and response (EDR) agent on the web server only monitors and responds to threats at the host level (e.g., file changes, process anomalies) after traffic has already reached the server; it does not inspect or block incoming HTTP requests at the network perimeter. Option C is wrong because a data loss prevention (DLP) rule on the email gateway is designed to monitor and prevent the unauthorized transmission of sensitive data via email, not to inspect or block HTTP traffic targeting a web application.

Practice this question →

MCQmedium

A help desk ticket reports that a user's Microsoft 365 mailbox sent hundreds of messages to external contacts, and the user says they are still receiving MFA prompts they did not start. The attacker may still have an active web session. What is the best first containment action?

A.Delete the suspicious sent messages and close the ticket.

B.Revoke the account's active sessions and reset the password immediately.

C.Wait until the end of the workday to avoid interrupting the user.

D.Reimage the user's laptop before touching the email account.

AnswerB

Ending active sessions cuts off any stolen cookies or tokens that may still be valid, and resetting the password prevents immediate reentry. In an email compromise, the attacker often keeps access through browser sessions even after credentials change. Fast containment should focus on terminating current access paths first, then investigating forwarding rules, OAuth grants, and sign-in history.

Why this answer

The user is still receiving unsolicited MFA prompts, indicating an attacker likely has an active web session with a valid token. Revoking all active sessions immediately invalidates any existing tokens or cookies, while resetting the password ensures the attacker cannot re-authenticate. This is the fastest way to cut off the attacker's access and stop further abuse of the mailbox.

Exam trap

The trap here is that candidates may think deleting the sent messages is sufficient containment, failing to recognize that the attacker's active session must be terminated to stop ongoing compromise.

How to eliminate wrong answers

Option A is wrong because deleting the suspicious messages does not remove the attacker's access; they can continue sending more emails, and the root cause (compromised session) remains unaddressed. Option C is wrong because waiting until the end of the workday gives the attacker more time to exfiltrate data, send additional malicious emails, or escalate privileges, violating the principle of immediate containment.

Practice this question →

MCQhard

Based on the exhibit, which change best moves the ERP recovery design toward meeting both recovery targets?

A.Increase the full backup frequency to every night and keep the same recovery process.

B.Add a warm standby database with 15-minute log shipping and scheduled failover tests.

C.Move backup media to the same server to reduce transfer time.

D.Eliminate differential backups and rely only on weekly full backups.

AnswerB

A warm standby reduces recovery time because the system is already provisioned and closer to operational readiness. Pairing it with 15-minute log shipping also improves the recovery point objective by limiting data loss. Scheduled failover tests validate that the process works in practice, which is critical when tight RTO and RPO targets must both be met.

Why this answer

Adding a warm standby database with 15-minute log shipping significantly reduces the recovery point objective (RPO) to near-zero and, combined with scheduled failover tests, ensures the recovery time objective (RTO) is met. This directly addresses the gap between the current backup-only approach and the required recovery targets, as log shipping provides near-continuous data protection and failover testing validates the recovery process.

Exam trap

The trap here is that candidates may think increasing backup frequency (Option A) is sufficient to meet recovery targets, but they overlook that backups alone do not reduce RTO and that a warm standby with log shipping is required for near-zero RPO and fast failover.

How to eliminate wrong answers

Option A is wrong because increasing full backup frequency to every night still leaves up to 24 hours of potential data loss, failing to meet a low RPO requirement, and does not improve recovery time. Option C is wrong because moving backup media to the same server eliminates off-site redundancy, increasing the risk of total data loss in a disaster, and does not reduce transfer time meaningfully if the network is the bottleneck. Option D is wrong because eliminating differential backups and relying only on weekly full backups increases both RPO (up to 7 days) and RTO (longer restore time), moving further from the recovery targets.

Practice this question →

MCQeasy

A SIEM alert shows five failed logins to an administrator account, followed by a successful login from a new city three minutes later. The account owner says they did not sign in. What should the analyst do first?

