CCNA Security Operations Questions — Page 3 of 4

151

MCQmedium

After seizing a suspected insider's laptop, a responder makes a bit-for-bit image of the drive. The legal team asks what step most directly proves the image was not altered after acquisition. What should be done?

A.Record the laptop's hostname and the user who last logged in.

B.Compute and document cryptographic hashes of the source media and the forensic image.

C.Copy the most recent files to a USB drive for quick review.

D.Return the laptop to the user once the image is saved.

AnswerB

Compute and document cryptographic hashes of both the source media and the forensic image using a collision-resistant algorithm like SHA-256. The hash generated from the source device and the hash of the acquired image must match exactly, providing strong evidence that no data was altered, added, or lost. This integrity check is a foundational practice in forensic imaging and is necessary to demonstrate the evidence is authentic and admissible in court.

Why this answer

Computing and documenting cryptographic hashes (e.g., SHA-256 or MD5) of both the source media and the forensic image immediately after acquisition creates a verifiable digital fingerprint. If the hash values match, it proves that the image is an exact, unaltered copy of the original drive. This step is foundational to maintaining the chain of custody and ensuring data integrity in forensic investigations.

Exam trap

The trap here is that candidates may confuse documentation steps (like recording hostnames) with integrity verification, or think that copying files to a USB drive is a valid forensic preservation method, when only cryptographic hashing provides mathematical proof of non-alteration.

How to eliminate wrong answers

Option A is wrong because recording the hostname and last logged-in user is part of documentation but does not provide any cryptographic verification that the image was not altered after acquisition. Option C is wrong because copying the most recent files to a USB drive for quick review introduces a separate copy that is not a bit-for-bit duplicate and does not prove the integrity of the original forensic image. Option D is wrong because returning the laptop to the user after imaging violates chain of custody and could allow tampering with the original evidence, but it does not directly prove the image was unaltered.

Practice this question →

152

MCQmedium

A SOC analyst receives an alert from the VPN appliance and identity platform. In the last 10 minutes, a user account had 14 failed VPN logons from one country, then one successful login from a different country. The user calls the help desk and says they have not used their account today. What should the analyst do first?

A.Block the foreign IP address at the firewall and wait for more alerts before acting.

B.Disable the user account and revoke active sessions or tokens while escalating the event as a suspected account compromise.

C.Reset the user password and close the alert because the new password will stop the attack.

D.Reimage the user’s laptop immediately to remove any possible malware before taking other steps.

AnswerB

The successful login after repeated failures, combined with the user’s confirmation that they were not active, strongly suggests compromise. The fastest effective containment is to disable the account and invalidate existing sessions or tokens so the attacker cannot continue using stolen credentials. This preserves the ability to investigate while stopping ongoing access. It is a stronger first action than a password reset alone, which may leave active tokens usable.

Why this answer

The combination of multiple failed logins from one country followed by a successful login from a different country, combined with the user's denial of activity, is a classic indicator of account compromise (e.g., credential stuffing or token theft). Disabling the account and revoking active sessions/tokens immediately stops the attacker's access, preventing further lateral movement or data exfiltration, while escalation ensures proper incident response. This aligns with the CompTIA incident response process: identification, containment, eradication, and recovery.

Exam trap

The trap here is that candidates may think resetting the password (Option C) is sufficient, but they overlook that active sessions and tokens must be explicitly revoked to fully contain the compromise, as per CompTIA's emphasis on session management in incident response.

How to eliminate wrong answers

Option A is wrong because blocking the foreign IP address alone is insufficient—the attacker may use multiple IPs or proxies, and waiting for more alerts delays containment, allowing the attacker to continue malicious activity. Option C is wrong because resetting the password without revoking active sessions or tokens leaves existing authenticated sessions intact; the attacker could still use a stolen session token or OAuth refresh token to maintain access. Option D is wrong because reimaging the laptop is premature and unnecessary—the compromise is likely credential-based, not malware-based, and the user's laptop may not be involved; this wastes time and resources before proper investigation.

Practice this question →

153

MCQmedium

A user reports that a shared department drive is rapidly renaming files and creating ransom notes on a Windows file server. The SOC confirms suspicious activity is still occurring on that server. What should the incident responder do first?

A.Shut down the server immediately to stop all malicious activity.

B.Isolate the server from the network while keeping it powered on if possible.

C.Restore the drive from backup before collecting any evidence.

D.Inform users to continue working until the forensic team arrives.

AnswerB

Active ransomware on a file server demands immediate containment. Isolating the server from the network halts lateral spread and further encryption, while keeping it powered on preserves volatile memory and running processes for forensic analysis.

