CCNA Security Operations Questions — Page 2 of 4

MCQmedium

After a new MFA policy rollout, the SIEM generates an alert for five failed logins to a SaaS admin portal from one IP, followed by a successful login to the same account from an IP in another country. The account owner says they were in meetings all day. What should the analyst do first?

A.Disable the account immediately without checking any other logs.

B.Correlate identity provider, VPN, and endpoint logs to validate whether the activity matches the user's normal pattern.

C.Delete the alert because MFA was enabled and the login eventually succeeded.

D.Reimage the user's laptop to remove any possible malware right away.

AnswerB

This is the best first step because triage should validate the alert and establish context before disruptive containment. Correlating identity provider, VPN, and endpoint telemetry can show whether the login came from an expected corporate path, a known remote-access method, or a likely compromise. The analyst can then decide whether account disablement, password resets, or escalation is warranted based on evidence rather than a single suspicious event.

Why this answer

The alert shows a successful login after five failures from a different country, which is a classic indicator of a potential account takeover. The analyst must correlate identity provider logs (e.g., Okta, Azure AD) for authentication details, VPN logs for network origination, and endpoint logs for device posture to determine if the successful login matches the user's normal behavior. This step validates whether the activity is legitimate or malicious before taking any irreversible action.

Exam trap

The trap here is that candidates assume MFA is infallible and ignore the geographic anomaly, leading them to delete the alert (Option C) or take premature action (Option A or D) without performing proper log correlation.

How to eliminate wrong answers

Option A is wrong because disabling the account immediately without checking other logs could disrupt legitimate access and ignores the possibility of a false positive or a misconfigured MFA policy. Option C is wrong because deleting the alert simply because MFA was enabled and the login succeeded overlooks the fact that MFA can be bypassed (e.g., via session hijacking, token replay, or social engineering), and the geographic anomaly warrants investigation. Option D is wrong because reimaging the laptop is a drastic, premature step that assumes compromise without evidence; the analyst must first confirm whether the successful login originated from the user's device or an attacker's system.

Practice this question →

MCQmedium

A security analyst is reviewing authentication logs from a corporate web application. The logs show that over a span of two hours, a single external IP address attempted to log in with 500 different usernames, each using the same password 'Spring2024!'. Only a few of these attempts succeeded. Which type of attack is most likely being observed?

A.Brute force attack

B.Password spraying attack

C.Credential stuffing attack

D.Dictionary attack

AnswerB

Password spraying tries one common password against many different usernames to avoid lockout thresholds, matching the 500 usernames each using 'Spring2024!'. Brute force would instead vary passwords against a single account, so the many-usernames pattern identifies spraying.

Why this answer

This is a password spraying attack because the attacker uses a single common password ('Spring2024!') against many different usernames. This technique avoids account lockout policies that typically trigger after multiple failed attempts on a single account, and the few successful logins indicate valid credentials were found.

Exam trap

The trap here is confusing password spraying with brute force: candidates see 'same password' and think brute force, but the key distinction is the attacker targets many usernames with one password, not one username with many passwords.

Why the other options are wrong

A brute force attack typically tries many passwords against a single username, but here one password is tried against many usernames, which is characteristic of password spraying.

Credential stuffing uses previously leaked username/password pairs, not a single password across many usernames. The attack here uses the same password for all attempts, which is characteristic of password spraying.

A dictionary attack typically uses a list of common passwords against a single username, but here the attacker used one password against many usernames, which is characteristic of password spraying.

Practice this question →

MCQmedium

A firewall rule change was implemented directly in production to allow a new vendor IP range. Within minutes, several internal services became unreachable because the rule order changed unexpectedly. Which change-management practice would have most likely prevented this outage?

A.Testing the change in a staging environment and approving it through a peer-reviewed change process before production.

B.Applying the rule during business hours so the team can respond faster if something breaks.

C.Making the change first in production because that is the only environment that matters.

D.Documenting the outage after the vendor confirms their IP range is valid.

AnswerA

A tested, peer-reviewed change process helps catch rule-order problems, dependency issues, and unintended access impacts before production is affected. Firewall changes can alter traffic flow in subtle ways, so validating them in a nonproduction environment and having a formal approval path reduces the chance of service disruption. A backout plan also gives the team a quick recovery path if the production change behaves differently than expected.

Why this answer

Implementing the change in a staging environment first allows validation of the rule order and its impact on traffic flow without affecting production. A peer-reviewed change process ensures that the rule insertion point (e.g., before a deny-all or after a permit statement) is verified, preventing the accidental reordering that caused the outage. This aligns with the change-management principle of testing in a representative environment before production deployment.

Exam trap

The trap here is that candidates may confuse 'change management' with 'incident response' or 'documentation,' leading them to choose options that address symptoms (e.g., faster response or post-hoc documentation) rather than the root cause of unvalidated rule order changes.

How to eliminate wrong answers

Option B is wrong because applying the rule during business hours does not address the root cause—unexpected rule reordering—and may increase risk if the change breaks services during peak usage. Option C is wrong because making the change directly in production bypasses all validation and review, which is precisely the practice that led to the outage. Option D is wrong because documenting the outage after the fact does nothing to prevent it; proactive change management requires testing and approval before implementation.

Practice this question →

MCQmedium

A branch office's network closet has repeated unauthorized access issues after staff badge in and hold the door for others. Management wants a control that allows one person through after valid badge use and helps prevent tailgating. Which control is best?

A.Closed-circuit television cameras, because they record the doorway for later review.

B.A mantrap, because it physically restricts entry to one person at a time.

C.A motion sensor, because it can detect movement inside the room.

D.A door closer, because it ensures the door automatically shuts after use.

AnswerB

A mantrap is a physical access control system consisting of a small vestibule with two interlocking doors, where only one door can open at a time. After the first door closes and locks, the individual must present valid credentials (e.g., badge or biometric) inside the booth before the second door releases, ensuring that only one authorized person passes through per cycle. This design inherently prevents tailgating by making it impossible for a second person to slip in with the first, directly addressing the repeated unauthorized access.

Why this answer

A mantrap is a physical security control consisting of a small space with two interlocking doors, typically requiring authentication to enter and exit. It ensures that only one person can pass through at a time, effectively preventing tailgating by trapping unauthorized individuals between the doors if they attempt to follow an authorized user.

Exam trap

The SY0-701 exam often tests the distinction between preventive and detective controls, leading candidates to choose CCTV because it is a common security measure, even though it does not actively prevent tailgating.

How to eliminate wrong answers

Option A is wrong because closed-circuit television cameras are a detective control, not a preventive one; they record incidents for later review but do not physically stop tailgating in real time. Option C is wrong because a motion sensor detects movement inside the room but does not control entry or prevent multiple people from passing through a door simultaneously.

Practice this question →

MCQeasy

An EDR alert shows a user workstation launching an unfamiliar executable from the Downloads folder and then making repeated outbound connections to an IP address in another country. What is the best first response by the security team?

A.Wait for more alerts before taking any action to avoid disrupting the user

B.Isolate the workstation from the network and begin incident triage

C.Immediately reinstall the operating system without collecting evidence

D.Disable the user's account in the directory service and close the ticket

AnswerB

Network isolation is the correct first response because it immediately severs the attacker's ability to maintain command-and-control or reach other hosts, containing the blast radius. Unlike destructive actions, isolation preserves volatile evidence (memory, running processes) and non-volatile artifacts for proper forensic triage. This action aligns with NIST SP 800-61 containment strategies and gives the incident response team a controlled environment to investigate without the threat continuing to propagate.

Why this answer

Isolating the workstation from the network immediately stops the potential command-and-control (C2) communication and prevents lateral movement, which is the priority first response in incident triage. The EDR alert indicates a suspicious executable from the Downloads folder making repeated outbound connections to a foreign IP, which strongly suggests malware or a trojan. Isolating the host preserves volatile evidence (e.g., memory, network connections) for forensic analysis while containing the threat.

Exam trap

The trap here is that candidates may confuse incident response phases (e.g., jumping to eradication or recovery before containment) or think that disabling the user account is sufficient, when in fact the running process must be contained first to stop active network communication.

How to eliminate wrong answers

Option A is wrong because waiting for more alerts allows the malware to continue exfiltrating data or spreading to other systems, violating the containment-first principle of incident response. Option C is wrong because immediately reinstalling the OS destroys all volatile evidence (e.g., memory, running processes, network artifacts) needed for root cause analysis and attribution, and may miss persistence mechanisms. Option D is wrong because disabling the user account does not stop the already-running malicious process from making outbound connections or executing further payloads; the host must be contained first.

Practice this question →

MCQmedium

A finance laptop is powered on, the user is still logged in, and it remains connected to Wi-Fi after a malware alert. What should the responder do first to preserve volatile evidence?

A.Power the laptop off immediately to stop any further attacker activity.

B.Collect volatile data such as memory, running processes, and active network connections.

C.Run a full antimalware scan before touching any other data.

D.Disconnect the power cable and remove the battery to prevent changes.

AnswerB

Volatile evidence is the first thing to lose when a machine shuts down or is rebooted, so collecting it immediately is the best move. Memory, process lists, open sockets, and logged-in sessions can reveal malware injection, command-and-control activity, or stolen credentials in use. Preserving that state before containment actions or shutdown gives investigators a better picture of what happened on the system.

Why this answer

The laptop is powered on, the user is logged in, and it is connected to the network, meaning volatile data (memory contents, running processes, active network connections) is at immediate risk of being lost if the system is shut down or tampered with. The responder must collect this data first to preserve evidence of the malware's current state, including any malicious processes, network connections, and in-memory artifacts that would disappear on power loss.

Exam trap

The trap here is that candidates mistakenly believe immediate shutdown (Option A) stops attacker activity, but in forensic practice, preserving volatile evidence by capturing memory and network state is always the priority before any power-down action.

How to eliminate wrong answers

Option A is wrong because powering off the laptop immediately destroys all volatile data (RAM, process lists, network connection states) and may trigger anti-forensic mechanisms in malware that wipe traces on shutdown; the correct first step is to capture volatile data before any power state change. Option C is wrong because running a full antimalware scan modifies the system state (reads files, creates logs, may quarantine or delete files) and overwrites or destroys volatile evidence in memory and active connections, violating forensic preservation principles.

Practice this question →

MCQhard

Based on the exhibit, what is the best eradication decision for the server compromise?

A.Restart sshd and monitor the system for another login attempt.

B.Manually delete the cron entry and reverse the SSH change on the live server.

C.Rebuild the server from a trusted image and restore only known-good data after evidence is preserved.

D.Increase the SIEM retention period and keep the current server online.

AnswerC

The server shows multiple signs of compromise: unauthorized key-based access, script download, cron persistence, and SSH configuration tampering. Those indicators make simple cleanup too risky. A rebuild from a trusted image is the most reliable eradication step, especially once the host is isolated. Evidence should be preserved first, then the service should be restored from validated data and a hardened baseline.

Why this answer

A server compromise implies that the attacker may have achieved persistence through modified binaries, kernel modules, or rootkits that cannot be reliably removed by simple remediation steps. Rebuilding from a trusted image ensures that all malicious artifacts are eliminated, and restoring only known-good data from backups (after forensic preservation) prevents reintroduction of compromised files. This aligns with the CompTIA incident response process, where eradication must remove all traces of the threat, and rebuilding is the safest approach for a confirmed compromise.

Exam trap

The trap here is that candidates may think manual remediation (Option B) is sufficient because they underestimate the attacker's ability to hide persistence mechanisms, or they confuse containment (e.g., isolating the server) with eradication (completely removing the threat).

How to eliminate wrong answers

Option A is wrong because restarting sshd does not remove the attacker's persistence mechanism (e.g., modified SSH configuration or cron job) and only temporarily disrupts access; the attacker could simply log in again. Option B is wrong because manually deleting a cron entry and reversing an SSH change on a live server is unreliable—the attacker may have installed a rootkit, backdoor, or modified system binaries that cannot be fully reversed, leaving the system still compromised. Option D is wrong because increasing SIEM retention does not address the existing compromise; keeping the compromised server online continues to expose the network to data exfiltration or lateral movement.

Practice this question →

MCQeasy

A branch office loses power briefly several times each month. Which control best helps keep network equipment running long enough for an orderly shutdown?

A.A UPS

B.A badge reader

C.A locked filing cabinet

D.A fire extinguisher

AnswerA

A UPS supplies battery-backed power, letting switches and routers ride through brief outages and trigger an orderly shutdown. This directly addresses the branch's repeated short power losses, which a surge protector or generator start-up delay cannot bridge.

Why this answer

A UPS (Uninterruptible Power Supply) provides battery backup power to network equipment during a power outage, allowing enough time for an orderly shutdown to prevent data corruption or hardware damage. Unlike surge protectors, a UPS actively supplies clean, regulated power from its batteries when the mains fail, making it the correct control for this scenario.

Exam trap

The trap here is that candidates might confuse a UPS with a surge protector or power strip, thinking any power-related device provides backup runtime, whereas only a UPS contains batteries to sustain power after an outage.

How to eliminate wrong answers

Option B is wrong because a badge reader is an access control mechanism used to restrict physical entry to a facility or room, not a device that provides backup power. Option C is wrong because a locked filing cabinet is a physical security control for protecting sensitive documents, not for maintaining power to network equipment during an outage.

Practice this question →

MCQmedium

A SOC analyst reviews email platform logs for a finance user account. At 08:12, the user successfully signs in from Denver. At 08:15, the same account signs in from a residential ISP in another state. At 08:16, the mailbox creates a new external forwarding rule and deletes the original alert message. The user says they did not set up forwarding. What is the best assessment?

A.False positive caused by normal mailbox synchronization behavior across devices.

B.True positive indicating likely account compromise and unauthorized mailbox abuse.

C.Benign activity because the user successfully authenticated with valid credentials and no malware was detected.

D.A denial-of-service event because the attacker is attempting to overwhelm the mail system.

AnswerB

The sequence of impossible travel, an unexpected sign-in source, and creation of an external forwarding rule strongly indicates unauthorized access. Deleting the alert email suggests the attacker is trying to hide evidence. The most likely conclusion is that the account is compromised and requires immediate response actions.

Why this answer

The rapid succession of logins from geographically distant locations (Denver and a different state via a residential ISP) within three minutes, followed immediately by creation of an external forwarding rule and deletion of the original alert message, is a classic indicator of account takeover. The user's denial of setting up forwarding confirms the activity is unauthorized. This pattern aligns with attacker behavior: after compromising credentials, they establish persistence (forwarding) and cover tracks (deleting alerts).

Exam trap

The trap here is that candidates mistakenly equate valid authentication with legitimate activity, ignoring the strong circumstantial evidence of impossible travel and unauthorized rule creation that clearly indicates compromise.

How to eliminate wrong answers

Option A is wrong because normal mailbox synchronization across devices would not create an external forwarding rule or delete an alert message; synchronization only replicates existing folder/item changes, not administrative rule creation. Option C is wrong because successful authentication with valid credentials does not rule out compromise—attackers often use stolen or phished credentials, and the subsequent anomalous actions (geographic impossibility, rule creation) override any assumption of benign activity. Option D is wrong because a denial-of-service event would involve overwhelming the mail system with traffic, not a single account's specific configuration changes and message deletion.

Practice this question →

MCQmedium

A SOC analyst receives an alert from the EDR system indicating that the process 'C:\Program Files\Vendor\Updater.exe' attempted to modify the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key on a user's workstation. The analyst checks the file hash and finds it matches a known legitimate software updater. Which of the following actions is most appropriate for the analyst to take?