A.Ignore the alert because the login eventually succeeded.

B.Temporarily disable the account and open an incident for investigation.

C.Reset the password only and close the alert.

D.Reboot the user's laptop to clear any malicious activity.

AnswerB

Disabling the account immediately limits further unauthorized access while the team investigates. Because the user denies the login and the activity is unusual, the account should be contained quickly and the event escalated for incident handling.

Why this answer

The alert shows a classic indicator of account compromise: multiple failed logins followed by a successful authentication from an unusual location. The account owner's denial of the login confirms unauthorized access, so the immediate priority is to contain the threat by disabling the account and opening an incident for formal investigation. This aligns with the NIST SP 800-61 incident response process, specifically the containment phase before eradication or recovery.

Exam trap

The trap here is that candidates may focus on the 'successful login' as a resolution rather than recognizing it as the point of compromise, leading them to incorrectly choose A or C instead of prioritizing containment.

How to eliminate wrong answers

Option A is wrong because ignoring the alert ignores the clear evidence of a successful brute-force or credential-stuffing attack; the successful login from a new city indicates the attacker gained access, so the alert must be acted upon. Option C is wrong because resetting the password alone does not address the possibility that the attacker established persistence (e.g., a backdoor or session token) or that other accounts are compromised; closing the alert without investigation violates standard incident response procedures. Option D is wrong because rebooting the user's laptop does not remediate a server-side or cloud-based account compromise; the attacker likely authenticated from a remote system, not the local device, and rebooting would not remove any malicious activity on the server or directory service.

Practice this question →

MCQmedium

A security analyst receives an alert about a user account that has been attempting to authenticate from an unusual geographic location outside of business hours. The analyst reviews the event logs and sees that the authentication attempt was successful, but the user has not reported any suspicious activity. Which of the following actions should the analyst take NEXT?

A.Disable the user account immediately to prevent further access

B.Contact the user to verify whether the authentication was legitimate

C.Continuously monitor the account for additional suspicious activity

D.Revoke all active sessions for the user account

AnswerB

Contacting the user is the appropriate next step in the incident response process. The analyst needs to confirm if the user performed the action. If the user denies it, the account is likely compromised, and the incident should be escalated. This step helps avoid false positives and ensures accurate incident handling.

Why this answer

The correct next step is to contact the user to verify whether the authentication was legitimate. Since the authentication was successful and the user has not reported suspicious activity, the analyst must first gather context from the user before taking any disruptive action. This aligns with the incident response process of validation and scoping before containment.

Exam trap

The trap here is that candidates often jump to containment (disabling the account) without first validating the alert, confusing the 'detection and analysis' phase with the 'containment, eradication, and recovery' phase of the incident response process.

Why the other options are wrong

Disabling the account immediately is premature without first verifying if the authentication was legitimate, as it could be the user themselves accessing from a remote location.

Revoking all active sessions is premature without first verifying if the authentication was legitimate; the user may have been traveling or using a VPN, and immediate revocation could disrupt legitimate work.

Practice this question →

MCQmedium

An investigator has just created a bit-for-bit image of a suspect's SSD using a write blocker. Before the drive is returned to evidence storage, what action most directly validates the integrity of both the original media and the image?

A.Defragment the original SSD to make later analysis faster.

B.Calculate cryptographic hashes of the source and the image and record them.

C.Compress the image file to reduce storage usage before documentation.

D.Wipe free space on the original SSD to remove deleted remnants.

AnswerB

Calculating and recording cryptographic hashes of both the source and the acquired image is the cornerstone of forensic integrity. A strong algorithm such as SHA-256 generates a fixed-length fingerprint, and when the hash values match, it proves the image is a bit-for-bit replica with no data altered or lost during acquisition. Recording those hashes in the investigator's notes or a signed report also establishes a verifiable chain of custody, allowing any independent examiner to re-run the same hash and confirm the evidence has not been modified. Without this step, there is no objective way to demonstrate that the image accurately represents the original source.