Why this answer

The immediate priority is to contain the ransomware outbreak by isolating the server from the network, which stops the malicious activity from spreading to other systems while preserving volatile evidence (e.g., running processes, memory contents) for forensic analysis. Powering off the server (Option A) would destroy this critical evidence and may not stop the encryption process if it is already in memory. Isolation via network disconnection (e.g., disabling the NIC or unplugging the cable) is the standard first step in incident response for active ransomware.

Exam trap

The trap here is that candidates assume immediate shutdown (Option A) is the safest action, but CompTIA emphasizes containment without destroying evidence, making network isolation the correct first step in active ransomware incidents.

How to eliminate wrong answers

Option A is wrong because shutting down the server immediately destroys volatile evidence (e.g., memory-resident malware, active network connections) and may allow the ransomware to complete encryption on disk before the OS halts. Option C is wrong because restoring from backup before collecting evidence can overwrite forensic artifacts and may reintroduce the vulnerability if the root cause is not identified. Option D is wrong because informing users to continue working risks further data loss and lateral movement of the ransomware across the network.

Practice this question →

154

Matchingmedium

Match each security monitoring artifact from the SOC alert queue to the best investigation focus.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Investigate possible script-based malware execution launched through a document

Check for suspicious domain lookups that may indicate command-and-control activity

Look for beaconing behavior from a potentially compromised endpoint

Assess for stolen credentials or credential-stuffing activity

Why these pairings

Each alert type suggests a specific investigation focus: phishing requires email analysis; malware needs file/behavior analysis; brute force focuses on auth logs; data exfiltration looks at outbound traffic; privileged misuse examines user activity; ransomware involves encryption events.

Practice this question →

155

Multi-Selecteasy

A SOC analyst reviews one user account and sees several failed logins from a single IP, then a successful login from the same IP, followed by a new inbox forwarding rule to an external address. Which two findings most strongly suggest account compromise? Select two.

Select 2 answers

A.Repeated failed logins followed by a successful login from the same source IP.

B.The user authenticated during normal business hours.

C.A new inbox forwarding rule sends mail to an external address.

D.The user accessed email from a corporate laptop.

E.The password age is 89 days.

AnswersA, C

Multiple failed attempts from the same source IP indicate a systematic credential attack rather than an accidental lockout. When a successful authentication follows immediately after, it strongly suggests the attacker eventually guessed or sprayed a valid password. This is a classic signature of brute-force or password-spraying and is a high-fidelity indicator of an account compromise.

Why this answer

A brute-force attack pattern—multiple failed logins followed by a successful authentication from the same external IP—strongly indicates credential compromise. This sequence suggests the attacker guessed or obtained the password and then successfully logged in. The single source IP ties the failed attempts to the eventual successful session, making it a classic indicator of account takeover.

Exam trap

The SY0-701 exam often tests the concept that a single successful login after failures is not enough—candidates must recognize that the forwarding rule is the second critical indicator, not the timing of the login.

Practice this question →

156

MCQhard

Based on the exhibit, what is the most important next IR action?

A.Change the password again and monitor the mailbox for a few days.

B.Revoke active sessions and OAuth consent grants for the account.

C.Restore the deleted inbox rule from backup to preserve evidence.

D.Close the incident because the forwarding rule was removed.

AnswerB

The password has already been changed and the inbox rule removed, but the audit trail shows an OAuth consent grant and a refresh token issued from an unfamiliar IP. Those tokens can continue to authorize access even after a password reset. Revoking active sessions and removing the malicious consent closes the persistent access path.

Why this answer

The exhibit shows a compromised account with a suspicious inbox rule forwarding emails externally. The most critical next step is to revoke active sessions and OAuth consent grants to immediately terminate the attacker's access and prevent further data exfiltration, as changing the password alone does not invalidate existing OAuth tokens or active sessions.

Exam trap

The trap here is that candidates assume changing the password is sufficient to stop an attacker, but they overlook that OAuth tokens and active sessions persist independently of password changes, allowing continued unauthorized access.

How to eliminate wrong answers

Option A is wrong because changing the password again does not revoke existing OAuth tokens or active sessions, so the attacker could maintain access via cached credentials or token-based authentication. Option C is wrong because restoring the deleted inbox rule from backup is not the most important next action; preserving evidence is secondary to stopping active compromise, and the rule may have already been removed by the attacker. Option D is wrong because closing the incident after removing the forwarding rule ignores the fact that the attacker still has active sessions and OAuth grants, leaving the account vulnerable to further abuse.