A.Disable the software updater immediately to prevent further registry modifications.

B.Create an exception rule in the EDR to suppress future alerts for this process.

C.Investigate the user's recent activity and check for signs of process hollowing or DLL injection.

D.Isolate the workstation from the network and reimage the system immediately.

AnswerC

This is the correct next step. The analyst should examine the process's behavior in depth, including checking for anomalies such as unexpected command-line arguments, suspicious parent processes, or indicators of code injection, before concluding whether the alert is a false positive.

Why this answer

The EDR alert indicates a legitimate process (Updater.exe) modifying a critical persistence registry key (Run). Even with a known good hash, the process could be compromised via process hollowing or DLL injection, where malicious code runs under the guise of a trusted executable. Investigating user activity and checking for these attack techniques is the appropriate next step to confirm whether the behavior is benign or indicative of a threat.

Exam trap

The trap here is that candidates assume a matching file hash guarantees the process is safe, overlooking that attackers can subvert a legitimate process at runtime through memory-based attacks that do not alter the file on disk.

Why the other options are wrong

The file hash matches a known legitimate updater, so disabling it without further investigation could disrupt necessary updates and is not justified by the alert alone.

Isolating and reimaging is too drastic given that the file hash matches a known legitimate updater; the alert is likely a false positive or indicates a sophisticated attack like process hollowing, which requires investigation first.

Practice this question →

MCQeasy

A laptop is suspected of being used in a malware incident. It is still powered on and connected to Wi-Fi. What should the responder do before shutting it down?

A.Install endpoint protection updates on the laptop right away.

B.Capture volatile evidence such as running processes and memory contents.

C.Delete suspicious files so the malware can no longer spread.

D.Reboot the laptop immediately to clear the suspected malware.

AnswerB

This is the best action because volatile data can disappear when the system is powered off or rebooted. Running processes, network connections, logged-on users, and memory contents may contain the strongest clues about active malware and attacker activity. Preserving this information first supports later investigation and helps responders understand what happened before they take more disruptive containment steps.

Why this answer

Volatile evidence, such as running processes, network connections, and memory contents, is lost when the system is powered off. Capturing this data first preserves critical forensic artifacts that can reveal the malware's behavior, persistence mechanisms, and indicators of compromise (IOCs). In a live incident, the responder must follow the order of volatility (RFC 3227) to collect the most ephemeral data before it disappears.

Exam trap

The trap here is that candidates mistakenly think immediate containment (e.g., deleting files or rebooting) is the priority, but the SY0-701 exam emphasizes preserving volatile evidence first to support forensic analysis and legal proceedings.

How to eliminate wrong answers

Option A is wrong because installing endpoint protection updates could alter the system state, overwrite evidence, or trigger anti-forensic behavior by the malware. Option C is wrong because deleting suspicious files destroys evidence and may not stop the malware, which could be running in memory or have persistence mechanisms. Option D is wrong because rebooting clears volatile memory (RAM), losing critical evidence like running processes, network connections, and injected code, and may allow malware to evade detection.

Practice this question →

MCQmedium

A scan keeps reporting the same medium-severity TLS configuration issue on a public web server. The application owner says the vendor software cannot be changed until next quarter, but they can place the service behind a reverse proxy that enforces stronger cipher settings. How should the issue be handled in the vulnerability management process?

A.Close the finding as fixed because the reverse proxy reduces the risk

B.Record an exception, document the compensating control, and set a review or remediation date

C.Mark the finding as a false positive and remove it from future scans

D.Ignore the finding until the vendor releases a new version

AnswerB

Recording an exception is the correct approach because the vulnerability is genuine but the organization is choosing to accept the residual risk in exchange for a documented compensating control (the reverse proxy). This formal risk acceptance process ensures that the finding remains visible, involves the appropriate decision-makers, and assigns a review or remediation date so the risk is revisited rather than forgotten. It also provides an audit trail that clearly distinguishes between a false positive and a deliberate, managed risk acceptance, which is essential for compliance frameworks like PCI DSS or NIST.

Why this answer

The vulnerability management process requires that when a vulnerability cannot be immediately remediated, compensating controls must be formally documented as an exception with a scheduled remediation date. In this scenario, the reverse proxy enforces stronger cipher settings, effectively mitigating the TLS misconfiguration at the network edge, which is a valid compensating control. Recording the exception ensures auditability and prevents the finding from being prematurely closed while the vendor software remains vulnerable.

Exam trap

The trap here is that candidates assume a compensating control automatically closes the finding, when in fact vulnerability management requires an exception process with documentation and a future remediation date to ensure the root cause is eventually addressed.

How to eliminate wrong answers

Option A is wrong because simply placing a reverse proxy does not fix the underlying TLS configuration on the origin server; the finding should not be closed as 'fixed' since the vulnerability still exists on the server itself. Option C is wrong because the TLS configuration issue is a real vulnerability, not a false positive, and removing it from scans would bypass proper risk tracking and violate vulnerability management best practices.

Practice this question →

MCQeasy

A SOC analyst sees 38 failed logins for a finance user account from one public IP address over 4 minutes, followed by one successful login. What should the analyst do first?

A.Immediately delete the account to stop any further access attempts.

B.Correlate the authentication logs with user activity and VPN records to verify whether the login pattern is expected.

C.Assume the account is compromised and notify all users to change their passwords.

D.Close the alert because one successful login means the activity was normal.

AnswerB

Correlating related logs is the best first step because it helps determine whether the event is a real attack or an expected user behavior pattern. Authentication logs, VPN records, and account activity can show whether the source IP, timing, and device match a legitimate session. Good triage focuses on confirmation before disruptive response actions.

Why this answer

The analyst must first verify whether the failed logins followed by a successful login represent a brute-force attack or legitimate behavior, such as a user mistyping their password and then succeeding. Correlating authentication logs with user activity and VPN records helps confirm if the public IP belongs to a known remote user or VPN endpoint, which is a standard first step in incident response to avoid false positives.

Exam trap

The trap here is that candidates assume a successful login after many failures always indicates compromise, but the question tests the critical first step of verification through log correlation before taking any action.

How to eliminate wrong answers

Option A is wrong because immediately deleting the account disrupts business operations and destroys forensic evidence; account deletion should only occur after thorough investigation and confirmation of compromise. Option C is wrong because assuming compromise without verification leads to unnecessary panic and password fatigue; the analyst must first correlate logs to determine if the activity is expected before initiating a password reset. Option D is wrong because one successful login after many failures does not indicate normal activity—it could indicate a successful brute-force attack, and closing the alert without investigation violates security operations procedures.

Practice this question →

Multi-Selecthard

A SIEM analyst reviews the following sequence from a VPN and email platform over 15 minutes: 47 failed logins against different accounts from one public IP, one successful VPN login from that same IP, a new inbox forwarding rule to an external address, and a mailbox sign-in from a device never seen before. Which three findings most strongly support a password-spraying-to-compromise scenario? Select three.

Select 3 answers

A.Many failed logins across different usernames from the same source IP in a short time window.

B.A successful VPN login from the same source IP after the burst of failures.

C.An inbox forwarding rule sending messages to an external address.

D.A workstation patch installation completed earlier that day.

E.The mailbox server reported normal disk utilization during the same hour.

AnswersA, B, C

This pattern is the hallmark of password spraying, where an attacker tests a small set of common passwords against a large number of accounts to evade account lockout thresholds. The single source IP indicates a coordinated scripted attempt, and the short time window suggests automation. In the MITRE ATT&CK framework, this maps to T1110.003 (Password Spraying) under Initial Access.

Why this answer

A high volume of failed logins against multiple accounts from a single public IP within a short time window is the hallmark of a password-spraying attack, where the attacker tries a few common passwords across many usernames to avoid account lockout. This pattern is distinct from a brute-force attack, which targets a single account with many passwords.

Exam trap

The trap here is that candidates may think a single successful login or a forwarding rule alone is suspicious, but the question asks for findings that most strongly support the password-spraying-to-compromise scenario, which requires the combination of the spray pattern, the successful login from the same source, and the post-compromise persistence action.

Practice this question →

MCQmedium

A security analyst notices repeated attempts to copy large amounts of data to USB drives from a user's workstation. The analyst suspects the user may be exfiltrating company proprietary data. The company wants to implement a technical control that can both detect and block such data exfiltration without completely disabling all USB ports, as some users require USB for authorized work. Which of the following would best meet this requirement?

A.Implement a host-based intrusion detection system (HIDS) that alerts on USB insertion events.

B.Deploy a data loss prevention (DLP) agent configured with rules to monitor and block unauthorized data transfers to removable media.

C.Enable BitLocker encryption on all USB drives to prevent unauthorized data access.

D.Configure the local group policy to disable all USB ports on all workstations.

AnswerB

A DLP agent can inspect data in real time, apply policies to classify sensitive content, and block transfers that violate company rules. This meets the need to both detect and block exfiltration while still permitting authorized USB use.

Why this answer

A Data Loss Prevention (DLP) agent can be configured with granular rules to monitor and block unauthorized data transfers to removable media (e.g., USB drives) based on content inspection, file type, or volume thresholds. This allows authorized USB usage while preventing exfiltration of proprietary data, meeting the requirement for both detection and blocking without disabling all USB ports.

Exam trap

The trap here is that candidates often confuse detection-only controls (like HIDS alerts) with prevention controls, or they assume encryption (BitLocker) can stop data exfiltration, when in fact encryption only protects data at rest and does not prevent copying from the host.

Why the other options are wrong

A HIDS alerts on USB insertion but does not block data transfers; it only detects, not prevents, exfiltration.

BitLocker encryption protects data at rest by encrypting the USB drive, but it does not monitor or block the act of copying data to the drive. It cannot detect or prevent exfiltration because the user can still copy data to an encrypted drive.

Disabling all USB ports prevents all USB use, including authorized work, which contradicts the requirement to allow some users to use USB for legitimate purposes.

Practice this question →

MCQmedium

A data center has repeated tailgating incidents at the entry to the server room. Management wants a control that forces one person to pass after badge authentication and prevents two people from entering together. What should be installed?

A.A mantrap between the outer door and the server room entrance

B.A CCTV camera focused on the doorway

C.A motion sensor inside the server room

D.A standard badge reader with no additional controls

AnswerA

A mantrap is a small interlocking vestibule with two doors; the outer door must close and lock before the inner door opens, allowing only one authenticated person to be inside at a time. It may also use weight sensors or volumetric detection to deny entry if more than one person is present. This physically enforces single-person entry, making tailgating impossible without forced entry.

Why this answer

A mantrap is a physical security control with two interlocking doors that enforces one-person entry. After badge authentication at the outer door, the inner door will not unlock until the outer door closes and locks, preventing two people from entering together. This directly addresses tailgating by creating a small vestibule that can only hold one authenticated person at a time.

Exam trap

The SY0-701 exam often tests the distinction between passive monitoring (CCTV) and active prevention (mantrap), leading candidates to mistakenly choose CCTV because they think recording alone will deter tailgating.

How to eliminate wrong answers

Option B is wrong because a CCTV camera only provides passive monitoring and does not physically prevent two people from entering together; it records incidents but does not enforce access control. Option C is wrong because a motion sensor inside the server room detects movement after entry but cannot stop tailgating at the door; it might even trigger false alarms from authorized occupants. Option D is wrong because a standard badge reader with no additional controls allows anyone to follow an authenticated user through the door without any physical barrier or detection mechanism to prevent tailgating.

Practice this question →

MCQeasy

A SOC analyst wants to make sure logs from multiple servers can be compared accurately during an incident review. What should be configured on those systems?

A.A local administrator account with the same password on every server

B.Time synchronization using the same trusted time source

C.A larger disk size on the log server

D.A separate VLAN for each application server

AnswerB

Time synchronization via a common trusted time source (such as an internal NTP server or a public stratum-1 source) ensures all servers generate logs with consistent timestamps. Without this alignment, event sequences from different systems appear skewed by the clock offset, making it impossible to reconstruct a true attack timeline. NTP (Network Time Protocol) with authentication (e.g., NTPv4 with symmetric keys or MS-SNTP) prevents an attacker from spoofing time updates, which is critical for forensic accuracy and log integrity.

Why this answer

Time synchronization using a trusted time source (e.g., NTP) ensures that all servers share the same clock. During incident review, accurate log correlation depends on timestamps being consistent across systems; even a few seconds of drift can misalign event sequences. Without synchronized time, comparing logs from multiple servers becomes unreliable, potentially obscuring the true timeline of an attack.

Exam trap

The trap here is that candidates may confuse administrative convenience (same password) or storage capacity with the fundamental need for temporal consistency, overlooking that log correlation depends on synchronized clocks, not identical credentials or disk space.

How to eliminate wrong answers

Option A is wrong because using a local administrator account with the same password on every server violates the principle of least privilege and creates a massive security risk—if one server is compromised, all servers are exposed. It does nothing to ensure log timestamps are consistent. Option C is wrong because increasing disk size on the log server only addresses storage capacity, not the accuracy of timestamp comparisons across servers; logs can still have misaligned times even if storage is abundant.

Practice this question →

MCQmedium

A security analyst detects real-time data exfiltration from a critical production database that supports customer transactions. The exfiltration appears to be occurring via a compromised application service account. Which containment strategy should the analyst implement FIRST to minimize damage while preserving forensic data?

A.Disconnect the database server from the network.

B.Shut down the database server.

C.Implement network segmentation to isolate the server.

D.Block the IP address of the suspected attacker.

AnswerA

Disconnecting the database server from the network is the immediate containment step because it severs the active data transfer channel at the network interface, halting further exfiltration while leaving the operating system, running processes, and volatile memory intact. This preservation is vital for forensic acquisition of memory-resident indicators, encryption keys, and live command-and-control sessions. It also avoids the risk of file corruption from a forced shutdown, allowing investigators to recover logs and database state cleanly.

Why this answer

Disconnecting the database server from the network (Option A) immediately stops the active data exfiltration by severing all network communication, including the compromised service account's outbound connections. This preserves the server's volatile memory, running processes, and disk state for forensic analysis, unlike a shutdown which would destroy critical evidence. It is the fastest containment action that minimizes data loss while maintaining the integrity of forensic artifacts.

Exam trap

The SY0-701 exam often tests the misconception that shutting down a server is the safest containment action, but the trap here is that shutdown destroys volatile forensic data (e.g., active network connections, memory-resident malware) that is critical for attribution and root cause analysis.

Why the other options are wrong

Shutting down the server destroys volatile forensic data (e.g., memory, active connections) and may cause data corruption or loss, violating the priority to preserve evidence while stopping exfiltration.

Blocking the IP address is ineffective because the attacker may use multiple IPs or proxies, and the compromised service account can still be used for further attacks from other sources. It does not stop the ongoing exfiltration via the legitimate database connection.

Practice this question →

MCQmedium

A server room uses raised flooring and sits below a chilled-water pipe. Facilities wants the earliest warning if water starts accumulating under the floor tiles. Which control should be added?

A.Add more motion detectors near the racks.

B.Use badge readers on the server room door.

C.Install smoke detectors only.

D.Install leak-detection sensors or a moisture detection cable tied to alerts.

AnswerD

Leak-detection sensors placed under the floor can detect water as soon as it appears, which is exactly what facilities wants here. Early warning lets staff respond before equipment is damaged or a larger outage occurs. For a room below a chilled-water pipe, environmental monitoring is more effective than access control or motion detection because the hazard is liquid intrusion rather than unauthorized entry.

Why this answer

Leak-detection sensors or moisture-detection cables are specifically designed to detect water accumulation under raised floors, providing the earliest possible warning. These sensors trigger alerts when moisture is present, allowing facilities to respond before water damages equipment or causes downtime. This directly addresses the risk of a chilled-water pipe leak in a server room environment.