Why this answer

Cryptographic hashing (e.g., SHA-256 or MD5) generates a unique digital fingerprint of the original SSD and the forensic image. By comparing the hash values, the investigator can verify that the bit-for-bit copy is identical to the source, ensuring data integrity and admissibility in legal proceedings. This step directly validates that no data has been altered or omitted during acquisition.

Exam trap

The trap here is that candidates may confuse integrity validation with storage optimization or cleanup tasks, mistakenly thinking defragmentation or compression helps preserve evidence, when in fact they destroy the forensic integrity that hashing alone guarantees.

How to eliminate wrong answers

Option A is wrong because defragmenting an SSD alters the physical layout of data, which destroys the original evidence and violates forensic best practices; it also does not validate integrity. Option C is wrong because compressing the image file changes its binary representation, breaking the hash match with the original media and potentially corrupting evidence. Option D is wrong because wiping free space modifies the original drive, destroying potential evidence remnants and invalidating any integrity verification.

Practice this question →

MCQmedium

The SOC has contained a mailbox compromise by resetting the password and revoking active sessions. Investigation shows the attacker created an automatic forwarding rule and added an OAuth consent grant. What should happen next to eradicate the threat?

A.Notify all employees to be more careful with email before taking any technical steps.

B.Delete the mailbox and create a new account for the user immediately.

C.Remove the malicious forwarding rule and review or revoke suspicious OAuth app grants.

D.Restore the user's messages from backup and reopen access without further review.

AnswerC

Eradication means removing the adversary's persistence mechanisms and closing the foothold they created. In a mailbox compromise, forwarding rules and unauthorized OAuth consents are common persistence methods. Removing those artifacts, then confirming no other malicious rules or delegated access remain, is the correct next step before returning the account to normal use and monitoring for recurrence.

Why this answer

The immediate next step after containment is to remove the attacker's persistence mechanisms. The malicious forwarding rule (which exfiltrates emails via SMTP) and the OAuth consent grant (which provides persistent API access) must be removed to fully eradicate the threat. Simply resetting the password and revoking sessions does not remove these backdoors, as OAuth grants persist independently of user credentials.

Exam trap

The trap here is that candidates assume a password reset and session revocation fully remediate the compromise, overlooking the fact that OAuth consent grants and mailbox forwarding rules are independent persistence mechanisms that must be explicitly removed.

How to eliminate wrong answers

Option A is wrong because notifying employees to be more careful is a general awareness step, not a technical eradication action, and it delays removing the attacker's active persistence mechanisms. Option B is wrong because deleting the mailbox and creating a new account is an overly destructive step that destroys forensic evidence and disrupts business operations; the correct approach is to surgically remove the malicious rules and grants while preserving the mailbox for investigation. Option D is wrong because restoring from backup and reopening access without reviewing or removing the forwarding rule and OAuth grant would re-introduce the same persistence mechanisms, leaving the compromise active.

Practice this question →

MCQmedium

Based on the exhibit, which change best helps the company meet its recovery objectives after a ransomware event?

A.Increase the retention period on the existing NAS backups to one year.

B.Move backups to an immutable, offline or logically isolated repository and test restores regularly.

C.Store the backup administrator password in a shared team spreadsheet so more staff can restore data quickly.

D.Replace the nightly full backup with a longer full backup window to capture more data each day.

AnswerB

An isolated, immutable backup target reduces the chance that ransomware can encrypt or delete backups. Regular restore testing confirms that the company can actually recover within the stated RTO and RPO. Because the current repository is domain-joined and reachable over SMB, it is too exposed. Isolation and tested recovery provide the strongest practical resilience improvement.

Why this answer

Ransomware often encrypts or deletes accessible backups. An immutable, offline, or logically isolated repository prevents attackers from modifying or deleting backup data, ensuring a clean recovery point. Regularly testing restores validates that the backups are functional and meet recovery objectives (RTO/RPO).