Practice this question →

157

MCQmedium

A security analyst notices a sudden increase in outbound traffic from a database server that normally only communicates with internal application servers. The server is running a standard OS with no recent changes. Which of the following actions should the analyst take FIRST to determine if the server is compromised?

A.Run a full antivirus scan on the server.

B.Check the server's running processes for unknown executables.

C.Block all outbound traffic from the server at the firewall.

D.Review the server's event logs for failed login attempts.

AnswerB

Inspecting the server's active process list is the most direct method to correlate the anomalous outbound traffic with a specific executable. Tools like `ps`, Task Manager, or `netstat -bno` can reveal a process's PID and its established remote connections, often immediately exposing an unknown or masquerading binary. This step provides high-fidelity, real-time evidence before more invasive or slower actions, making it the appropriate incident-response triage action.

Why this answer

Checking the server's running processes for unknown executables is the first and most direct step to identify if an attacker has established a foothold. A sudden outbound traffic spike without recent configuration changes strongly suggests a malicious process (e.g., a reverse shell or data exfiltration tool) is running. Examining running processes allows the analyst to spot suspicious executables or command-line arguments before taking more disruptive actions like blocking traffic or running a scan.

Exam trap

The trap here is that candidates often jump to blocking traffic (Option C) as a quick fix, but the FIRST action must be to gather evidence by inspecting running processes, as blocking prematurely destroys forensic data and violates the principle of 'do no harm' during incident response.

Why the other options are wrong

Running a full antivirus scan is time-consuming and may not detect sophisticated or custom malware. The immediate priority is to identify suspicious processes causing the unusual outbound traffic, which is faster and more direct.

Blocking all outbound traffic at the firewall would disrupt legitimate internal communications and is a reactive containment step, not a first investigative action to determine compromise.

Reviewing event logs for failed login attempts is a secondary step; the immediate priority is to identify active malicious processes causing the outbound traffic spike, not historical authentication events.

Practice this question →

158

MCQmedium

A security analyst is reviewing network flow logs and notices a series of outbound connections from a single internal workstation to an external IP address on TCP port 443. The connections occur every 5 minutes, each lasting about 2 seconds, and the amount of data transferred per connection is consistently around 1 KB. The workstation's user reports no unusual activity. The analyst checks the host's EDR logs and sees no malicious processes or known indicators. Which type of activity is this pattern most consistent with?

A.Beaconing to a command-and-control server

B.Normal software update check

C.DNS tunneling

D.Data exfiltration via HTTPS

AnswerA

Beaconing to a command-and-control server is the correct classification. This pattern is hallmarks of malware that maintains a C2 channel by sending periodic 'heartbeat' messages at fixed intervals with minimal payloads. The consistent 5-minute cadence and ~1 KB data transfer per connection are classic indicators of a beaconing protocol, designed to evade detection by blending in with low-volume background traffic while ensuring the compromised host remains controllable. Such regularity is atypical for legitimate software, which usually introduces jitter or variable sizes, and the tiny payload is insufficient for meaningful data exfiltration, making C2 beaconing the most probable explanation.

Why this answer

This pattern is most consistent with beaconing to a command-and-control (C2) server because the connections are periodic (every 5 minutes), short-lived (2 seconds), and consistently transfer a small amount of data (~1 KB) over HTTPS (TCP 443). These characteristics—regular intervals, low data volume, and stealthy use of encrypted channels—are hallmarks of C2 beaconing used by malware to maintain persistence and receive instructions without raising immediate suspicion.

Exam trap

The trap here is that candidates confuse periodic HTTPS connections with normal software updates, but the key differentiator is the extremely consistent timing and tiny data size—updates are rarely this regular or this small, while C2 beaconing is designed to be minimal and predictable to evade detection.

Why the other options are wrong

Normal software update checks typically occur less frequently (e.g., daily) and transfer more data (e.g., several MB) for downloading patches, not 1 KB every 5 minutes. The consistent, short-duration connections suggest a heartbeat mechanism, not a routine update.

DNS tunneling typically uses DNS queries (UDP 53) or occasionally TCP 53, not TCP 443, and involves larger or irregular data patterns, not small, periodic HTTPS connections.

Data exfiltration via HTTPS would typically involve larger data transfers (e.g., megabytes) and longer connection durations, not the small, consistent 1 KB every 5 minutes seen here.

Practice this question →

159

MCQeasy

Based on the exhibit, what should the team do next to confirm the backups can actually be used during an outage?

A.Increase the retention period before making any restore attempts.

B.Perform a test restore to a nonproduction location and verify the recovered files.

C.Delete older backup sets so the backup window is shorter.