Exam trap

The trap here is that candidates may confuse environmental monitoring controls (like leak detection) with physical security controls (like motion detectors or badge readers), or assume smoke detectors are sufficient for all hazard detection, when they are specific to fire only.

How to eliminate wrong answers

Option A is wrong because motion detectors detect movement (e.g., people or objects) and cannot sense water or moisture, so they provide no warning of a water leak. Option B is wrong because badge readers control physical access to the server room but do not detect environmental hazards like water accumulation. Option C is wrong because smoke detectors are designed to detect smoke or fire, not water; they would not activate until a fire occurs, missing the water leak entirely.

Practice this question →

Drag & Dropmedium

Drag and drop the steps to implement a backup strategy following the 3-2-1 rule into the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The 3-2-1 rule ensures redundancy: three copies, two different media, one offsite. Testing is crucial to verify recoverability.

Practice this question →

MCQmedium

A help desk technician receives an alert that an unmanaged laptop was plugged into a conference room network jack and was automatically placed into a restricted network segment until it passed a security check. Which control is responsible for that behavior?

A.Network access control (NAC).

B.Data loss prevention (DLP).

C.Intrusion prevention system (IPS).

D.Sandboxing gateway.

AnswerA

NAC (Network Access Control) is the security technology that evaluates a device's security posture before granting network access. It typically uses protocols like 802.1X for authentication and checks compliance criteria—such as patch level, antivirus status, or encryption—via an agent or client. If a device is found noncompliant, NAC can isolate it into a quarantine VLAN or redirect it to remediation servers, thereby directly controlling admission. This aligns exactly with the incident described, where an unmanaged device must be assessed and segregated.

Why this answer

Network Access Control (NAC) is the correct answer because it is specifically designed to enforce security policies on devices attempting to connect to a network. When an unmanaged laptop is plugged into a network jack, NAC evaluates the device's compliance (e.g., antivirus status, patch level) and, if it fails, automatically places it into a restricted segment (e.g., a quarantine VLAN) until it passes a security check. This behavior is a core function of NAC solutions like Cisco ISE or Aruba ClearPass, which use 802.1X or MAC authentication bypass to dynamically assign VLANs based on device posture.

Exam trap

The trap here is that candidates often confuse NAC with an IPS or firewall because both can block traffic, but NAC specifically controls access at the point of network entry (Layer 2) based on device identity and compliance, not by inspecting packet payloads.

How to eliminate wrong answers

Option B is wrong because Data Loss Prevention (DLP) focuses on monitoring and preventing unauthorized transmission of sensitive data, not on controlling network access or quarantining devices. Option C is wrong because an Intrusion Prevention System (IPS) inspects network traffic for malicious patterns and blocks attacks, but it does not enforce pre-admission security checks or dynamically segment devices based on compliance. Option D is wrong because a sandboxing gateway detonates suspicious files in an isolated environment to analyze behavior, but it does not manage network access or quarantine endpoints at the switch port level.

Practice this question →

Multi-Selecthard

A records room has repeated tailgating after hours and occasional door propping during deliveries. Management wants one control that prevents follow-on entry and another that immediately alerts security if the door is forced open or left ajar. Which two controls best meet the need? Select two.

Select 2 answers

A.Install a mantrap at the room entrance.

B.Add a door position sensor tied to an alarm or SIEM alert.

C.Place a larger warning sign on the wall beside the door.

D.Mount a visible camera over the door only.

E.Replace the mechanical lock with the same type of lock and no monitoring.

AnswersA, B

A mantrap is an enclosed vestibule with two interlocking doors; only one door can open at a time, and the system verifies a single valid credential before unlocking the second door. This physically isolates each entrant, so a second person cannot slip through behind an authorized user, directly eliminating tailgating. It can also be configured with anti-passback logic to prevent badge sharing and repeated entry.

Why this answer

A mantrap (option A) prevents tailgating by requiring one door to close before the next can open, effectively stopping follow-on entry. A door position sensor (option B) detects when the door is forced open or left ajar and triggers an immediate alert to security via an alarm or SIEM integration, meeting the requirement for real-time notification.

Exam trap

The trap here is that candidates often choose a camera (option D) thinking it provides real-time alerting, but a standard visible camera without integrated analytics does not automatically alert on door status—it only records footage for later review.

Practice this question →

MCQeasy

A critical patch must be applied to a production server next week. What is the best way to reduce the risk of downtime if the patch causes a problem?

A.Apply the patch during business hours so users can report issues quickly

B.Create a rollback plan before installing the patch

C.Skip testing because critical patches are always safe

D.Disable logging during the patch to improve performance

AnswerB

A rollback plan is a documented series of steps to restore the server to its previous known-good state, including pre-verified backups of data and configuration files, snapshots, and validation checks. It establishes a safe exit strategy so that if the patch causes unforeseen failures—such as application incompatibility or data corruption—the team can rapidly revert, minimizing downtime and data loss. This is a foundational component of change management and is more important than the patch itself in preserving service reliability.

Why this answer

Creating a rollback plan before installing a patch ensures that if the patch causes unexpected issues, the system can be restored to its previous stable state quickly, minimizing downtime. A rollback plan typically includes steps to revert the patch, restore from a backup, or switch to a failover system, which is a fundamental change management practice in security operations.

Exam trap

The trap here is that candidates may assume applying a patch during business hours allows for quick user feedback, but this overlooks the higher risk of widespread disruption and the importance of a controlled maintenance window.

How to eliminate wrong answers

Option A is wrong because applying a patch during business hours increases the risk of disrupting users and operations; patches should be applied during maintenance windows to minimize impact. Option C is wrong because skipping testing is dangerous even for critical patches, as they can still introduce compatibility issues or break existing functionality; testing in a non-production environment is essential. Option D is wrong because disabling logging during a patch removes the ability to audit changes and troubleshoot problems, which could lead to undetected issues and longer downtime.

Practice this question →

MCQeasy

A help desk team needs to update desktops in a call center without interrupting callers during peak hours. What is the best operational approach?

A.Deploy the updates immediately to all desktops at once

B.Schedule the updates during an approved maintenance window

C.Ask each user to install updates whenever they have time

D.Disable update notifications permanently

AnswerB

Scheduling updates during an approved maintenance window is correct because it aligns with ITIL-based change management, giving the help desk a defined, communicated time frame to apply patches, monitor for issues, and roll back if necessary. This approach minimizes user impact, ensures network and application resources are reserved for operations during business hours, and allows for staged deployment (e.g., pilot group first) to validate stability before broader release.

Why this answer

Scheduling updates during an approved maintenance window ensures that desktops are updated during a period of low activity, minimizing disruption to call center operations. This approach aligns with change management best practices, allowing for controlled deployment and rollback if issues arise, and avoids the performance degradation or reboots that could interrupt active calls.

Exam trap

The trap here is that candidates may choose immediate deployment (A) thinking it is the most efficient for security, overlooking the operational requirement to maintain service availability during peak hours.

How to eliminate wrong answers

Option A is wrong because deploying updates immediately to all desktops at once risks simultaneous reboots or performance slowdowns during peak hours, which would directly interrupt callers and violate availability requirements. Option C is wrong because asking each user to install updates whenever they have time lacks coordination and control; users may forget, delay, or apply updates inconsistently, leading to security gaps and unpredictable system behavior.

Practice this question →

100

MCQeasy

A Linux server starts showing many failed SSH logins from one source IP address. Which log source should the analyst review first?

A.The system authentication log

B.The printer spooler log

C.The browser history log

D.The backup completion log

AnswerA

This is the best choice because authentication logs record login attempts, failures, and success events. For SSH activity, the auth log or equivalent security log is the most direct place to confirm whether the attempts are real, what accounts were targeted, and whether any successful logon followed the failures. It provides the most useful first evidence for triage.

Why this answer

The system authentication log (e.g., /var/log/auth.log or /var/log/secure) records all SSH login attempts, including failed ones, along with source IP addresses. This is the primary log source for investigating authentication failures on Linux systems, as it captures PAM (Pluggable Authentication Module) events and SSH daemon messages.

Exam trap

The trap here is that candidates might confuse system authentication logs with generic system logs (e.g., /var/log/messages) or assume that SSH failures would be recorded in a network-level log, but the exam specifically tests knowledge of Linux authentication logging mechanisms.

How to eliminate wrong answers

Option B is wrong because the printer spooler log (e.g., /var/log/cups/) tracks print jobs and printer errors, not network authentication events like SSH logins. Option C is wrong because browser history logs are client-side records of web browsing activity, unrelated to server-side SSH authentication attempts. Option D is wrong because the backup completion log (e.g., /var/log/backup.log) records backup job statuses, not real-time authentication failures from remote IP addresses.

Practice this question →

101

MCQmedium

EDR alerts on a remote laptop show a suspicious process attempting to dump browser credentials and then contacting a rare domain. The user is in another time zone and still needs the laptop online for a presentation later today. What containment action is best?

A.Remotely isolate the device through the EDR console while keeping it powered on.

B.Ask the user to uninstall the EDR agent and reboot the laptop.

C.Wait until after the presentation and then begin containment.

D.Email the user asking them to close the browser and log out of their accounts.

AnswerA

EDR isolation is the best containment action because it stops most network communication while preserving the device state for investigation. Keeping the endpoint powered on maintains access to volatile evidence and avoids unnecessary disruption to disk contents or running processes. This is especially useful when the user is remote, because it can contain the threat quickly without requiring physical access or a full shutdown that would erase useful forensic data.

Why this answer

Remotely isolating the device through the EDR console is the best containment action because it immediately blocks all network communication to and from the laptop while keeping it powered on and running. This prevents the suspicious process from exfiltrating browser credentials or communicating with the rare command-and-control domain, yet allows the user to continue using local applications for the presentation later today. EDR isolation typically works by applying a host-based firewall rule that drops all traffic except to the EDR management server, ensuring the threat is contained without disrupting local productivity.

Exam trap

The trap here is that candidates may choose to wait until after the presentation (Option C) due to business continuity concerns, failing to recognize that immediate containment via network isolation can preserve both security and productivity.

How to eliminate wrong answers

Option B is wrong because asking the user to uninstall the EDR agent removes the very tool needed to monitor and contain the threat, leaving the laptop defenseless and potentially allowing the malicious process to continue unchecked. Option C is wrong because waiting until after the presentation gives the attacker time to exfiltrate sensitive credentials and establish persistence, violating the fundamental incident response principle of immediate containment. Option D is wrong because emailing the user to close the browser and log out does not stop the suspicious process from running in the background or prevent it from communicating with the rare domain, and the user may not act promptly or correctly.

Practice this question →

102

MCQmedium

Based on the exhibit, what is the most likely explanation for the alert?

A.The workstation has been redirected to an approved corporate proxy, so the event is expected.

B.A DNS cache poisoning attack is in progress and the workstation is now using a rogue gateway.

C.The endpoint is infected with malware that is hiding its traffic through encrypted tunnels.

D.The workstation is under a denial-of-service attack because it sent repeated DNS lookups.

AnswerA

The exhibit shows the workstation resolving WPAD, retrieving the proxy auto-configuration file, and then sending traffic to the approved proxy listed in inventory. Those steps match normal browser proxy discovery, not malicious behavior. Because the destination is the known corporate proxy, the alert should be validated as legitimate and then tuned if it repeatedly fires on the same approved sequence.

Why this answer

The alert indicates that the workstation's DNS traffic is being redirected to an internal proxy server (10.0.0.53), which is a common configuration in corporate environments for content filtering and security monitoring. Since the destination IP (10.0.0.53) is within the organization's private IP range and the proxy is explicitly approved, this behavior is expected and not malicious. The event is consistent with a transparent proxy or DNS-based proxy redirection, where the workstation's DNS queries are intercepted and forwarded to the corporate proxy.

Exam trap

The trap here is that candidates often assume any DNS redirection to an internal IP indicates a man-in-the-middle attack or DNS poisoning, but they overlook that corporate proxies legitimately use this technique for security monitoring and content filtering.

How to eliminate wrong answers

Option B is wrong because DNS cache poisoning would involve a rogue DNS server returning forged responses, not a consistent redirection to an internal proxy IP; the exhibit shows the workstation's DNS queries going to 10.0.0.53, which is a private IP, not a spoofed external address. Option C is wrong because malware using encrypted tunnels would typically show traffic to an external C2 server over protocols like HTTPS or DNS over HTTPS, not a consistent pattern of DNS queries to a known internal proxy IP. Option D is wrong because a denial-of-service attack would involve an overwhelming volume of traffic or resource exhaustion, not a single workstation sending DNS lookups to a proxy; repeated DNS lookups alone do not indicate a DoS attack.

Practice this question →

103

MCQmedium

A security analyst at a manufacturing company notices multiple workstations generating high volumes of encrypted outbound traffic and displaying ransom notes. The analyst suspects a ransomware outbreak. According to the incident response process, which of the following should the analyst perform FIRST?

A.Immediately wipe the hard drives of all affected workstations and reinstall the operating system.

B.Isolate the affected workstations from the network by disconnecting their network cables and disabling Wi-Fi.

C.Contact local law enforcement to report the ransomware incident and request a forensic investigation.

D.Conduct a full forensic analysis of one affected workstation to determine the ransomware variant and entry vector.

AnswerB

Disconnecting the network cables and disabling Wi-Fi on affected workstations is the correct immediate step because it performs a logical and physical air-gap, severing all paths for the ransomware to communicate with its command-and-control server or move laterally to other hosts. This containment action stops the active encryption of SMB shares, database servers, and other network devices, while also preserving dynamic evidence such as memory and running processes for later analysis, which would be destroyed if the system were powered off.

Why this answer

The first priority in a suspected ransomware outbreak is containment to prevent lateral spread and further encryption. Disconnecting network cables and disabling Wi-Fi immediately isolates the affected workstations from the network, stopping the ransomware from communicating with its command-and-control (C2) server or encrypting additional systems. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Exam trap

The trap here is that candidates often jump to eradication (wiping drives) or notification (calling law enforcement) first, forgetting that containment is the immediate priority to stop the outbreak from spreading across the network.

Why the other options are wrong

Wiping drives and reinstalling OS destroys volatile evidence and prevents forensic analysis to determine the ransomware variant and entry vector, which is critical for containment and eradication. The first step in incident response is containment, not eradication or recovery.

Contacting law enforcement is not the first step; immediate containment (isolation) is required to prevent further spread of the ransomware across the network.

In the incident response process, the first priority is containment to prevent further spread. Conducting a forensic analysis before containment allows the ransomware to continue encrypting other systems, violating the containment-first principle.

Practice this question →

104

MCQmedium

Security receives a company-owned laptop connected to an insider theft investigation. Before the device is transported to the evidence locker, what is the BEST action to support chain of custody?

A.Factory reset the laptop so investigators can start from a clean system

B.Seal the device in an evidence bag and record each handoff with signatures

C.Remove the hard drive and image it without any documentation

D.Leave the laptop unlocked so the next analyst can inspect it quickly

AnswerB

Sealing the laptop in an evidence bag and logging every handoff with signatures creates an unbroken, documented custody record. This directly satisfies the chain-of-custody requirement by proving who held the device at each stage, preventing tampering claims from undermining the insider theft investigation.

Why this answer

Sealing the device in an evidence bag and recording each handoff with signatures establishes a documented, unbroken chain of custody. This ensures the integrity of the evidence by preventing tampering and providing a verifiable record of who handled the device and when, which is critical for admissibility in legal proceedings.