This aligns with the 3-2-1 backup rule and NIST SP 800-184 guidance for ransomware recovery.

Exam trap

The trap here is that candidates often assume longer retention or more frequent backups alone improve recovery, but they overlook the need for isolation and immutability to protect against ransomware's ability to target accessible backup data.

How to eliminate wrong answers

Option A is wrong because increasing the retention period on existing NAS backups does not protect them from being encrypted or deleted by ransomware if the NAS is network-accessible; retention alone does not provide immutability or isolation. Option C is wrong because storing the backup administrator password in a shared team spreadsheet violates the principle of least privilege and introduces a security risk; it does not improve recovery speed or integrity and could lead to unauthorized access or credential theft. Option D is wrong because replacing the nightly full backup with a longer full backup window does not inherently improve recovery objectives; it may increase the backup window and data captured but does not address ransomware resilience, and longer backups can increase exposure to corruption or encryption during the backup window.

Practice this question →

MCQhard

Based on the exhibit, what is the most likely conclusion after correlating the logs? A configuration-management task ran from a jump host and generated repeated login alerts on target servers. The SOC wants to determine whether this is malicious activity or approved automation.

A.This is a true brute-force attack because any failed login must be malicious.

B.This is a likely false positive caused by approved automation, so the alert should be correlated with the change window.

C.This indicates DNS poisoning because both servers were contacted from the same source IP.

D.This is proof of ransomware spreading laterally over SMB.

AnswerB

The alert lines up with an approved maintenance window, a known jump host, and a documented configuration-management account that should only be used by automation. The mixed failed-and-successful logins are consistent with scripts negotiating authentication rather than an intruder guessing passwords. The SOC should confirm the change record, document the benign cause, and adjust correlation rules if this pattern recurs.

Why this answer

The logs show repeated login attempts from a jump host, which is a common pattern for configuration-management tools (e.g., Ansible, Puppet) that execute tasks across multiple servers. The SOC should correlate these events with the approved change window to confirm they are part of legitimate automation, not malicious activity. Failed logins alone do not indicate a brute-force attack, as automation scripts may retry connections or use cached credentials that occasionally fail due to network latency or credential rotation.

Exam trap

The trap here is that candidates assume any failed login attempt is malicious, but the SY0-701 exam tests the ability to correlate logs with operational context (e.g., change windows, known source IPs) to identify false positives from legitimate automation.

How to eliminate wrong answers

Option A is wrong because it assumes any failed login is malicious, ignoring that automation tools often generate failed login events due to transient issues (e.g., credential caching, network timeouts) and that a true brute-force attack would show a high volume of rapid, sequential attempts from an external or unexpected source IP. Option C is wrong because DNS poisoning involves manipulating DNS responses to redirect traffic to malicious IPs, which is unrelated to repeated login alerts from a jump host; the same source IP contacting multiple servers is normal for centralized management. Option D is wrong because ransomware spreading laterally over SMB would show evidence of file writes, encryption activity, or SMB session enumeration (e.g., using tools like PsExec or EternalBlue), not simply repeated login alerts from a jump host.

Practice this question →

MCQhard

A security analyst is reviewing firewall logs and notices repeated connection attempts from a single external IP address to multiple internal IP addresses on TCP port 22 (SSH). Each attempt uses a different username but the same password: 'Spring2024!'. The attempts occur sporadically over a 12-hour period. Which type of attack is most likely being observed?

A.Brute-force attack

B.Dictionary attack

C.Password spraying attack

D.Man-in-the-middle attack

AnswerC

Correct. Password spraying involves an attacker trying a small number of commonly used passwords against many different accounts to avoid lockout and evade detection. The use of a single password against many usernames exactly matches this technique.