D.Convert the backups to full backups only so the status report is simpler.

AnswerB

A test restore is the best way to validate that backups are usable during recovery. Successful backup jobs alone do not guarantee that data can be restored quickly, completely, or without corruption. Restoring to a nonproduction location confirms the files open correctly and helps the team measure recovery readiness before an actual incident.

Why this answer

The only way to confirm that backups are usable during an outage is to perform a test restore to a nonproduction location and verify the recovered files. This validates the integrity of the backup data, the restore process, and that the files are complete and functional, which is a core principle of backup validation (often called a 'restore test' or 'disaster recovery drill'). Simply reviewing backup status reports or increasing retention does not prove that the data can be successfully restored.

Exam trap

The trap here is that candidates often assume a successful backup job (green status) guarantees recoverability, but the exam tests the distinction between backup completion and restore validation—CompTIA often tests this by making 'increase retention' or 'simplify backup type' seem like proactive steps, when only a test restore confirms usability.

How to eliminate wrong answers

Option A is wrong because increasing the retention period only keeps more historical copies of backups; it does not test whether those backups are actually restorable or contain valid data. Option C is wrong because deleting older backup sets to shorten the backup window does not validate the usability of the remaining backups and may actually reduce recovery point objectives (RPO) unnecessarily. Option D is wrong because converting to full backups only simplifies the status report but does not test the restore process; full backups can still be corrupt or incomplete without a restore verification.

Practice this question →

160

MCQmedium

A SOC analyst receives an alert that a domain admin account authenticated to a file server at 02:14 from a jump host that is normally used only by the infrastructure team. The Windows logs also show a scheduled task launching a backup script at the same time, and the backup team says the task was created during yesterday's change window. What is the best next step to determine whether this is a false positive?

A.Disable the domain admin account immediately and wait for the backup team to respond.

B.Correlate the authentication event with the change ticket and the scheduled task details.

C.Escalate the alert as confirmed compromise because the login occurred after hours.

D.Delete the scheduled task so it cannot be used again.

AnswerB

Correlating the authentication event with the change ticket and scheduled task details is the foundational verification step. Because scheduled tasks run under specific security principals, a match between the login time, source, and the task's execution window provides strong evidence that the activity was expected and legitimate. This approach reduces false positives while preserving any potentially malicious evidence for later analysis. It distinguishes an authorized administrative workflow from an attacker's authentication attempt, enabling an informed risk-based decision.

Why this answer

The alert involves a domain admin authentication from a jump host at an unusual time, but the scheduled task was created during a change window. Correlating the authentication event with the change ticket and the scheduled task details allows the SOC analyst to verify if the activity was authorized, preventing unnecessary incident response. This step aligns with the incident response process of validating alerts before taking action.

Exam trap

The trap here is that candidates assume any after-hours admin login is malicious, but the scheduled task created during a change window provides a legitimate explanation that must be verified through correlation.

How to eliminate wrong answers

Option A is wrong because disabling the domain admin account immediately without investigation could disrupt legitimate operations and is premature; the activity may be authorized. Option C is wrong because escalating as a confirmed compromise based solely on after-hours login ignores the possibility of scheduled maintenance or authorized changes, leading to false positives. Option D is wrong because deleting the scheduled task destroys evidence and could break legitimate business processes; the task should be analyzed, not removed.

Practice this question →

161

MCQeasy

After a workstation hardening baseline is updated, the security team wants to confirm that finance laptops actually match the new settings. Which control is the best way to verify this?

A.Run a configuration compliance scan against the updated baseline

B.Ask users whether they think their laptops are secure

C.Assume the baseline was applied because the change ticket was approved

D.Delete the old baseline so there is only one policy to reference

AnswerA

A configuration compliance scan is the definitive verification method because it programmatically compares each endpoint's actual registry keys, service states, group policy settings, and installed software against the approved hardening baseline. This identifies even minor deviations such as a disabled firewall rule or an outdated patch level, giving security teams concrete evidence of compliance or drift. Unlike subjective assessments, a scan produces reproducible, auditable results that directly reflect whether the updated baseline was successfully deployed.

Why this answer

A configuration compliance scan compares the current settings of the finance laptops against the updated hardening baseline. This automated process checks specific registry keys, file permissions, service states, and security policy settings (e.g., via SCAP or CIS benchmarks) to verify alignment. It provides objective, measurable evidence of compliance, unlike subjective user feedback or assumptions.

Exam trap

The trap here is that candidates may confuse change management approval (Option C) with actual technical verification, overlooking the need for a direct compliance check to confirm implementation.