Exam trap

The trap here is that candidates may think a factory reset (Option A) helps investigators start clean, but it actually destroys evidence, while proper sealing and documentation (Option B) is the only method that preserves evidence integrity for legal proceedings.

How to eliminate wrong answers

Option A is wrong because factory resetting the laptop destroys all potential evidence, including files, logs, and metadata, making it impossible for investigators to recover data relevant to the theft. Option C is wrong because removing the hard drive and imaging it without documentation violates chain of custody principles, as there is no record of who performed the action or when, compromising evidence integrity. Option D is wrong because leaving the laptop unlocked risks unauthorized access, alteration, or deletion of evidence, breaking the chain of custody and potentially rendering the evidence inadmissible.

Practice this question →

105

Multi-Selecteasy

A security team receives a suspicious email attachment and wants to inspect its behavior safely before any user opens it. They also want a tool that can isolate the same threat if it reaches an endpoint. Which two tools or capabilities best fit this need? Select two.

Select 2 answers

A.EDR remote isolation capability on the endpoint.

B.Sandboxing the attachment before release to users.

C.DLP monitoring to prevent accidental data leakage.

D.A WAF filtering web requests to the application.

E.Port mirroring on a switch for traffic review.

AnswersA, B

Endpoint Detection and Response (EDR) agents run on the endpoint and can execute a remote isolation command that quarantines the host from the network while preserving volatile data such as memory, running processes, and open files for forensic analysis. This containment action stops lateral movement and further malicious activity within the enterprise, but it does not analyze the attachment's behavior beforehand. It is an appropriate post-detection response to a confirmed or strongly suspected malicious attachment on that specific machine.

Why this answer

A is correct because EDR remote isolation capability allows the security team to immediately disconnect an endpoint from the network if the suspicious attachment is executed, preventing lateral movement and data exfiltration. B is correct because sandboxing the attachment before release to users provides a safe, isolated environment to analyze the file's behavior without risking the production network. Together, these tools address both proactive analysis (sandbox) and reactive containment (EDR isolation).

Exam trap

The trap here is that candidates may confuse DLP's data loss prevention role with threat analysis or endpoint containment, overlooking that DLP does not execute files or isolate systems.

Practice this question →

106

MCQmedium

A security analyst detects an encrypted outbound connection from a web server to an unknown IP address. The connection is persistent and occurs every 5 minutes. What is the MOST appropriate first step for the analyst to take?

A.Disconnect the server from the network immediately.

B.Block the IP address at the perimeter firewall.

C.Review the server's process list and logs to identify the source.

D.Escalate the incident to the incident response team.

AnswerC

This is the correct first step. By examining the process list and logs (e.g., system, firewall, and application logs), the analyst can determine the specific process or service responsible for the outbound connection, assess whether it is malicious, and gather evidence for further investigation or escalation.

Why this answer

The first step in investigating an unknown encrypted outbound connection is to identify the process or service responsible for initiating it. Reviewing the server's process list and logs allows the analyst to determine whether the connection is legitimate (e.g., a scheduled update or backup) or malicious (e.g., a beacon from implanted malware). Without this visibility, actions like blocking or disconnecting could disrupt legitimate services or alert an attacker prematurely.

Exam trap

The trap here is that candidates often jump to containment (disconnect or block) without first performing local analysis, failing to recognize that the initial step in incident response is always identification and scoping before containment.

Why the other options are wrong

Disconnecting the server immediately could destroy volatile evidence (e.g., running processes, memory contents) needed to identify the source of the encrypted connection, and may cause unnecessary service disruption without understanding the threat.

Blocking the IP address at the perimeter firewall is premature without first identifying the source and nature of the connection. The connection could be legitimate (e.g., a scheduled update or backup), and blocking it might disrupt operations or alert an attacker without gathering evidence.

In this scenario, the analyst has not yet identified the source of the encrypted connection. Escalating without initial investigation would bypass necessary evidence gathering and could delay containment.

Practice this question →

107

MCQmedium

A system administrator must run a weekly patch-and-restart job on 80 Linux servers without logging in interactively. The job should be repeatable, auditable, and limited to only the required maintenance commands. What is the best approach?

A.Share a root SSH key with the operations team so anyone can run the job.

B.Use a configuration management tool with a dedicated service account and restricted sudo permissions.

C.Have each administrator log in manually and run the commands from an interactive shell.

D.Create a local root account on every server for maintenance tasks.

AnswerB

Using a configuration management tool like Ansible or Puppet with a dedicated service account is ideal because it enforces least privilege: the account can be restricted via sudoers to only execute the specific patching and reboot commands (e.g., yum, apt, systemctl reboot), not a full root shell. The tool provides centralized execution, idempotent playbooks, and immutable audit logs showing exactly which commands ran on which hosts, eliminating human variability. A dedicated service account also supports credential rotation and integration with enterprise secret management, without exposing interactive root access.

Why this answer

B is correct because configuration management tools (e.g., Ansible, Puppet, or SaltStack) allow you to define a repeatable, auditable patch-and-restart job using a dedicated service account with restricted sudo permissions. This approach enforces the principle of least privilege, logs all actions via the tool's job history, and eliminates the need for interactive login, meeting all requirements for automation, auditability, and command restriction.

Exam trap

The trap here is that candidates may choose Option A (shared root SSH key) because it seems convenient for automation, but they overlook the critical security and auditability requirements that make configuration management with a restricted service account the only correct choice.

How to eliminate wrong answers

Option A is wrong because sharing a root SSH key violates the principle of least privilege and non-repudiation — anyone with the key can execute arbitrary commands as root without an audit trail of who ran what. Option C is wrong because manual interactive login on 80 servers is not repeatable, introduces human error, and fails to provide a centralized audit log; it also violates the requirement to avoid interactive login. Option D is wrong because creating a local root account on every server increases the attack surface, makes key management and auditing nearly impossible, and directly contradicts the need for a restricted, auditable process.

Practice this question →

108

MCQmedium

A security analyst detects unusual outbound traffic from a workstation to an external IP address known for command and control. The analyst has verified the alert and wants to contain the threat. According to the NIST SP 800-61 incident response process, which of the following steps should the analyst take FIRST?

A.Disconnect the workstation from the network

B.Perform a forensic analysis of the workstation

C.Reimage the workstation

D.Alert the system administrator

AnswerA

Disconnecting the workstation from the network cable or disabling its virtual NIC is the immediate containment action that stops active command-and-control beaconing and prevents further data exfiltration to the threat actor. Per NIST SP 800-61, this is the first priority once an incident is confirmed, as it isolates the compromised host and blocks lateral movement while preserving the current system state for later forensic acquisition. Do not delay this step for analysis or notification.

Why this answer

According to NIST SP 800-61, the first step in containment during incident response is to prevent further damage by isolating the compromised system. Disconnecting the workstation from the network immediately stops the outbound command-and-control traffic, preventing data exfiltration and further compromise. This aligns with the 'containment' phase before any analysis or remediation occurs.

Exam trap

The trap here is that candidates often confuse the order of incident response phases, choosing forensic analysis (Option B) first instead of containment, because they mistakenly believe evidence preservation must precede network isolation.

Why the other options are wrong

Per NIST SP 800-61, containment is the immediate priority after verification. Forensic analysis occurs after containment to preserve evidence and avoid altering the system state.

Reimaging the workstation is a recovery step, not a containment step. According to NIST SP 800-61, containment should occur before eradication or recovery to prevent further damage.

Alerting the system administrator is not the first containment step; NIST SP 800-61 prioritizes immediate containment actions like disconnecting the workstation to prevent further C2 communication.

Practice this question →

109

MCQmedium

A security analyst notices unusual outbound traffic from a server that normally only communicates with internal clients. The traffic is encrypted and goes to an external IP address not on any blocklists. The analyst also finds a new scheduled task on the server that runs a PowerShell script. Which of the following best describes the analyst's immediate next step in the incident response process?

A.Disconnect the server from the network to contain the potential breach.

B.Wipe the server and restore from a known good backup.

C.Run a full antivirus scan on the server to identify malware.

D.Inform the legal department and law enforcement.

AnswerA

This is correct because containment is the immediate priority in incident response to stop the threat from spreading or causing more harm. Disconnecting the network cable or disabling the network interface is a simple and effective containment action.

Why this answer

According to standard incident response frameworks such as NIST SP 800-61, containment is one of the first and most critical steps after detecting a potential compromise. The unusual encrypted outbound traffic and the unauthorized scheduled task are strong indicators of compromise (IOCs). Disconnecting the server from the network immediately helps prevent further data exfiltration, lateral movement, or additional damage.

Other actions, such as running a scan, wiping the server, or notifying legal, are performed later in the process after containment and evidence preservation.

Why the other options are wrong

Wiping and restoring from backup is a recovery step, not an immediate containment step. The incident response process requires containment first to prevent further damage or data exfiltration.

Running a full antivirus scan is a detection step, but the immediate priority in incident response is containment. The unusual outbound encrypted traffic and scheduled task indicate a potential compromise that must be isolated first to prevent data exfiltration or lateral movement.

Informing legal and law enforcement is not the immediate next step during incident response; containment (disconnecting the network) takes priority to prevent further damage or data exfiltration.

Practice this question →

110

MCQeasy

A laptop is suspected of being compromised, and the responder wants to preserve useful evidence before shutting it down. What should be done first?

A.Power off the laptop immediately to stop all attacker activity.

B.Capture volatile data such as memory and running processes if possible.

C.Install a new antivirus product before collecting evidence.

D.Reimage the laptop so the user can return to work quickly.

AnswerB

Capturing volatile data is the best first step when preserving evidence matters. Memory can contain malware code, encryption keys, active network sessions, and signs of lateral movement that disappear after shutdown. In incident response, responders try to preserve the most time-sensitive evidence before disrupting the system, as long as doing so is safe and approved.

Why this answer

Volatile data (e.g., RAM contents, running processes, network connections) is lost when the laptop is powered off. Capturing this data first preserves critical evidence of the attacker's current activity, such as malware in memory or active network connections, which is essential for forensic analysis. This aligns with the forensic principle of order of volatility, where the most volatile data is collected first.

Exam trap

The trap here is that candidates often think immediate shutdown stops the attack, but CompTIA tests the forensic principle that volatile data must be captured first to preserve evidence that disappears on power loss.

How to eliminate wrong answers

Option A is wrong because immediately powering off the laptop destroys volatile data (e.g., memory, running processes, network connections) that may contain critical evidence of the compromise, such as active malware or attacker commands. Option C is wrong because installing a new antivirus product modifies the system state (e.g., writes files, changes registry entries), potentially overwriting or destroying existing evidence, and is not a forensic best practice. Option D is wrong because reimaging the laptop completely wipes all data, including evidence of the compromise, making forensic analysis impossible and violating evidence preservation protocols.

Practice this question →

111

Multi-Selectmedium

A SIEM rule flags a Linux server because it makes outbound HTTPS connections to the same cloud IP every 15 minutes. The server runs an approved patch agent that should check in on a regular schedule. Which two checks best validate whether the alert is a false positive? Select two.

Select 2 answers

A.Compare the process name, parent process, and digital signature to the approved agent baseline.

B.Verify the destination domain and certificate chain against vendor documentation.

C.Assume the traffic is benign because it happens on a fixed schedule.

D.Suppress all alerts from the host permanently after this one event.

E.Stop collecting logs from the server so the same alert does not recur.

AnswersA, B

When a SIEM flags outbound traffic, examining the process name and parent process establishes the execution context; a patch agent like SCCM or WSUS will run from an expected parent and have a valid digital signature from the vendor. Matching these attributes against an approved baseline provides high-confidence evidence that the alert is a false positive, because unsigned or anomalous process trees are a common malware indicator.

Why this answer

Comparing the process name, parent process, and digital signature against the approved agent baseline directly validates that the traffic originates from the legitimate patch agent and not from malware masquerading as the agent. This is a standard host-based validation technique to confirm the source process integrity before investigating network alerts.

Exam trap

The trap here is that candidates may think a fixed schedule alone is sufficient to dismiss the alert (Option C), but CompTIA expects you to validate both the source process integrity and the destination legitimacy before concluding a false positive.

Practice this question →

112

MCQeasy

Before applying a critical patch to a production application server, which action best reduces the risk of extended downtime if the patch fails?

A.Apply the patch immediately without testing so the system is protected sooner.

B.Create a verified backup or rollback plan before making the change.

C.Disable logging so the patch process uses fewer resources.

D.Postpone the patch indefinitely until all business users request it.

AnswerB

A verified backup or rollback plan is the best safeguard because it gives the team a way to recover quickly if the patch causes instability. In patch management, resilience matters as much as speed. Planning for restoration before the change reduces downtime, supports change control, and helps the business continue operating if the update introduces problems.

Why this answer

Creating a verified backup or rollback plan before applying a critical patch ensures that if the patch causes unexpected failures or incompatibilities, the system can be restored to its previous stable state quickly. This directly reduces the risk of extended downtime by providing a reliable recovery path, which is a fundamental principle of change management and risk mitigation in production environments.

Exam trap

The trap here is that candidates may think immediate patching (Option A) is always the best security practice, but the question specifically asks about reducing the risk of extended downtime if the patch fails, not about security speed, so the correct answer focuses on recovery preparedness.

How to eliminate wrong answers

Option A is wrong because applying the patch immediately without testing bypasses validation and increases the likelihood of a failure that could cause extended downtime, as there is no rollback plan or backup to recover from. Option C is wrong because disabling logging does not reduce downtime risk; it actually hinders troubleshooting by removing forensic evidence needed to diagnose patch failures, and resource savings are negligible compared to the risk of extended outage. Option D is wrong because postponing the patch indefinitely leaves the system vulnerable to known exploits, and waiting for all business users to request it is impractical and violates security best practices for timely patch management.

Practice this question →

113

MCQmedium

A help desk technician reports that a user's account was locked out three times overnight. The security team reviews the authentication logs and discovers that the lockouts resulted from failed login attempts originating from a single external IP address, each attempt using a slightly different variation of the user's password. Which of the following should the security analyst do FIRST?

A.Block the external IP address at the perimeter firewall.

B.Disable the user account and require a password reset.

C.Investigate the user's recent activity for signs of compromise.

D.Increase the account lockout threshold to prevent future lockouts.

AnswerC

Correct. The analyst should first gather contextual information about the user's account, recent successful logins, and any other anomalous behavior. This investigation determines whether the account was actually breached and informs subsequent containment and remediation steps.

Why this answer

The pattern of failed login attempts from a single external IP using password variations suggests a brute-force or password-spraying attack. The security analyst must first investigate the user's recent activity to determine if the account was successfully compromised or if the attacker gained access via a successful login attempt before the lockouts occurred. This aligns with the incident response process, where identification and analysis precede containment actions like blocking IPs or resetting passwords.

Exam trap

The trap here is that candidates may jump to immediate containment (blocking the IP or disabling the account) without first verifying whether the attack succeeded, which violates the incident response principle of 'identify before contain' and could disrupt legitimate access or miss evidence of a breach.

Why the other options are wrong

Blocking the external IP address is premature because the lockouts could be a symptom of a compromised account being used by an attacker, and the priority is to investigate the user's account for compromise first.

Disabling the user account and requiring a password reset is premature because the lockouts are from an external IP with password variations, suggesting a brute-force attack, not necessarily that the user's account is compromised. The first step should be to investigate the user's activity to determine if the account was actually breached.

Practice this question →

114

Multi-Selectmedium

A finance workstation is suspected of running malware. It is still powered on, the user is logged in, and the network cable is connected. Which two actions best preserve volatile evidence before shutdown? Select two.