Why this answer

This is a password spraying attack because the attacker uses a single common password ('Spring2024!') against multiple usernames across different internal IP addresses, attempting to avoid account lockout by spreading attempts over time and targets. Unlike brute-force or dictionary attacks that focus many passwords against a single account, password spraying targets many accounts with a few weak passwords, making it harder to detect via failed login thresholds.

Exam trap

The trap here is that candidates confuse 'multiple passwords against one user' (brute-force/dictionary) with 'one password against multiple users' (password spraying), especially when the scenario mentions 'different username' and 'same password' — a classic sign of a spraying attack.

Why the other options are wrong

A brute-force attack typically involves trying many passwords for a single username, but here the same password is used across multiple usernames, which is characteristic of password spraying.

The attack uses the same password for multiple usernames, which is characteristic of password spraying, not dictionary attacks. A dictionary attack would involve trying many passwords against a single username, not a single password against many usernames.

A man-in-the-middle attack involves intercepting and potentially altering communications between two parties, not repeated login attempts from a single external IP to multiple internal IPs. The observed pattern of systematic password guessing across many accounts does not fit MITM.

Practice this question →

MCQhard

Based on the exhibit, what is the best immediate action for the SOC or IR team? A finance workstation shows evidence of a macro-launched script, followed by file renaming and lateral SMB traffic to two other hosts. The team has not yet determined the full scope of the incident.

A.Isolate the host from the network and revoke its remote access to stop further spread.

B.Restore the workstation from backup immediately before preserving any evidence.

C.Run a vulnerability scan against the subnet to see whether the malware exploited an unpatched service.

D.Notify users to ignore the issue until the next maintenance window because the incident is likely self-limiting.

AnswerA

Isolate the host from the network and revoke its remote access to stop further spread. This is the immediate containment step in incident response. By severing the network connection, you halt active SMB propagation to neighboring systems, and revoking remote access eliminates the attacker's control channel. Containment takes priority over analysis while the compromise is actively encrypting files and moving laterally.

Why this answer

The exhibit shows a macro-launched script, file renaming, and lateral SMB traffic to two other hosts, indicating active lateral movement. Isolating the host (e.g., via network access control or disabling the switch port) immediately stops the spread of the malware to other systems, preserving the ability to investigate without further compromise. This aligns with the first step in incident response: containment before eradication or recovery.

Exam trap

The trap here is that candidates may choose Option C (vulnerability scan) because they think identifying the root cause is the priority, but in an active incident with lateral movement, containment (isolation) must come first per the NIST SP 800-61 incident response framework.

How to eliminate wrong answers

Option B is wrong because restoring from backup before preserving evidence destroys volatile data and artifacts (e.g., memory, logs, renamed files) that are critical for forensic analysis and understanding the attack vector. Option C is wrong because running a vulnerability scan is a slow, passive step that does not address the immediate active threat of lateral movement; it also risks alerting the attacker or consuming network resources during an active incident. Option D is wrong because the incident is not self-limiting—macro-launched scripts and SMB lateral movement indicate an active, potentially spreading threat that requires immediate action, not deferral to a maintenance window.

Practice this question →

MCQmedium

A SOC analyst is reviewing logs from a Windows domain controller and notices a large number of failed logon attempts (Event ID 4625) from a single source IP address within a five-minute window. The account names used are random strings such as "a1b2c3", "x9y8z7", etc. The analyst then checks the source IP and finds it is a known external address from a foreign country. Which of the following is the most appropriate next step for the analyst to take?

A.Immediately block the IP address at the perimeter firewall.

B.Investigate whether any of the attempted accounts correspond to actual domain users.

C.Run a full antivirus scan on the domain controller.

D.Notify the company's legal department for law enforcement involvement.

AnswerB

This is the correct first step. If any of the random account names match legitimate domain accounts, it indicates a targeted attack and possible credential compromise. Even if no failures are logged, a successful authentication might have been recorded separately. This investigation guides subsequent containment and remediation.