How to eliminate wrong answers

Option B is wrong because asking users whether they think their laptops are secure relies on subjective opinion and lacks technical verification; users cannot accurately assess registry settings, service configurations, or Group Policy objects. Option C is wrong because assuming the baseline was applied based solely on an approved change ticket ignores the possibility of failed deployments, manual overrides, or configuration drift; change management does not guarantee technical enforcement. Option D is wrong because deleting the old baseline does not verify that the new settings are actually applied; it only removes a reference point, leaving no way to measure compliance or detect deviations.

Practice this question →

162

MCQmedium

A company is placing a customer-facing web application behind a new security control. The team wants to block malicious HTTP requests such as injection attempts before they reach the application server, with minimal code changes to the app itself. Which control is the best fit?

A.Network access control (NAC) at the switch port.

B.Web application firewall (WAF) in front of the application.

C.Data loss prevention (DLP) on the email gateway.

D.Endpoint detection and response (EDR) on the web server only.

AnswerB

A web application firewall (WAF) is purpose-built to protect web applications by inspecting HTTP/HTTPS traffic at the application layer and filtering malicious requests using signature-based and behavioral rules. It understands web protocols, allowing it to block common exploits such as SQL injection, cross-site scripting (XSS), and CSRF without requiring changes to application code. Deploying a WAF inline in front of the application provides real-time, proactive filtering of inbound requests before they reach the server, making it the correct control for this scenario.

Why this answer

A web application firewall (WAF) is specifically designed to inspect and filter HTTP/HTTPS traffic at the application layer (Layer 7), blocking malicious payloads such as SQL injection and cross-site scripting (XSS) before they reach the web server. It operates without requiring changes to the application code, making it the ideal choice for this scenario.

Exam trap

The trap here is that candidates may confuse a WAF with a network firewall or NAC, thinking any 'security control' placed in front of a server can block application-layer attacks, but only a WAF operates at Layer 7 with HTTP-specific inspection capabilities.

How to eliminate wrong answers

Option A is wrong because Network Access Control (NAC) operates at Layer 2/3 to enforce access policies based on device posture or authentication at the switch port, and it cannot inspect or block application-layer HTTP attacks like injection attempts. Option C is wrong because Data Loss Prevention (DLP) on the email gateway is designed to monitor and prevent exfiltration of sensitive data in email traffic, not to filter malicious HTTP requests targeting a web application. Option D is wrong because Endpoint Detection and Response (EDR) on the web server only detects and responds to threats at the host level after they have reached the server, whereas the requirement is to block attacks before they reach the application server with minimal code changes.

Practice this question →

163

MCQmedium

An employee reports a ransomware note on a file server. The server is still powered on, shares are still being accessed, and management wants service restored as quickly as possible. What should the incident response team do first?

A.Power off the server immediately to stop all attacker activity

B.Isolate the server from the network while keeping it powered on

C.Start restoring from backup before collecting any logs or memory data

D.Delete the ransomware note and suspicious files to reduce business disruption

AnswerB

Network isolation, such as unplugging the cable or applying a host-based firewall rule, halts the ransomware's ability to encrypt additional shares and disrupts command-and-control channels, effectively containing the blast radius. Keeping the server powered preserves memory-resident data, including the malicious process, open handles, and potential encryption keys, which can be harvested via a memory dump for attribution and recovery. This approach balances incident containment with evidence preservation, and should be executed in a way that doesn't delete or alter on-disk artifacts.

Why this answer

The correct first step is to isolate the server from the network while keeping it powered on. This preserves volatile evidence (e.g., memory, running processes, network connections) that is critical for forensic analysis and understanding the ransomware's entry vector. Powering off would destroy this data, and restoring from backup prematurely could reintroduce the infection or miss evidence needed to prevent recurrence.

Exam trap

The trap here is that candidates often assume immediate power-off is the safest containment action, but CompTIA emphasizes preserving volatile evidence first, as powering off destroys critical forensic data that may be needed for decryption or attribution.

How to eliminate wrong answers

Option A is wrong because powering off the server immediately destroys volatile data in RAM (e.g., encryption keys, active network connections, process artifacts) that are essential for forensic analysis and may be needed to decrypt files or identify the ransomware variant. Option C is wrong because restoring from backup before collecting logs or memory data risks restoring an infected state or missing evidence that could reveal how the ransomware entered, allowing it to strike again.

Practice this question →

164

MCQmedium

A security analyst receives an alert from the intrusion detection system (IDS) indicating a high volume of outbound traffic from a single internal workstation to an external IP address known to be associated with a command-and-control (C2) server. The workstation's user reports no unusual activity. Which of the following should the analyst do FIRST?