Select 2 answers

A.Capture RAM or a volatile memory image before the system is powered off

B.Record running processes, open network connections, and logged-on users

C.Shut the workstation down immediately and restart it cleanly

D.Run a disk defragmentation utility to prepare for imaging

E.Uninstall the suspected malware before collecting any evidence

AnswersA, B

RAM and other volatile memory hold a live snapshot of the compromise: running processes, loaded kernel modules, open sockets, active network sessions, decrypted payloads, and plaintext encryption keys often exist nowhere on disk. Once the workstation is powered off, this data vanishes instantaneously and cannot be recovered by any forensic technique, so a memory capture with a tool like WinPmem or FTK Imager must be acquired first. Malware frequently operates entirely in memory—fileless variants or injected code—making the RAM image the only source of evidence of their execution. This is the foundational step in the Order of Volatility and the first action to take during live response.

Why this answer

Capturing RAM or a volatile memory image preserves data that is lost when the system is powered off, such as running processes, encryption keys, and network connections. This is a fundamental step in forensic incident response to ensure volatile evidence is not destroyed before analysis.

Exam trap

The trap here is that candidates may think immediate shutdown is safe or that disk defragmentation is a valid preparation step, but both destroy or alter evidence, violating forensic preservation principles.

Practice this question →

115

MCQmedium

An EDR console alerts that powershell.exe launched with an encoded command on a finance workstation, and a minute later the host begins making repeated outbound connections to an unfamiliar IP address. What is the best initial response?

A.Run a full antivirus scan first and leave the workstation online so the user can keep working.

B.Isolate the workstation through the EDR platform and preserve logs and volatile evidence for investigation.

C.Power off the workstation immediately to ensure the malicious process stops.

D.Create a permanent firewall rule that allows the unfamiliar IP address so you can observe more traffic.

AnswerB

Encoded PowerShell combined with outbound beaconing is a strong indicator of active malicious behavior. Isolating the endpoint through EDR contains the incident while preserving the host’s state for analysis. This approach is better than pulling the plug because it reduces attacker activity without unnecessarily destroying volatile evidence. The analyst can then collect logs, memory, and process details before remediation or reimaging.

Why this answer

Isolating the workstation via the EDR platform stops the immediate threat (the malicious outbound connections) while preserving volatile evidence (e.g., running processes, network connections, memory contents) and logs for forensic analysis. This aligns with the incident response principle of containment before eradication, and EDR isolation typically uses a host-based firewall rule to block all traffic except to the EDR management server, ensuring the host remains accessible for investigation.

Exam trap

The trap here is that candidates confuse immediate containment (isolation) with eradication (antivirus scan) or evidence preservation (shutdown), but the SY0-701 emphasizes that isolation via EDR is the best initial response because it stops the threat without destroying volatile data.

How to eliminate wrong answers

Option A is wrong because running a full antivirus scan while the host remains online allows the attacker to continue exfiltration or lateral movement, and antivirus may miss fileless or encoded PowerShell attacks that never touch disk. Option C is wrong because powering off the workstation destroys volatile evidence (e.g., memory-resident malware, active network connections, process trees) and may prevent forensic analysis of the attack chain. Option D is wrong because creating a permanent firewall rule to allow the unfamiliar IP address would actively assist the attacker by ensuring uninterrupted command-and-control communication, violating the containment principle.

Practice this question →

116

Multi-Selecthard

A SOC analyst reviews an EDR alert showing powershell.exe launched with an encoded command, then immediately connected to an unfamiliar IP address and spawned rundll32.exe. The user is still logged in and the machine may still contain evidence needed for investigation. Which two actions should the analyst take first to contain the incident while preserving evidence? Select two.

Select 2 answers

A.Isolate the endpoint using EDR network containment or a quarantine policy.

B.Disable the user account and revoke active sessions or tokens for that identity.

C.Reboot the workstation immediately to clear any malicious process from memory.

D.Run a full vulnerability scan before taking any other action.

E.Delete the suspicious email from the mailbox to remove the original payload.

AnswersA, B

EDR network containment or a quarantine policy is the appropriate first response because it immediately blocks network-level communication from the endpoint to any external C2 server or internal hosts, thereby preventing lateral movement while the endpoint remains in a forensically sound state. By keeping the process and disk intact, the SOC analyst can later extract memory dumps, review active network connections, and perform threat hunting without contaminating volatile evidence. This action aligns with the containment phase of incident response, prioritizing the preservation of evidence over immediate eradication.

Why this answer

Isolating the endpoint via EDR network containment or quarantine policy immediately stops the malicious process from communicating with the command-and-control (C2) server at the unfamiliar IP address, preventing data exfiltration and lateral movement. This action preserves the volatile evidence in memory (e.g., the spawned rundll32.exe process) and on disk, allowing forensic analysis without the risk of the attacker destroying evidence remotely.

Exam trap

The trap here is that candidates often choose to reboot the workstation (Option C) thinking it will 'clean' the system, but this destroys volatile evidence and does not contain the incident, whereas disabling the user account (Option B) is a valid containment step to prevent further access via that identity.

Practice this question →

117

Multi-Selectmedium

A legacy application server has a critical vulnerability, but the vendor will not release a fix for 30 days. Which two compensating controls are the best short-term risk reduction steps? Select two.

Select 2 answers

A.Restrict access to the server to known admin IPs or a jump host.

B.Place a web application firewall or IPS rule in front of the exposed service.

C.Document the issue and wait for the vendor patch without making any changes.

D.Open the service to more networks so monitoring tools can see it better.

E.Disable logging to reduce the performance overhead caused by the vulnerability.

AnswersA, B

Restricting access to the server via network ACLs, security groups, or firewall rules to only known administrative IPs or a hardened jump host directly shrinks the attack surface. This effectively filters out the vast majority of potential exploit attempts from untrusted networks while the vulnerability remains unpatched. A jump host also centralizes access, enabling stronger authentication, session logging, and audit trails, which further reduces the likelihood and impact of an attacker reaching the vulnerable application.

Why this answer

Restricting access to the server to known admin IPs or a jump host reduces the attack surface by limiting who can reach the vulnerable service. This network-layer control (e.g., using ACLs or firewall rules) prevents exploitation from untrusted sources while the vendor patch is pending. It is a classic compensating control that buys time without modifying the application itself.

Exam trap

The trap here is that candidates may think documenting the issue (Option C) is sufficient or that increasing monitoring (Option D) is a control, but CompTIA expects active risk reduction measures like access restriction and virtual patching, not passive or counterproductive actions.

Practice this question →

118

MCQmedium

An IDS raises an alert for a possible SQL injection attack against an internal reporting portal. The web server logs show the source IP belongs to the company's vulnerability scanner, and the requests match the scanner's normal test pattern. What is the most appropriate analyst action?

A.Treat the alert as a confirmed breach and begin password resets for all portal users.

B.Mark the alert as a likely false positive after verifying the scanner schedule and source IP.

C.Block the scanner IP permanently to prevent future alerts from the same host.

D.Quarantine the reporting server because IDS alerts always indicate active exploitation.

AnswerB

The source IP and request pattern match the vulnerability scanner's authorised schedule, confirming benign activity rather than a real SQL injection attempt, so closing the alert as a likely false positive is proportionate and avoids unnecessary escalation.

Why this answer

The IDS alert matches the known behavior of the company's vulnerability scanner, which is a legitimate and scheduled security tool. Verifying the scanner schedule and source IP confirms the traffic is authorized, making the alert a false positive. Analysts should correlate IDS alerts with asset inventories and change management records to avoid unnecessary incident response actions.

Exam trap

The trap here is that candidates may assume any SQL injection pattern in IDS logs is malicious, overlooking the possibility that the traffic originates from an authorized internal security tool.

How to eliminate wrong answers

Option A is wrong because treating the alert as a confirmed breach without verification wastes resources and causes unnecessary user disruption; IDS alerts require validation before escalation. Option C is wrong because permanently blocking the scanner IP would disrupt legitimate security testing and vulnerability management processes. Option D is wrong because quarantining the server based solely on an IDS alert ignores the context that the traffic is from an authorized scanner; IDS alerts can be false positives and do not always indicate active exploitation.

Practice this question →

119

MCQeasy

Based on the exhibit, which tool should the security team use to safely observe the attachment's behavior before delivery to users?

A.Sandboxing, so the file can execute in a controlled environment before release.

B.DLP, so the gateway can block sensitive data from leaving the organization.

C.NAC, so the sender's device can be checked before the message is accepted.

D.SIEM, so the team can store the attachment and review alerts later.

AnswerA

Sandboxing is designed to detonate suspicious files safely and observe their behavior. Because the attachment is a macro-enabled spreadsheet and static scanning did not find a known signature, dynamic analysis is the right next step. This helps confirm whether the file tries to drop malware, contact an external server, or modify the system.

Why this answer

Sandboxing allows the security team to execute the attachment in a controlled, isolated environment to observe its behavior (e.g., network connections, file modifications) without risking the production network. This is the correct approach because it safely detonates the file before delivery, enabling detection of malicious activity such as ransomware or trojans. Other tools like DLP, NAC, or SIEM do not provide the dynamic analysis needed to assess the attachment's runtime behavior.

Exam trap

The trap here is that candidates may confuse sandboxing with DLP or SIEM, thinking that blocking data exfiltration or reviewing logs after delivery is sufficient, when the question specifically requires observing behavior before delivery.

How to eliminate wrong answers

Option B (DLP) is wrong because Data Loss Prevention focuses on monitoring and blocking sensitive data exfiltration, not on analyzing the behavior of an attachment for malware. Option C (NAC) is wrong because Network Access Control checks the security posture of a device before granting network access, not the content or behavior of an attachment in an email. Option D (SIEM) is wrong because a Security Information and Event Management system aggregates and correlates logs for analysis, but it cannot safely execute or observe the runtime behavior of an attachment before delivery.

Practice this question →

120

MCQmedium

A hardening script is pushed to a production web server and, within minutes, the application stops accepting secure connections. The team discovers the script disabled a required TLS setting that the legacy application still needs. What should have been in place to reduce the impact of this change?

A.A documented change window with testing in a staging environment and a rollback plan.

B.A longer password policy for administrators so they can log in after the outage.

C.Disabling all logging during the change so the application can restart faster.

D.Replacing the web server hardware to ensure the TLS settings are applied correctly.

AnswerA

A documented change window with staging validation and a rollback plan directly satisfies the stem's impact-reduction constraint: staging testing would have exposed the legacy application's TLS dependency before production, and the rollback plan would have restored the disabled TLS setting immediately, cutting outage duration. Change windows alone do not prevent misconfiguration; the rollback capability is what limits blast radius.

Why this answer

A documented change window with testing in a staging environment and a rollback plan ensures that changes are validated before production deployment. In this scenario, the hardening script disabled a required TLS setting (e.g., TLS 1.0 or a specific cipher suite) that the legacy application depended on. Testing in staging would have caught the incompatibility, and a rollback plan would allow reverting the change quickly, minimizing downtime.

Exam trap

The trap here is that candidates might think the issue is about authentication (Option B) or hardware (Option D), but the core problem is a configuration change that broke TLS compatibility, which requires proper change management and testing, not hardware or password policies.

How to eliminate wrong answers

Option B is wrong because a longer password policy for administrators does not address the technical issue of a misconfigured TLS setting; it only affects authentication, not the secure connection failure. Option C is wrong because disabling logging during the change does not help the application restart faster or prevent the TLS misconfiguration; logging is unrelated to the TLS stack or service recovery. Option D is wrong because replacing the web server hardware does not affect TLS settings; TLS configuration is software-based (e.g., in the web server's config files or registry), and hardware replacement would not resolve a misapplied script.

Practice this question →

121

MCQeasy

A SIEM alert shows a workstation connecting to the same unknown internet address every 15 minutes, even after business hours. The device belongs to an employee who is on vacation. What is the best next step for the analyst?

A.Dismiss the alert because periodic connections are always normal for workstations.

B.Treat the alert as potentially malicious and check endpoint and proxy logs for more context.

C.Immediately delete the workstation account from the directory service.

D.Shut down the entire office network until the analyst can review the alert.

AnswerB

Treating the alert as potentially malicious is the appropriate first response because an unknown destination contacted at regular intervals is a classic beaconing signature used by command-and-control (C2) malware. Checking endpoint logs can reveal the executable or script initiating the connection, while proxy logs provide the full URL, TLS SNI, and destination categorization needed to assess reputation. This non-destructive correlation gives the analyst the context required to determine whether the traffic is a true positive or a benign service, and it preserves forensic data for later investigation.

Why this answer

The alert describes a persistent outbound connection to an unknown external IP address at regular intervals, which is a classic indicator of beaconing behavior often associated with malware command-and-control (C2) traffic. The fact that the connection occurs after business hours and the workstation's user is on vacation increases suspicion, as legitimate scheduled tasks or updates would typically not run under those conditions. Checking endpoint and proxy logs provides the necessary context to determine if the traffic is benign (e.g., a misconfigured service) or malicious (e.g., C2 communication).

Exam trap

The trap here is that candidates may assume periodic connections are always benign (e.g., Windows Update or NTP sync) and dismiss the alert, failing to recognize that the regularity, unknown destination, and user-on-vacation context are red flags for malicious C2 activity.

How to eliminate wrong answers

Option A is wrong because periodic connections are not always normal; beaconing at fixed intervals to an unknown external address is a well-known indicator of compromise (IoC) in security monitoring, and dismissing it outright violates standard incident response procedures. Option C is wrong because immediately deleting the workstation account from the directory service is a drastic, irreversible action that could disrupt legitimate operations and destroy forensic evidence; the proper first step is to gather additional context before taking containment actions.

Practice this question →

122

MCQmedium

Facilities sees occasional water droplets forming above the cable trays in a data room during humid afternoons. The team wants the earliest possible warning before equipment is damaged. Which control should be added?

A.Motion detectors connected to the alarm panel.

B.Water leak sensors tied to environmental monitoring.

C.Badge readers on the room entrance only.

D.Fire suppression tests scheduled more frequently.

AnswerB

Water leak sensors are purpose-built to detect the presence of moisture or abnormal humidity levels, often using conductive pads or capacitive probes that trigger an alert when water contacts the sensor. When integrated into an environmental monitoring system, they provide continuous, real-time visibility of conditions such as condensation on ductwork or plumbing leaks, allowing facility staff to respond before water reaches sensitive electrical equipment. This makes them the correct, targeted solution for the described scenario, as they directly address the risk of water intrusion rather than relying on indirect indicators.

Why this answer

Water leak sensors tied to environmental monitoring provide the earliest possible warning by detecting moisture directly on or near the cable trays. Unlike motion detectors or badge readers, these sensors are specifically designed to alert before water reaches sensitive equipment, enabling proactive remediation.

Exam trap

The trap here is that candidates may confuse physical security controls (motion detectors, badge readers) with environmental monitoring controls, overlooking that water damage requires specific moisture detection rather than access or motion sensing.

How to eliminate wrong answers

Option A is wrong because motion detectors detect movement, not water, and would not provide any warning about condensation or leaks. Option C is wrong because badge readers control physical access to the room but cannot detect environmental conditions like humidity or water. Option D is wrong because fire suppression tests are unrelated to water detection and do not address the condensation issue; they focus on fire safety, not moisture monitoring.

Practice this question →

123

Multi-Selecthard

A SIEM correlates the following: 17 failed logons against the same VPN account from one IP in 9 minutes, a successful login from that IP, creation of a new API token in the SaaS tenant, and a large export job started two minutes later. Which two interpretations are best supported? Select two.