Why this answer

The analyst must first determine if any of the randomly generated account names match existing domain user accounts. If a match is found, it indicates a targeted password-spraying or brute-force attack against valid accounts, requiring immediate account lockdown and credential reset. This investigation step aligns with the incident response process of identification before containment or escalation.

Exam trap

The trap here is that candidates may jump to immediate blocking (Option A) as a reflexive security action, but the SY0-701 emphasizes following the incident response process—identify and analyze before containing.

Why the other options are wrong

Blocking the IP immediately is premature without confirming the threat; the failed logins use random account names, suggesting a password spray or reconnaissance, but legitimate users might be affected if the IP is shared or spoofed.

Notifying legal/law enforcement is premature at this stage; the analyst first needs to determine if the failed logons pose an actual threat (e.g., successful brute force or valid account compromise) before escalating.

Practice this question →

MCQmedium

You are handed a company laptop suspected in an insider theft case. Legal says the evidence may be needed in court. Which action best preserves admissibility?

A.Browse the drive directly on the original laptop to identify the most relevant files.

B.Create a forensic image using a write blocker and record hash values.

C.Email the user asking them to return any copies they may have made.

D.Mount the drive read-write so searching and exporting data will be faster.

AnswerB

A forensic image taken through a write blocker is the best choice because it preserves the original media and reduces the chance of accidental modification. Recording cryptographic hash values before and after acquisition helps prove integrity and supports chain of custody. That combination is standard practice when evidence might be examined in a disciplinary, regulatory, or legal setting.

Why this answer

Creating a forensic image with a write blocker ensures the original evidence remains unaltered, preserving its integrity for court admissibility. Recording hash values (e.g., SHA-256) provides a cryptographic fingerprint that can later verify the image is an exact copy, meeting legal standards for chain of custody and authenticity.

Exam trap

The trap here is that candidates may think direct browsing or read-write mounting is faster and acceptable, but they fail to recognize that any write access—even unintentional—breaks forensic integrity and admissibility in legal proceedings.

How to eliminate wrong answers

Option A is wrong because directly browsing the drive on the original laptop modifies file metadata (e.g., last access time) and risks accidental alteration, which can break the chain of custody and render evidence inadmissible. Option C is wrong because emailing the user does not preserve evidence; it may alert the suspect, leading to data destruction, and provides no forensic integrity or verifiable chain of custody. Option D is wrong because mounting the drive read-write allows write operations that alter the original data, destroying its forensic integrity and making it inadmissible in court.

Practice this question →

MCQmedium

After seizing a suspect's laptop, a responder creates a bit-for-bit disk image using a write blocker. The legal team wants the next step that most directly supports evidence integrity for later review. What should the responder do?

A.Open the image file and browse folders to confirm the contents look normal.

B.Compute and document cryptographic hash values for the source and the image.

C.Rename the image file with the case number and store it on a desktop.

D.Run a full antivirus scan on the image before logging it in.

AnswerB

The responder should hash the original source device (ideally via a write-blocked interface) and then hash the freshly created image file using a strong algorithm such as SHA-256. If the two digests match, the evidence is mathematically proven to be a bit-for-bit copy, and any future alteration can be detected by re-hashing the image and comparing to the documented value. Recording the algorithm, hash, and timestamp in the chain-of-custody gives investigators and courts an independent, verifiable method to confirm the image's integrity at any later point.

Why this answer

Computing and documenting cryptographic hash values (e.g., SHA-256 or MD5) for both the source drive and the bit-for-bit image creates a digital fingerprint. If the hashes match, it proves the image is an exact, unaltered copy of the original evidence, directly supporting integrity for later review. This step is foundational in forensic acquisition to meet legal standards for admissibility.

Exam trap

The trap here is that candidates may think browsing the image is harmless or that antivirus scans are always safe, but the exam tests the strict forensic requirement to never modify original evidence and to use hashing as the sole direct integrity check.