A.Disconnect the workstation from the network.

B.Run a full antivirus scan on the workstation.

C.Review firewall logs to see if the traffic is being blocked.

D.Inform the user to shut down the workstation.

AnswerA

Disconnecting the workstation from the network is the immediate containment action because it severs the active command-and-control channel, preventing data exfiltration and halting any further lateral movement. Unlike shutting down, this preserves volatile evidence such as running processes, open network connections, and memory-resident malware, which are critical for forensic analysis and determining the full scope of the compromise.

Why this answer

The IDS alert indicates a high volume of outbound traffic to a known C2 server, which strongly suggests the workstation is compromised and communicating with an attacker. Disconnecting the workstation from the network (Option A) is the immediate containment step to prevent data exfiltration and further C2 communication, following the NIST incident response framework's containment phase. This action stops the threat at the network layer without waiting for additional analysis.

Exam trap

CompTIA often tests the principle that containment (disconnecting the network) must precede eradication (antivirus scan) or analysis (log review), and the trap here is that candidates choose a less disruptive step like running a scan or checking logs, thinking they need more data before acting.

Why the other options are wrong

Running a full antivirus scan is a secondary step after containing the threat; the immediate priority is to stop potential data exfiltration or further C2 communication by disconnecting the workstation from the network.

Reviewing firewall logs to see if traffic is being blocked is a secondary step; the immediate priority is to contain the potential compromise by disconnecting the workstation from the network to prevent further C2 communication.

In this scenario, the priority is to contain the potential compromise immediately by disconnecting the workstation from the network. Instructing the user to shut down the workstation could destroy volatile evidence (e.g., memory contents) and does not prevent the C2 traffic from continuing during the shutdown process.

Practice this question →

165

MCQmedium

A SOC analyst receives an EDR alert showing a finance laptop creating encrypted archives and then attempting SMB connections to several internal file shares. The user is still logged in, and the business wants to stop possible spread without destroying volatile evidence. What should the analyst do first?

A.Power off the laptop immediately to stop all activity.

B.Isolate the endpoint from the network using the EDR containment feature.

C.Reimage the laptop from a gold image as soon as possible.

D.Disable the user account in Active Directory and wait for the malware to stop.

AnswerB

EDR network containment severs the host's connections while leaving the machine running, halting lateral SMB spread to file shares and preserving volatile memory, running processes and logged-on session state. That satisfies both the stop-spread and evidence-preservation constraints before any remediation.

Why this answer

The EDR containment feature isolates the endpoint from the network while preserving all running processes, memory, and disk state. This stops the encrypted archives from being exfiltrated via SMB and prevents lateral movement, but keeps volatile evidence (e.g., active malware processes, network connections) intact for forensic analysis.

Exam trap

The trap here is that candidates confuse 'stopping the spread' with 'destroying evidence,' and choose power-off or reimage, failing to recognize that containment in EDR is designed specifically to halt network propagation while preserving forensic data.

How to eliminate wrong answers

Option A is wrong because powering off the laptop destroys volatile evidence (e.g., memory-resident malware, active network connections, encryption keys in RAM) and may trigger anti-forensic mechanisms. Option C is wrong because reimaging wipes all data, including critical forensic artifacts like the encrypted archives, malware binaries, and registry changes, making incident response impossible. Option D is wrong because disabling the user account does not stop the malware already running on the laptop from continuing its SMB connections and encryption activity, as the process operates with the user's cached credentials or tokens.

Practice this question →

166

Multi-Selectmedium

A company is implementing controls to protect against insider threats. Which three of the following controls are most effective for detecting and preventing data exfiltration by a malicious insider? (Choose three.)

Select 3 answers

.Deploying Data Loss Prevention (DLP) solutions to monitor and block sensitive data leaving via email or USB

.Implementing user behavior analytics (UBA) to flag unusual access patterns or large downloads

.Enforcing strict role-based access controls (RBAC) with the principle of least privilege

.Requiring all employees to use complex passwords changed every 30 days

.Installing antivirus software on all endpoints

.Conducting annual security awareness training for all staff

Why this answer

Data Loss Prevention (DLP) solutions are effective because they can inspect content in real time, blocking sensitive data from being sent via email, copied to USB, or uploaded to cloud services. User Behavior Analytics (UBA) detects anomalies such as a user downloading thousands of records at 3 AM, which is a strong indicator of malicious intent. Role-Based Access Control (RBAC) with least privilege limits the data a user can access, reducing the attack surface and making exfiltration harder even if credentials are compromised.