Select 2 answers

A.The attacker is likely performing a brute-force password attack against a single account.

B.The pattern is most consistent with password spraying across many accounts.

C.The account is likely compromised and being used for token abuse or persistence.

D.The events primarily indicate a volumetric denial-of-service attack.

E.Token creation proves the account password was never exposed.

AnswersA, C

Seventeen failed logons all targeting the same account from a single source is the hallmark of a brute-force attack, where the attacker systematically submits many password guesses against one username. Unlike spraying, which spreads a few attempts across many identities, this concentrated burst aims to eventually crack the one credential. The subsequent successful logon and token creation are consistent with a brute-force attempt that finally succeeded and then moved to post-exploitation.

Why this answer

A is correct because 17 failed logons against a single VPN account from one IP in 9 minutes is a classic brute-force pattern—repeated authentication attempts targeting one username. The subsequent successful login, API token creation, and data export indicate the attacker gained access and then established persistence (via the token) to exfiltrate data, confirming the account was compromised.

Exam trap

The trap here is confusing a single-account brute-force with password spraying—candidates often misidentify the pattern because they see multiple failed logons and assume many accounts are targeted, but the key is the same account and same IP over a short window.

Practice this question →

124

Multi-Selectmedium

An EDR alert shows winword.exe launching powershell.exe with an encoded command after a user opened an invoice attachment. No new executable file was written to disk, and the host is still online. Which two actions should the SOC analyst take first to validate the alert and collect usable evidence? Select two.

Select 2 answers

A.Review the parent-child process chain and the full PowerShell command line in EDR.

B.Compare the endpoint's outbound connections with its normal baseline and approved destinations.

C.Reimage the workstation immediately to eliminate any possible persistence.

D.Ask the user to delete the suspicious email and clear the recycle bin.

E.Check PowerShell script block logs, AMSI detections, and related event records on the endpoint.

AnswersA, E

Reviewing the parent-child process chain in EDR confirms that winword.exe actually spawned powershell.exe, validating the suspicious macro-to-PowerShell execution path rather than assuming a false positive. The full PowerShell command line is essential because it reveals whether an encoded payload, download cradle, or malicious script was passed, and it often exposes obfuscation techniques that would otherwise be invisible. This direct process and script evidence is the fastest and most reliable way to triage the alert before taking broader defensive action.

Why this answer

Reviewing the parent-child process chain (winword.exe → powershell.exe) and the full PowerShell command line in the EDR allows the analyst to immediately validate whether the alert is a true positive by confirming the process lineage and decoding the encoded command. This step is critical for understanding the attacker's intent without relying on disk artifacts, as the attack is fileless and memory-resident.

Exam trap

The trap here is that candidates may think reimaging or deleting the email is a valid containment step, but the question specifically asks for actions to validate the alert and collect usable evidence, not to contain or remediate.

Practice this question →

125

MCQmedium

At 10:15, a file server begins renaming documents and creating payment notes. The SOC confirms the server is also making SMB connections to other internal hosts, but users can still access shared folders. What should the incident handler do FIRST?

A.Disconnect the server from the network or isolate it through EDR containment while preserving power

B.Shut down the server immediately to stop all malicious activity

C.Restore the server from backup before taking any other action

D.Wait for users to report more symptoms before responding

AnswerA

Network isolation or EDR containment is the correct immediate step because it halts ransomware's further encryption and lateral movement while keeping the system powered on. Preserving power retains volatile evidence—RAM, active network connections, and running processes—which incident responders need for forensic analysis and recovery. This approach balances rapid containment with the integrity of digital evidence, unlike destructive shutdowns or premature restoration.

Why this answer

The correct first step is to contain the incident by disconnecting the server from the network or using EDR containment while preserving power. This stops the spread of malicious SMB connections and prevents further damage, while keeping the system powered on to preserve volatile evidence (e.g., memory, running processes) for forensic analysis. Immediate containment aligns with the NIST incident response framework's containment phase, prioritizing isolation over eradication or recovery.

Exam trap

The trap here is that candidates may choose to shut down the server (Option B) thinking it stops the attack, but CompTIA emphasizes preserving power and evidence for forensic analysis, making isolation the correct first step.

How to eliminate wrong answers

Option B is wrong because shutting down the server destroys volatile evidence (e.g., memory contents, active network connections) and may allow malware to persist or trigger destructive payloads on reboot. Option C is wrong because restoring from backup before containment could re-infect the network if the backup is compromised, and it skips the critical step of preserving evidence. Option D is wrong because waiting for more symptoms allows the attacker to move laterally via SMB, encrypt more files, or exfiltrate data, violating the principle of rapid containment.

Practice this question →

126

Multi-Selectmedium

An organization is implementing a Security Information and Event Management (SIEM) system to enhance its security monitoring capabilities. Which four of the following are primary functions of a SIEM? (Choose four.)

Select 4 answers

.Correlation of log data from multiple sources

.Real-time alerting on security events

.Centralized log storage and retention

.Automated threat intelligence feed integration

.Vulnerability scanning and patch management

.In-line network traffic blocking

Why this answer

A SIEM's primary functions include correlation of log data from multiple sources to identify patterns and anomalies, real-time alerting on security events to enable immediate response, centralized log storage and retention for compliance and forensic analysis, and automated threat intelligence feed integration to enrich event data with known indicators of compromise (IOCs). These capabilities collectively provide comprehensive security monitoring and incident detection.

Exam trap

The SY0-701 exam often tests the misconception that a SIEM can actively block traffic or perform vulnerability scanning, but in reality, a SIEM is a passive monitoring and analysis tool that does not execute remediation actions or network-level blocking.

Practice this question →

127

MCQmedium

A contractor connects a personal tablet to a lobby Ethernet jack. The network team wants the device blocked from internal resources until it passes posture checks and only guest access is allowed meanwhile. Which control best fits?

A.A data loss prevention platform that inspects file transfers.

B.Network access control that verifies the device before granting access.

C.A network intrusion detection system placed inline at the switch.

D.A VPN concentrator that encrypts remote traffic back to headquarters.

AnswerB

Network access control (NAC) provides exactly this capability by using protocols like 802.1X and RADIUS to authenticate the device and evaluate its security posture before the switch port is opened. Depending on the policy, the tablet may be allowed onto a guest VLAN, denied entirely, or placed in quarantine if it lacks required patches or antivirus. This pre-admission enforcement prevents the unverified contractor device from reaching internal resources, fulfilling the requirement.

Why this answer

Network Access Control (NAC) is the correct solution because it enforces security policies by checking a device's compliance (e.g., antivirus, patch level) before granting access to internal resources. In this scenario, the contractor's tablet is initially placed on a guest VLAN with internet-only access until posture checks pass, which is a core NAC function (e.g., using 802.1X or MAC authentication bypass).

Exam trap

The trap here is confusing NAC with a NIDS or DLP, because candidates often think 'blocking' requires an inline security appliance, but NAC uses switch-level VLAN assignment and 802.1X to enforce policy without inspecting content.

How to eliminate wrong answers

Option A is wrong because a Data Loss Prevention (DLP) platform inspects data in motion or at rest to prevent leaks, not to enforce pre-admission posture checks or VLAN assignment. Option C is wrong because a Network Intrusion Detection System (NIDS) monitors traffic for malicious patterns but does not block or quarantine devices based on compliance status; it is passive and cannot enforce guest-only access. Option D is wrong because a VPN concentrator encrypts remote traffic but does not perform device posture assessment or control local network segmentation before access is granted.

Practice this question →

128

MCQmedium

After a ransomware event, management wants proof that last night's backups can actually support business operations before they declare recovery complete. What is the best action?

A.Perform a test restore into an isolated environment and validate the files or application work correctly.

B.Increase the backup retention period without testing the backups.

C.Copy the backup set to a new storage bucket and assume it is usable.

D.Run a vulnerability scan against the backup server.

AnswerA

A test restore is the only option that proves the backup can actually be recovered and used. By restoring into an isolated environment, the team avoids contaminating production while still confirming that data, permissions, and the application behave as expected. This also helps validate recovery objectives and exposes problems such as corrupted backups, missing dependencies, or failed restore procedures before a real outage occurs.

Why this answer

Performing a test restore into an isolated environment directly validates that the backup data is intact, the restore process works, and the restored files or applications function as expected. This provides management with the proof they need to confirm business operations can resume, which is the core requirement after a ransomware event.

Exam trap

The trap here is that candidates may confuse backup management tasks (like retention or copying) with actual recovery validation, or think that security scanning proves backup usability, when only a functional test restore provides the required proof of operability.

How to eliminate wrong answers

Option B is wrong because merely increasing the backup retention period does not verify the usability or integrity of the backups; it only stores more data without any validation. Option C is wrong because copying the backup set to a new storage bucket and assuming it is usable ignores the need to test the restore process and verify data integrity; backups are useless if they cannot be restored correctly. Option D is wrong because running a vulnerability scan against the backup server checks for security weaknesses but does not test whether the backup data can be restored and support business operations.

Practice this question →

129

MCQmedium

A vulnerability scan identifies a critical patch for a fleet of internet-facing servers. The operations lead wants to apply it immediately during peak business hours because the exploit is public. What is the BEST next step?

A.Install the patch on all servers immediately without testing

B.Use the emergency change process with testing, approval, and a rollback plan

C.Wait until the next quarterly maintenance window to avoid any risk

D.Patch only one production server and assume the rest will be fine

AnswerB

The emergency change process is the correct path because it preserves the essential safeguards of testing, stakeholder approval, and a defined rollback plan while compressing the timeline for a critical vulnerability. This process typically involves a CAB (Change Advisory Board) or emergency CAB, where the risk of not patching is weighed against the potential impact of the patch itself. Testing on a representative non-production system, even in abbreviated form, validates compatibility and reduces the chance of introducing an outage. A documented rollback procedure ensures that if the patch fails in production, the organization can quickly revert to a known-good state without prolonged downtime.

Why this answer

An emergency change process allows the critical patch to be applied quickly while still incorporating essential steps like testing, approval, and a rollback plan. This balances the urgency of a public exploit with the need to avoid unintended service disruptions during peak business hours, aligning with change management best practices in Security Operations.

Exam trap

The trap here is that candidates may choose option A, thinking speed is the only priority, but the exam tests the balance between urgency and risk management through formal change control processes.

How to eliminate wrong answers

Option A is wrong because installing the patch on all servers immediately without testing risks introducing compatibility issues or system instability, which could cause widespread outages during peak hours. Option C is wrong because waiting until the next quarterly maintenance window ignores the critical nature of a public exploit, leaving systems vulnerable to active attacks in the interim. Option D is wrong because patching only one production server and assuming the rest will be fine does not address the fleet-wide vulnerability and provides a false sense of security, as the unpatched servers remain exposed.

Practice this question →

130

MCQmedium

A SIEM alert shows a successful VPN login for an executive account from an unusual country, followed 3 minutes later by large downloads from a file share the user rarely accesses. Which log source should the analyst review next to determine whether the session came from the user's assigned laptop or an unmanaged device?

A.VPN concentrator logs

B.Endpoint detection and response telemetry from the user's laptop

C.DNS query logs from the internal resolver

D.Email gateway logs for the executive mailbox

AnswerB

Endpoint detection and response (EDR) telemetry from the user's laptop provides the highest-fidelity evidence for validating a VPN login. It can confirm the device's unique hardware ID, hostname, and EDR agent status, while also showing whether the laptop was trusted, healthy, and free of active compromises at the time of login. By correlating process execution, network connections, and user activity, EDR can tie the VPN authentication to the exact endpoint and rule out a stolen token or a forged client.

Why this answer

B is correct because endpoint detection and response (EDR) telemetry from the user's laptop provides granular process-level and network-level data, including the source IP of the VPN session, the device's hostname, and whether the VPN client software was initiated from the managed laptop's operating system. This allows the analyst to confirm if the VPN session originated from the assigned corporate device or from an unmanaged device using stolen credentials.

Exam trap

The SY0-701 exam often tests the misconception that VPN concentrator logs alone can identify the device type, but they only show authentication and external IP, not whether the session originated from the assigned managed laptop.

How to eliminate wrong answers

Option A is wrong because VPN concentrator logs only show the external IP address and authentication details, not whether the session came from the user's assigned laptop or an unmanaged device—they lack device-level identifiers like hostname or EDR agent presence. Option C is wrong because DNS query logs from the internal resolver only show domain name resolution requests, not the source device identity or VPN client origin, so they cannot differentiate between a managed and unmanaged device.

Practice this question →

131

MCQmedium

An NDR tool shows a production web server sending small, periodic DNS queries to random-looking subdomains under a domain the company does not use. The pattern repeats every 60 seconds, even when normal web traffic is idle. What is the best interpretation and next step?

A.This is normal DNS behavior, so no action is needed unless users report an outage.

B.Suspect DNS-based command-and-control, then isolate the server and collect logs and packet data for analysis.

C.Rotate the DNS server’s administrator password and leave the web server online.

D.Assume the web server is performing routine certificate renewal checks and ignore the alert.

AnswerB

Regular outbound DNS queries to random subdomains can indicate tunneling or command-and-control traffic. The fact that it repeats at a fixed interval strengthens that suspicion. The best next step is to contain the host so the activity cannot continue, while preserving logs and packet captures for investigation. This lets the team determine whether malware, a rogue process, or a misconfiguration is responsible without losing evidence.

Why this answer

The small, periodic DNS queries to random-looking subdomains under an unused domain are a classic indicator of DNS-based command-and-control (C2) communication. Attackers often use DNS tunneling to exfiltrate data or send commands, as DNS traffic is typically allowed through firewalls. The fact that the pattern persists even during idle web traffic confirms it is not related to normal server operations, making isolation and forensic collection the appropriate next step.

Exam trap

The trap here is that candidates may mistake periodic DNS queries for legitimate maintenance traffic (like certificate renewal or NTP sync) and overlook the key indicator of random-looking subdomains under an unused domain, which is a hallmark of DNS tunneling for C2.

How to eliminate wrong answers

Option A is wrong because periodic DNS queries to random subdomains under an unused domain are not normal DNS behavior; legitimate DNS queries are typically for known, resolvable domains and do not exhibit a consistent 60-second pattern during idle periods. Option C is wrong because rotating the DNS server's administrator password does not address the compromised web server's outbound C2 traffic; the server itself must be isolated and investigated. Option D is wrong because certificate renewal checks use well-known domains (e.g., from a Certificate Authority) and do not involve random-looking subdomains under an unused domain; ignoring the alert could allow persistent C2 activity to continue.

Practice this question →

132

MCQmedium

EDR detects encoded PowerShell launched from a word processor, a process attempt to read LSASS memory, and an outbound HTTPS connection to a rare domain. What should the analyst do first?

A.Isolate the endpoint from the network while keeping it powered on for investigation.

B.Delete the user's profile to stop the malicious process immediately.

C.Patch the word processor before reviewing any alerts or logs.

D.Reboot the system immediately to clear anything running in memory.

AnswerA

This is the correct first action because the host shows clear signs of active compromise and possible credential theft. Network isolation limits further spread and command-and-control activity, while leaving the system powered on preserves volatile evidence for later analysis. That balance supports both containment and investigation, which is the right sequence when EDR indicates live malicious behavior.

Why this answer

The EDR alerts indicate a likely credential theft attempt (LSASS read) and C2 communication (rare domain). Isolating the endpoint preserves forensic evidence in memory and disk while preventing further data exfiltration or lateral movement, which is the immediate containment priority per incident response best practices.