How to eliminate wrong answers

Option A is wrong because opening the image file to browse folders modifies metadata (e.g., last accessed timestamps) and risks altering the evidence, violating forensic best practices. Option C is wrong because renaming the file and storing it on a desktop does not provide any integrity verification; it only aids organization and may expose the image to accidental modification. Option D is wrong because running an antivirus scan on the image can modify the image file (e.g., by quarantining or deleting detected files), breaking the bit-for-bit integrity, and should only be done on a copy, not the original image.

Practice this question →

Multi-Selecthard

A virtual file server was restored from last night’s backup. The service is online, but some finance users report missing spreadsheet changes and a few files show a 'recovered copy' timestamp. Which two checks should be completed before the team accepts the restore as successful? Select two.

Select 2 answers

A.Compare restored data against backup hashes or a manifest to verify that the copy is complete and uncorrupted.

B.Run an application-level validation test with finance users or sample transactions to confirm the data is usable.

C.Assume the restore is acceptable because the file server is online and users can browse shares.

D.Delete the previous night’s backup so the team will not accidentally restore it again.

E.Expose the restored server directly to the internet so remote users can test it faster.

AnswersA, B

Hash or manifest comparison confirms that the restored files match what was backed up and were not corrupted during storage or recovery. This is a direct integrity check and is more reliable than simply seeing that the server starts. It helps identify silent partial restores.

Why this answer

Comparing restored data against backup hashes or a manifest ensures the data integrity and completeness of the restore process. Even though the file server is online, missing spreadsheet changes and 'recovered copy' timestamps suggest possible corruption or incomplete restoration. Verifying hashes (e.g., SHA-256) against a known-good manifest confirms that every file was restored without bit-rot or truncation, which is a standard post-restore validation step in backup and recovery procedures.

Exam trap

The trap here is that candidates may assume a service being online and shares browsable is sufficient proof of a successful restore, ignoring the need for data integrity verification and application-level validation.

Practice this question →

MCQmedium

After a new MFA policy rollout, the SIEM generates an alert for five failed logins to a SaaS admin portal from one IP, followed by a successful login to the same account from an IP in another country. The account owner says they were in meetings all day. What should the analyst do first?

A.Disable the account immediately without checking any other logs.

B.Correlate identity provider, VPN, and endpoint logs to validate whether the activity matches the user's normal pattern.

C.Delete the alert because MFA was enabled and the login eventually succeeded.

D.Reimage the user's laptop to remove any possible malware right away.

AnswerB

This is the best first step because triage should validate the alert and establish context before disruptive containment. Correlating identity provider, VPN, and endpoint telemetry can show whether the login came from an expected corporate path, a known remote-access method, or a likely compromise. The analyst can then decide whether account disablement, password resets, or escalation is warranted based on evidence rather than a single suspicious event.

Why this answer

The alert shows a successful login after five failures from a different country, which is a classic indicator of a potential account takeover. The analyst must correlate identity provider logs (e.g., Okta, Azure AD) for authentication details, VPN logs for network origination, and endpoint logs for device posture to determine if the successful login matches the user's normal behavior. This step validates whether the activity is legitimate or malicious before taking any irreversible action.

Exam trap

The trap here is that candidates assume MFA is infallible and ignore the geographic anomaly, leading them to delete the alert (Option C) or take premature action (Option A or D) without performing proper log correlation.

How to eliminate wrong answers

Option A is wrong because disabling the account immediately without checking other logs could disrupt legitimate access and ignores the possibility of a false positive or a misconfigured MFA policy. Option C is wrong because deleting the alert simply because MFA was enabled and the login succeeded overlooks the fact that MFA can be bypassed (e.g., via session hijacking, token replay, or social engineering), and the geographic anomaly warrants investigation. Option D is wrong because reimaging the laptop is a drastic, premature step that assumes compromise without evidence; the analyst must first confirm whether the successful login originated from the user's device or an attacker's system.

Practice this question →