Exam trap

The trap here is that candidates often confuse general security controls (like password policies or antivirus) with controls specifically designed to detect or prevent data exfiltration, leading them to select options that are good security practices but irrelevant to the scenario.

Practice this question →

167

MCQmedium

An email attachment from an external supplier is not blocked by signature-based AV, but the SOC wants to see whether it drops files, launches child processes, or contacts suspicious domains before delivery to users. Which control best fits?

A.Network IDS, because it passively monitors traffic for known threats.

B.Sandboxing, because it detonates the file in an isolated environment.

C.DLP, because it prevents sensitive data from leaving the organization.

D.NAC, because it controls whether a device can join the network.

AnswerB

Sandboxing detonates the suspicious attachment in a contained virtual machine or emulated operating system with instrumentation that records file drops, registry and process modifications, and outbound callbacks. By observing actual runtime behavior, it can reveal malicious intent even if no signature exists, while isolating any payload from production resources. It is therefore the correct control for inspecting a supplier attachment that an external email filter does not block.

Why this answer

Sandboxing is the correct control because it detonates the file in an isolated, virtualized environment to observe its runtime behavior, such as dropping files, spawning child processes, or making outbound connections to suspicious domains. This goes beyond signature-based AV by analyzing dynamic behavior rather than static file hashes or patterns. The SOC's goal is to assess the file's actions before delivery, which sandboxing directly addresses.

Exam trap

The trap here is that candidates confuse passive monitoring (IDS) with active behavioral analysis (sandboxing), assuming IDS can detect unknown threats by watching traffic, but IDS lacks the ability to execute and observe the file's runtime actions in an isolated environment.

How to eliminate wrong answers

Option A is wrong because Network IDS passively monitors traffic for known threat signatures but cannot detonate or analyze the behavior of an email attachment in isolation; it would only alert on network-level indicators after the file is executed. Option C is wrong because DLP (Data Loss Prevention) focuses on preventing sensitive data from leaving the organization via monitoring content in transit or at rest, not on analyzing file behavior or detecting malicious actions like dropping files or contacting domains. Option D is wrong because NAC (Network Access Control) enforces policies on device compliance and network admission, such as checking for up-to-date antivirus or patch levels, and has no capability to execute or analyze email attachments for behavioral threats.

Practice this question →

168

MCQeasy

Based on the exhibit, what should the analyst do before opening the forensic image for examination?

A.Mount the image read-write so the analyst can begin searching immediately.

B.Calculate and compare the image hash to the source hash before analysis.

C.Defragment the original SSD so the files will be easier to search later.

D.Compress the image into a ZIP file to reduce storage usage before verifying it.

AnswerB

Hash verification confirms that the forensic image matches the original drive and has not changed during transfer or storage. This is a key evidence-handling step because it supports integrity and admissibility. The analyst should document the result in the case notes and chain of custody before examining the contents.

Why this answer

Before examining a forensic image, the analyst must verify its integrity by calculating its hash (e.g., MD5, SHA-1, SHA-256) and comparing it to the known hash of the original source. This ensures the image is an exact, unaltered copy, which is critical for maintaining the chain of custody and admissibility of evidence. Option B is correct because hash verification is the foundational step in forensic analysis.

Exam trap

The trap here is that candidates may think mounting the image immediately is efficient, but they overlook the critical integrity check required before any analysis to ensure the evidence is unaltered.

How to eliminate wrong answers

Option A is wrong because mounting the image read-write would allow writes to the image, altering its data and breaking the chain of custody; forensic images must always be mounted read-only. Option C is wrong because defragmenting the original SSD would modify the source data, destroying evidence and violating forensic best practices; analysis is performed on the image, not the original drive. Option D is wrong because compressing the image into a ZIP file before verifying its hash would change the file's hash, making it impossible to verify integrity against the source; verification must occur on the uncompressed image.

Practice this question →

169

MCQmedium

A security analyst observes a critical server generating unusually high outbound traffic to an external IP address that is listed on a threat intelligence feed as a known command-and-control server. The analyst suspects the server is compromised. According to standard incident response procedures, what should the analyst do NEXT?

A.Reboot the server to clear any malicious processes from memory

B.Isolate the server from the network to stop the communication

C.Apply the latest security patches to the server

D.Ignore the alert because the external IP might be a false positive

AnswerB

Containment is the immediate priority in incident response. Isolating the server — by disabling the switch port, unplugging the network cable, or enforcing a host-based firewall rule — cuts off the established C2 channel, halts data exfiltration in progress, and prevents the attacker from pivoting laterally or issuing additional commands. This action preserves volatile evidence (memory, active connections, running processes) for forensic acquisition, unlike destructive measures such as rebooting, and aligns with the NIST SP 800-61 containment strategy, ensuring the threat is neutralized before any eradication or recovery steps are taken.