Exam trap

The trap here is that candidates may choose reboot (D) thinking it clears malware, but CompTIA emphasizes preserving evidence and containing the threat first, as rebooting destroys volatile data needed for forensic analysis.

How to eliminate wrong answers

Option B is wrong because deleting the user profile destroys volatile evidence (e.g., process memory, registry artifacts) and may not stop a process running in system context. Option C is wrong because patching the word processor is a long-term remediation step, not an immediate response to an active compromise. Option D is wrong because rebooting clears memory-resident malware and forensic artifacts, potentially losing critical evidence of the attack chain.

Practice this question →

133

MCQhard

Based on the exhibit, which issue should be remediated first by the operations team? A small company has limited maintenance windows and can address only one of several findings this week.

A.db-lab02, because high-severity findings always outrank medium and critical findings.

B.printsrv03, because it is internet-facing and has no vendor patch available.

C.vpn-gw01, because it is internet-facing, exploitable now, and a fix is available.

D.None of these, because the team should wait for the next quarterly review before changing anything.

AnswerC

The VPN gateway is the most urgent issue because it is externally reachable, has a critical remote code execution flaw, and a vendor patch already exists. That combination creates high likelihood and high impact. The reboot requirement is inconvenient, but it is still the most actionable and dangerous finding. The other issues are either isolated from production or partially mitigated by compensating controls.

Why this answer

Vpn-gw01 is internet-facing, has an active exploit (CVSS score indicating current exploitation), and a vendor patch is available. In risk management, the highest priority is given to assets that are exposed to the internet, currently exploitable, and have a known fix, as this combination presents the most urgent threat to the organization's security posture.

Exam trap

The trap here is that candidates often assume severity (e.g., critical vs. high) is the sole determinant of remediation priority, ignoring the critical factors of internet exposure, exploitability, and patch availability that CompTIA emphasizes in risk management scenarios.

How to eliminate wrong answers

Option A is wrong because it incorrectly states that high-severity findings always outrank medium and critical findings; severity is only one factor in prioritization, and internet exposure, exploitability, and patch availability are equally important. Option B is wrong because printsrv03, while internet-facing with no vendor patch, does not have an active exploit, making it less urgent than an asset that is currently exploitable. Option D is wrong because waiting for the next quarterly review would leave a known, exploitable vulnerability unpatched, violating the principle of timely remediation for critical risks.

Practice this question →

134

MCQmedium

A security analyst is reviewing web server logs after a user reports that the company website displayed an error message containing raw database queries. The log shows repeated requests to the product search page with the following parameter: `?id=1 OR 1=1`. Which of the following should the analyst do FIRST to confirm the nature of the suspected attack?

A.Run a vulnerability scan against the web server.

B.Block the source IP address in the firewall.

C.Verify the request details against the web application firewall logs.

D.Isolate the web server from the network immediately.

AnswerC

Checking the WAF logs is the authoritative first step because they contain the full HTTP transaction metadata, including headers, request body, and the WAF's decision (e.g., rule match, blocked, or allowed). By correlating the web server access log timestamps and request IDs with WAF events, the analyst can definitively confirm whether the SQLi payload was actually blocked or reached the application. This evidence-based verification determines the incident scope and prevents wasting time on false positives. Without this correlation, any further action—including containment or scanning—could be based on an unverified assumption that the attack succeeded.

Why this answer

The analyst should first verify the request details against the web application firewall (WAF) logs to confirm whether the WAF detected and blocked the SQL injection attempt. The parameter `?id=1 OR 1=1` is a classic SQL injection payload, and WAF logs provide immediate evidence of whether the request was flagged, allowed, or blocked, enabling the analyst to correlate the user's report with actual security controls before taking further action.

Exam trap

The trap here is that candidates may jump to containment (blocking or isolating) or scanning without first using existing logs to confirm the attack, failing to follow the incident response principle of 'verify before act'.

Why the other options are wrong

Running a vulnerability scan is a secondary step after confirming the attack; the analyst first needs to verify the request details in the WAF logs to determine if the attack was blocked or reached the server.

Blocking the source IP address in the firewall is a reactive measure that does not confirm the nature of the attack; it only prevents further requests from that IP. The analyst needs to first verify the attack type by correlating logs with the WAF.

Isolating the web server immediately is premature because the analyst has not yet confirmed the nature of the attack. The log entry suggests a SQL injection attempt, but the first step should be to verify the attack using WAF logs, not to take drastic containment actions that could disrupt services.

Practice this question →

135

MCQmedium

EDR flags a workstation after a word processor launches encoded PowerShell and the host begins contacting a rare domain over HTTPS. The user is still active. What is the best containment action from the EDR console?

A.Isolate the endpoint from the network while keeping it powered on.

B.Delete the suspicious PowerShell process from the console and close the alert.

C.Reimage the workstation immediately to return it to a clean state.

D.Power the workstation off and disconnect the SSD to preserve data.

AnswerA

This is the best containment step because it stops the suspected malware from communicating outward or moving laterally, while preserving the live system for follow-up investigation. Keeping the machine powered on protects volatile evidence such as memory, processes, and active connections. EDR isolation is especially useful when the user is still logged in and the host may still contain useful artifacts that would be lost by immediate shutdown.

Why this answer

Isolating the endpoint from the network while keeping it powered on is the best containment action because it immediately cuts off the command-and-control (C2) communication over HTTPS to the rare domain, preventing further data exfiltration or lateral movement, while preserving volatile memory and running processes for forensic analysis. This aligns with incident response best practices where containment must prioritize stopping the threat without destroying evidence.

Exam trap

The trap here is that candidates often choose to kill the process or power off the system, mistakenly believing that stopping the immediate malicious activity is sufficient, without understanding that containment must preserve forensic evidence and prevent re-infection or lateral movement.

How to eliminate wrong answers

Option B is wrong because deleting the suspicious PowerShell process from the console does not remove the underlying malware or persistence mechanism, and the endpoint remains connected to the network, allowing the attacker to re-establish C2 or execute additional payloads. Option C is wrong because reimaging the workstation destroys all forensic evidence, including volatile memory, logs, and artifacts that could reveal the attack vector, scope, and indicators of compromise, which is premature before a proper investigation. Option D is wrong because powering the workstation off and disconnecting the SSD destroys volatile memory (e.g., running processes, network connections, encryption keys) that are critical for understanding the attack, and it prevents live response actions such as memory acquisition or process analysis.

Practice this question →

136

Multi-Selectmedium

An EDR alert shows suspicious PowerShell activity on a remote employee laptop, and the user is still logged in to cloud applications. Which two response actions are best if the device is believed to be actively compromised? Select two.

Select 2 answers

A.Isolate the endpoint through the EDR tool or quarantine its network access.

B.Collect a live response package or volatile data before cleanup begins.

C.Power off the laptop immediately to stop the activity as fast as possible.

D.Wait until the user returns the laptop to the office for physical inspection.

E.Remove the EDR agent so the attacker cannot detect the investigation.

AnswersA, B

Network isolation is the fastest way to stop additional attacker communication, lateral movement, and command execution from the compromised laptop. It contains the incident while preserving the system state for investigation. EDR quarantine is particularly useful for remote devices because it can be applied without physical access to the endpoint.

Why this answer

Isolating the endpoint via the EDR tool or quarantining its network access immediately stops the attacker's ability to communicate with command-and-control servers, preventing lateral movement and further data exfiltration. This containment action is a critical first step in incident response for an actively compromised device, as it preserves the integrity of the investigation while halting malicious activity.

Exam trap

The trap here is that candidates confuse 'stopping the activity' with 'powering off the device,' failing to recognize that volatile data collection must precede any shutdown to preserve forensic evidence.

Practice this question →

137

MCQmedium

A Linux operations team needs to run a nightly script that restarts one service and archives its logs on 60 servers. Security does not want an administrator to log in interactively, and the script should have only the permissions needed for that job. What is the best approach?

A.Use the root account so the job never fails.

B.Create a dedicated service account with only the delegated rights needed, and run the script as a scheduled job.

C.Store an administrator's SSH key inside the script.

D.Have an operator log in and run the commands manually each night.

AnswerB

A dedicated noninteractive account supports automation while keeping permissions tightly scoped to the task. The account can be granted only the ability to restart the specific service and write the required log archive location, rather than full administrator access. Scheduling the job also makes the activity repeatable and auditable. This approach supports least privilege, reduces human error, and avoids interactive logons on every server.

Why this answer

It follows the principle of least privilege by creating a dedicated service account with only the specific rights needed to restart the service and archive logs. Running the script as a scheduled job (e.g., via cron) eliminates the need for interactive login, satisfying the security requirement. This approach minimizes the attack surface and ensures the job runs automatically without exposing administrative credentials.

Exam trap

The trap here is that candidates often assume root is necessary for system service management, but SY0-701 tests the principle of least privilege and the ability to delegate specific rights via service accounts and sudoers policies.

How to eliminate wrong answers

Option A is wrong because using the root account grants unrestricted superuser privileges, violating the principle of least privilege and increasing the risk of catastrophic errors or compromise. Option C is wrong because storing an administrator's SSH key inside the script exposes the private key to anyone who can read the script, creating a credential theft vulnerability and violating secure key management practices. Option D is wrong because requiring an operator to log in manually each night introduces human error, inconsistency, and violates the security policy that prohibits interactive login.

Practice this question →

138

MCQmedium

A vulnerability dashboard shows four new findings. Which one should be remediated first by the operations team? - A low-severity issue on an offline lab VM - A medium-severity issue on a payroll server with no known exploit - A critical issue on an internet-facing web server with an available exploit - A high-severity issue on a test workstation that is not domain joined

A.The low-severity issue on the offline lab VM.

B.The medium-severity issue on the payroll server with no known exploit.

C.The critical issue on the internet-facing web server with an available exploit.

D.The high-severity issue on the test workstation that is not domain joined.

AnswerC

This finding combines maximum exploitability with maximum exposure: an available exploit means attackers can weaponise it immediately, and internet-facing placement removes the network boundary that would otherwise contain it. The other findings lack either a known exploit or external reachability.

Why this answer

The critical issue on the internet-facing web server with an available exploit should be remediated first because it combines the highest severity (critical) with an active, exploitable vulnerability on an asset exposed to the public internet. In vulnerability management, remediation priority is determined by risk, which is a function of severity, exploitability, and asset exposure. An internet-facing web server with a known exploit represents an immediate threat that can be remotely compromised, unlike the other findings which are on isolated or less critical systems.

Exam trap

CompTIA often tests the principle that severity alone does not determine priority; candidates must consider exploitability and asset exposure, and the trap here is assuming a high-severity issue on any asset (like a test workstation) should be fixed before a critical issue on an internet-facing server, ignoring that the test workstation is isolated and not domain-joined, reducing its risk profile.

How to eliminate wrong answers

Option A is wrong because a low-severity issue on an offline lab VM poses minimal risk; the VM is not connected to the network, so exploitation is virtually impossible and remediation can be deferred. Option B is wrong because a medium-severity issue on a payroll server with no known exploit is less urgent; without an available exploit, the likelihood of successful attack is low, and the server, while sensitive, is not directly exposed to the internet. Option D is wrong because a high-severity issue on a test workstation that is not domain joined is isolated from the production domain and likely not accessible from the internet, reducing the attack surface and urgency compared to a critical, exploitable internet-facing server.

Practice this question →

139

MCQhard

Based on the exhibit, what is the best eradication decision after containment? A quarantined endpoint was found to have a malicious startup item and a scheduled task. The team has already isolated it from the network and preserved memory for analysis.

A.Delete only the update.exe file and reconnect the host once the user confirms it is working.

B.Remove persistence artifacts and rebuild the endpoint from a known-good image before returning it to service.

C.Restore network connectivity now because no encryption was observed.

D.Change the DNS servers for the entire enterprise to block the malware domain.

AnswerB

The host contains a malicious executable plus two persistence mechanisms, so cleanup must remove more than the payload file. Reimaging from trusted media provides the most reliable eradication path, especially when the malware family is already identified and the machine has been quarantined. This reduces the chance of hidden remnants, registry persistence, or tampered system components surviving the response effort.

Why this answer

After containment (network isolation and memory preservation), the best eradication step is to remove all persistence mechanisms (startup item and scheduled task) and rebuild the endpoint from a known-good image. This ensures that any undetected malware remnants, rootkits, or hidden artifacts are eliminated, preventing reinfection. Simply deleting files or changing DNS does not guarantee the system is clean, and reconnecting without a full rebuild risks lateral movement or data exfiltration.

Exam trap

The trap here is that candidates may choose Option A, thinking that deleting the malicious file is sufficient, but CompTIA emphasizes that persistence artifacts must be removed and a system should be rebuilt from a trusted image to ensure complete eradication.

How to eliminate wrong answers

Option A is wrong because deleting only the update.exe file leaves the scheduled task and startup item intact, and the user's confirmation of functionality does not verify security; the host could still have hidden persistence or other malware. Option C is wrong because restoring network connectivity without eradication ignores the possibility of dormant malware or backdoors, and the absence of encryption does not indicate the system is safe. Option D is wrong because changing enterprise DNS servers is a containment or mitigation step, not an eradication decision; it does not clean the compromised endpoint and may disrupt legitimate traffic.

Practice this question →

140

MCQeasy

A user reports a ransomware note on one department file share, but other departments are still working normally. What is the best first containment action?

A.Shut down the entire company network immediately.

B.Disconnect the affected file share or server from the network.

C.Delete the ransom note and wait to see whether the problem returns.

D.Restore the share immediately before checking what caused the incident.

AnswerB

Isolating the affected system is the best first containment step because it helps stop the malware from spreading while preserving the rest of the environment. The goal in early incident response is to reduce impact quickly without causing unnecessary downtime. Once contained, responders can investigate scope, preserve evidence, and begin eradication and recovery.

Why this answer

The immediate priority in a ransomware incident is to contain the threat by isolating the affected system to prevent lateral movement. Disconnecting the file share or server from the network stops the ransomware from encrypting additional files or spreading to other departments via SMB or other protocols. This aligns with the NIST SP 800-61 containment strategy, which emphasizes rapid isolation without disrupting unaffected systems.

Exam trap

The trap here is that candidates may choose Option A (full network shutdown) because they think it is the safest action, but the exam emphasizes precise, least-disruptive containment that preserves evidence and limits business impact.

How to eliminate wrong answers

Option A is wrong because shutting down the entire company network is overly disruptive, may destroy volatile evidence (e.g., memory-resident malware), and is unnecessary when only one department is affected. Option C is wrong because deleting the ransom note does not remove the ransomware executable or prevent further encryption; it ignores the active threat and wastes critical response time. Option D is wrong because restoring the share without first containing the incident risks immediate re-infection, as the ransomware may still be active on the network or the restored files could be re-encrypted.

Practice this question →

141

MCQmedium

A SIEM correlates three failed MFA prompts for a payroll admin account from one IP, a successful login two minutes later from the same IP, and a new mailbox forwarding rule to an external address. What is the best immediate action?

A.Reset the password and leave the account enabled so the user can keep working.

B.Disable the account and revoke active sessions and tokens.

C.Delete the forwarding rule and monitor the account for a few hours.

D.Wait for the user to confirm the login before taking any action.

AnswerB

This is the best immediate containment step because the signs strongly indicate account compromise. Disabling the account stops new authentication, while revoking sessions and tokens cuts off any already-established access that could continue to act as the user. That combination contains the incident quickly and limits further mailbox manipulation, data theft, or privilege misuse while the team investigates logs and confirms scope.

Why this answer

The combination of failed MFA prompts followed by a successful login and immediate creation of an external mailbox forwarding rule is a classic indicator of account compromise (e.g., adversary-in-the-middle or token theft). Disabling the account and revoking active sessions and tokens stops the attacker from maintaining access and prevents further data exfiltration via the forwarding rule, which is the most urgent containment step in incident response.

Exam trap

CompTIA often tests the misconception that deleting the malicious artifact (forwarding rule) is sufficient, when in reality the priority is to contain the compromised account by disabling it and revoking all sessions.

How to eliminate wrong answers

Option A is wrong because resetting the password alone does not invalidate active sessions or tokens, allowing the attacker to continue using existing authenticated sessions. Option C is wrong because deleting only the forwarding rule without disabling the account leaves the attacker with continued access to the mailbox and the ability to recreate the rule or perform other malicious actions. Option D is wrong because waiting for user confirmation delays containment, giving the attacker more time to exfiltrate data or establish persistence, and the user may not be aware of the compromise.

Practice this question →

142

MCQmedium

A SOC analyst confirms that a critical Linux virtual machine is making outbound connections to a known malicious IP address. The application owner says the VM hosts a revenue system that cannot be powered off without causing a major outage. What is the best containment action?

A.Shut down the VM immediately to stop all malicious activity.

B.Isolate the VM at the network layer while keeping it powered on.

C.Wait for the next maintenance window before taking action.

D.Reimage the VM from a known-good template immediately.

AnswerB

Isolating the VM at the network layer—for example, by applying a firewall ACL, moving the virtual NIC to a quarantine VLAN, or using vNIC-level security groups—denies the attacker further command-and-control and lateral movement while leaving the operating system, processes, and memory intact for live acquisition. This approach minimizes disruption to a critical revenue system, is reversible, and gives the SOC time to collect volatile evidence like open sockets and process lists from a Linux environment. It is the preferred initial containment action because it cuts off attacker communication without destroying the forensic state.

Why this answer

Network isolation (e.g., applying a firewall ACL or moving the VM to a quarantine VLAN) stops outbound malicious traffic while keeping the revenue-critical system powered on and available for forensic analysis. This balances security containment with business continuity, as shutting down the VM (Option A) would cause a major outage, and waiting (Option C) would allow continued data exfiltration or lateral movement.

Exam trap

The trap here is that candidates may assume immediate shutdown is always the best containment action, but the exam tests the ability to prioritize business continuity while still containing the threat through network-layer isolation.

How to eliminate wrong answers

Option A is wrong because immediately shutting down the VM would cause a major outage for the revenue system, violating the requirement to avoid disruption, and it would destroy volatile forensic evidence (e.g., memory, active connections). Option C is wrong because waiting for the next maintenance window allows the malicious outbound connections to continue, risking data exfiltration, further compromise, or lateral movement to other systems.

Practice this question →

143

MCQmedium

Based on the exhibit, which finding is the best candidate for immediate remediation or emergency mitigation?

A.VPN-EDGE01, because a critical internet-facing RCE with public exploit code has the highest risk.

B.FILE-02, because file servers often affect many users and should always come before perimeter systems.

C.TEST-VM-17, because any high-severity issue deserves the fastest response regardless of exposure.

D.PRINTER-3F, because default credentials are the easiest issue to exploit and therefore the most dangerous.

AnswerA

VPN-EDGE01 combines severity, exposure, and exploit availability. A critical remote code execution flaw on an internet-facing device is the most urgent because attackers can reach it directly from outside the organization. Public proof-of-concept code further lowers the effort needed to exploit it. When prioritizing vulnerabilities, this combination usually receives immediate remediation or emergency mitigation.

Why this answer

VPN-EDGE01 is an internet-facing device with a critical remote code execution (RCE) vulnerability that has public exploit code available. This combination of high severity, network exposure, and weaponized exploit makes it the highest risk and most urgent for immediate remediation or emergency mitigation.

Exam trap

The trap here is that candidates may prioritize by severity alone (high vs. critical) or by ease of exploitation (default credentials), ignoring the critical factor of network exposure and the presence of public exploit code, which together create the highest immediate risk.

How to eliminate wrong answers

Option B is wrong because file servers, while affecting many users, do not inherently present a higher risk than an internet-facing device with a critical RCE; prioritizing by user count over exposure and exploitability is a common prioritization error. Option C is wrong because a high-severity issue on a non-internet-facing test VM (TEST-VM-17) is less urgent than a critical RCE on an internet-facing edge device, as the test VM has limited exposure and lower likelihood of exploitation. Option D is wrong because default credentials on a printer (PRINTER-3F), while easily exploitable, typically have limited impact compared to a critical RCE on a perimeter VPN gateway that could lead to full network compromise.

Practice this question →

144

MCQeasy

An administrator wants to add a new vendor IP range to a firewall rule in production. What is the best change-management step to reduce risk?

A.Apply the change immediately during peak business hours.

B.Test and approve the change before implementing it in production.

C.Allow the entire vendor subnet permanently without review.

D.Skip documentation to speed up the rollout.

AnswerB

Change management should include review, approval, and testing before production deployment. This reduces the chance of outages, misconfigurations, and unintended access. A controlled change window and validation steps are especially important for firewall rules because small mistakes can break connectivity or create security gaps.

Why this answer

Change management requires testing and approval before applying changes to production systems. Adding a new vendor IP range to a firewall rule without validation could inadvertently allow malicious traffic or block legitimate traffic, leading to a security breach or service disruption. Testing in a non-production environment or using a change window ensures the rule behaves as intended and aligns with the organization's security policy.

Exam trap

The trap here is that candidates may think immediate implementation (Option A) is acceptable for urgent security fixes, but the question specifies adding a new vendor IP range, which is a planned change that must follow proper change management procedures to avoid unintended access or downtime.

How to eliminate wrong answers

Option A is wrong because applying the change immediately during peak business hours violates change management best practices and risks causing outages or security gaps when the network is under heavy load, making rollback difficult. Option C is wrong because allowing the entire vendor subnet permanently without review bypasses the principle of least privilege and could expose the network to unnecessary risk if the vendor's IP range changes or includes untrusted addresses. Option D is wrong because skipping documentation undermines audit trails and incident response; without records, administrators cannot verify what changes were made or revert them if needed.

Practice this question →

145

MCQeasy

Based on the exhibit, which control would best reduce unauthorized follow-on entry into the records room?

A.Install a mantrap so only one person can pass through at a time.

B.Add more network firewall rules around the records room door.

C.Increase the screen lock timeout on nearby workstations.

D.Replace the UPS batteries to stop unauthorized people from entering.

AnswerA

A mantrap is designed to prevent tailgating and piggybacking by controlling one person through an entry point at a time. The exhibit shows someone followed an authorized employee into a sensitive room after the badge granted access. A mantrap directly addresses that weakness and is a common physical-security control for restricted areas.

Why this answer

A mantrap is a physical security control consisting of a small space with two interlocking doors, designed to allow only one person to pass at a time. This prevents tailgating and piggybacking, which are common methods of unauthorized follow-on entry into a restricted area like a records room.

Exam trap

The trap here is that candidates may confuse logical access controls (firewall rules, screen lock timeouts) or power-related controls (UPS) with physical access controls, failing to recognize that the question specifically targets unauthorized follow-on entry through a physical door.

How to eliminate wrong answers

Option B is wrong because network firewall rules control logical access to network resources, not physical entry through a door. Option C is wrong because increasing the screen lock timeout on workstations reduces the risk of unauthorized logical access to a computer, but does nothing to prevent a person from physically following an authorized user into the records room. Option D is wrong because replacing UPS batteries ensures backup power for equipment, but has no effect on preventing unauthorized physical entry.

Practice this question →

146

MCQeasy

A file server begins encrypting documents, and the SOC confirms the activity is malicious. Which incident response step should happen first to limit further damage?

A.Lessons learned

B.Containment

C.Recovery

D.Post-incident reporting

AnswerB

Containment is the immediate priority in incident response, isolating affected systems, blocking network communications, disabling compromised accounts, and preserving forensic evidence while stopping ongoing encryption. For a file server actively encrypting, containment actions like taking the server offline, segmenting VLANs, or revoking account tokens minimize further damage and buy time for eradication. This aligns with NIST SP 800-61 and CompTIA's incident response phases where containment precedes eradication and recovery.

Why this answer

Containment is the correct first step because it isolates the compromised file server from the network, preventing the ransomware from encrypting additional shares or spreading laterally. The SMB protocol (port 445) used for file sharing would be blocked at the switch or firewall, halting further encryption of documents. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Exam trap

CompTIA often tests the misconception that recovery (e.g., restoring from backup) is the first priority, but containment must come first to stop the active damage and prevent reinfection.

How to eliminate wrong answers

Option A is wrong because lessons learned occurs after the incident is fully resolved, not during active encryption. Option C is wrong because recovery (e.g., restoring from backups) cannot happen until the threat is contained and eradicated; attempting recovery first could re-encrypt data. Option D is wrong because post-incident reporting is a final step for documentation and compliance, not an immediate action to limit damage.

Practice this question →

147

MCQmedium

During malware containment, an analyst needs to preserve transient information from a compromised Windows workstation that is still running. Which action is MOST appropriate before shutdown or imaging?

A.Capture memory and live process information with approved response tools

B.Immediately unplug the workstation and carry it to the evidence room

C.Run a full antivirus scan to clean the machine before analysis

D.Clear the event logs so the malicious activity is easier to isolate

AnswerA

Memory and live process data exist only while the workstation runs, so capturing them with approved tools preserves volatile evidence that shutdown or imaging would destroy. This satisfies the requirement to preserve transient information before containment proceeds.

Why this answer

Transient information such as running processes, network connections, and memory-resident malware is lost when the system is powered off. Capturing memory and live process data with approved forensic tools (e.g., FTK Imager, DumpIt, or WinPmem) preserves volatile evidence critical for incident analysis and attribution, in accordance with the order of volatility (RFC 3227).

Exam trap

The trap here is that candidates may think immediate power-off preserves evidence, but it actually destroys volatile data, which is the most time-sensitive and valuable for incident response.

How to eliminate wrong answers

Option B is wrong because immediately unplugging the workstation causes a loss of volatile data (memory, network connections, running processes) and may corrupt the file system, destroying transient evidence. Option C is wrong because running a full antivirus scan modifies the system state, potentially deleting or altering malware artifacts and violating forensic integrity principles. Option D is wrong because clearing event logs destroys historical evidence of malicious activity, making it harder to reconstruct the attack timeline and violating the preservation of evidence.

Practice this question →

148

MCQmedium

A SIEM correlates VPN logs and sees the same public IP make one failed login attempt against 56 different user accounts over 25 minutes. The usernames vary, but the password value appears to be the same in each attempt. Ten minutes later, one of those accounts authenticates successfully from the same IP, and no password-reset events are recorded. Which attack pattern is most likely?

A.Password spraying against multiple accounts with a shared password guess.

B.A brute-force attack focused on a single account with repeated rapid guesses.

C.A replay attack using captured authentication traffic from a previous session.

D.Credential stuffing using known breached username and password pairs.

AnswerA

This pattern matches password spraying because the attacker tries one common password across many usernames to avoid lockouts and reduce noisy failures. The same source IP, low failure count per account, and eventual success on one account are classic clues. Analysts should treat the successful login as potentially compromised and review related authentication, MFA, and session activity immediately.

Why this answer

The SIEM logs show the same public IP attempting to authenticate with 56 different usernames using the same password. This is the hallmark of a password spraying attack, where an attacker tries a single common password against many accounts to avoid account lockout policies. The subsequent successful authentication from the same IP, without a password reset, confirms the guessed password was valid for one account.

Exam trap

The trap here is that candidates confuse password spraying with brute-force attacks, failing to recognize that the key differentiator is the single password used against multiple accounts versus multiple passwords against a single account.

How to eliminate wrong answers

Option B is wrong because a brute-force attack focuses on a single account with many rapid password guesses, not a single password against many accounts. Option C is wrong because a replay attack would reuse captured authentication tokens or hashes from a previous session, not attempt login with a plaintext password across multiple usernames.

Practice this question →

149

Multi-Selecthard

EDR reports that a workstation launched PowerShell from a word processor, created a scheduled task named WinUpdateSvc, and began making repeated HTTPS connections to a rare external domain. The user is still logged in to several cloud apps. Which two response actions are best to initiate from the EDR console? Select two.

Select 2 answers

A.Isolate the endpoint from the network to stop further communication and lateral movement.

B.Collect an EDR triage package or memory-focused artifact before powering the device off.

C.Delete the scheduled task immediately so the host returns to normal operation.

D.Reimage the workstation from the golden image as the first response.

E.Ignore the alert because the PowerShell binary is built into Windows and therefore safe.

AnswersA, B

Isolation is the fastest way to contain a compromised endpoint when the device is still active. It prevents additional command-and-control traffic, reduces the chance of lateral movement, and can be done without immediately shutting down the machine. This is the primary EDR containment action in a live incident.

Why this answer

Isolating the endpoint from the network immediately stops the active HTTPS command-and-control (C2) communication and prevents lateral movement to other systems. Given the suspicious chain (word processor spawning PowerShell, creating a scheduled task, and connecting to a rare external domain), this is a strong indicator of a malware infection or unauthorized remote access. Isolation preserves the forensic state while cutting off the attacker's access.

Exam trap

The trap here is that candidates may think deleting the scheduled task (Option C) is sufficient to remediate, but the exam emphasizes that removing artifacts without addressing the root cause is ineffective, and that isolation and forensic collection are the correct first steps in incident response.

Practice this question →

150

MCQmedium

Help desk staff must restart one Windows service and read its event logs on 150 servers, but they should not have local administrator rights or interactive logon to the systems. Which approach best supports this requirement?

A.Create one shared local administrator account for the entire help desk team.

B.Add the staff to the local Administrators group on every server.

C.Use a Just Enough Administration constrained endpoint for the allowed tasks.

D.Run the maintenance job under each technician's personal account on a schedule.

AnswerC

JEA (Just Enough Administration) is the correct technique because it lets you register a constrained PowerShell endpoint that exposes only the exact cmdlets needed — for example, Restart-Service filtered to the specific service name and Get-Content/Get-WinEvent for its log files. Users connect to the JEA endpoint and execute the permitted commands under a virtual account with just enough privilege, while full console or admin access is never granted. JEA also automatically records session transcripts, preserving an auditable trail that ties each action back to the individual technician.

Why this answer

Just Enough Administration (JEA) allows you to create constrained PowerShell endpoints that delegate specific administrative tasks—such as restarting a service and reading event logs—without granting full local administrator rights or interactive logon. By defining role capabilities that limit cmdlets and parameters, help desk staff can perform only the required operations on all 150 servers via a constrained endpoint, meeting the security requirement precisely.

Exam trap

The trap here is that candidates often assume that adding users to the local Administrators group or using a shared admin account is the simplest way to delegate tasks, overlooking that JEA provides a secure, auditable, and least-privilege alternative that specifically prevents interactive logon and limits command scope.

How to eliminate wrong answers

Option A is wrong because a shared local administrator account violates the principle of least privilege and non-repudiation, as it cannot audit individual actions and provides full administrative access. Option B is wrong because adding staff to the local Administrators group grants them interactive logon rights and unrestricted control over each server, which directly contradicts the requirement to avoid local admin rights and interactive logon. Option D is wrong because running maintenance jobs under each technician's personal account on a schedule does not prevent interactive logon or grant administrative rights, but it fails to provide the on-demand, constrained access needed for ad-hoc restarts and log reading, and it introduces scheduling complexity without addressing the delegation requirement.

Practice this question →