Why this answer

Isolating the server from the network immediately stops the outbound command-and-control (C2) communication, preventing data exfiltration and further compromise. This aligns with the first step in the NIST SP 800-61 incident response process—containment—before any eradication or recovery actions are taken. Rebooting or patching without isolation could destroy volatile evidence (e.g., memory-resident malware) and allow the attacker to persist or escalate.

Exam trap

The trap here is that candidates confuse the containment phase with eradication or recovery, choosing to reboot or patch immediately instead of isolating the system to stop the active threat and preserve evidence.

Why the other options are wrong

Rebooting the server may temporarily disrupt malicious processes, but it does not stop the ongoing command-and-control communication and could destroy forensic evidence. The immediate priority is to contain the threat by isolating the server from the network.

Applying patches is a remediation step that should occur after containment; the immediate priority is to stop the active C2 communication by isolating the server.

Ignoring the alert based on a potential false positive is inappropriate because the traffic matches a known C2 indicator, and the high outbound volume suggests active compromise. Incident response requires immediate action to contain the threat.

Practice this question →

170

MCQmedium

A security analyst is monitoring logs from the cloud access security broker (CASB) and observes that a user account downloaded 500 GB of data from a highly sensitive SharePoint document library within a single hour. The user's historical baseline shows an average daily download of less than 10 MB. Additionally, the log shows the session originated from an IP address in a country where the company has no employees or business operations. Which of the following actions is the most appropriate for the analyst to take?

A.Immediately block the user account and the source IP address at the CASB.

B.Contact the user directly by phone to verify whether they initiated the download.

C.Initiate the organization's incident response process for a potential data exfiltration event.

D.Disable the SharePoint document library and remove all user permissions to prevent further data loss.

AnswerC

Correct. The combination of anomalous data volume and unusual geolocation strongly suggests a security incident. The analyst should follow the incident response plan, which typically includes preserving logs, engaging the incident response team, and escalating per policy.

Why this answer

The combination of a massive data download (500 GB vs. a 10 MB baseline) and a session originating from a country with no business presence strongly indicates a potential data exfiltration event. Initiating the incident response process ensures that the organization follows a structured, documented procedure to contain, analyze, and remediate the threat, preserving forensic evidence and coordinating response actions. The CASB log provides the initial indicators, but the incident response plan is the appropriate framework for handling such high-risk anomalies.

Exam trap

The trap here is that candidates may choose to immediately block or contact the user, failing to recognize that the incident response process is the systematic, first-step action for potential data exfiltration, as it balances containment with forensic preservation and legal considerations.

Why the other options are wrong

Immediately blocking the user and IP without investigation could destroy evidence and alert a potential attacker, hindering forensic analysis. The analyst should first initiate the incident response process to contain and investigate properly.

The indicators (500 GB download vs. 10 MB baseline, foreign IP) strongly suggest a security incident, not a benign anomaly. Contacting the user first could waste critical time and alert a potential attacker, violating incident response best practices.

Disabling the SharePoint library and removing permissions is too drastic and disruptive; it could halt legitimate business operations and does not follow a proper incident response procedure. The analyst should first initiate the incident response process to investigate and contain the threat methodically.

Practice this question →

171

MCQmedium

After hours, EDR alerts show a finance laptop encrypting local files and trying SMB connections to nearby workstations. The user is still logged in, and management wants the fastest step that limits spread while preserving evidence. What should the SOC do first?

A.Shut down the laptop immediately to stop any further activity.

B.Use EDR to isolate the laptop from the network.

C.Run a full antivirus scan before making any network changes.

D.Reimage the laptop right away from a standard corporate image.

AnswerB

EDR-based isolation is the correct first move because it enforces a logical network quarantine at the host, blocking outbound SMB, RDP, and other propagation paths while keeping the system powered on. This preserves volatile memory for acquisition, prevents the malware from completing encryption over mapped drives, and allows the incident responder to collect IOCs and determine scope without alerting the attacker. EDR isolation is reversible and granular, so it is preferred over physical disconnection.

Why this answer

EDR isolation immediately blocks all network communication (including SMB) while preserving the endpoint's state for forensic analysis. This stops lateral movement and further encryption without losing volatile data like memory or running processes, which a shutdown would destroy.

Exam trap

The trap here is that candidates confuse 'stopping the activity' with 'shutting down,' not realizing that isolation halts network propagation without destroying the evidence needed for root-cause analysis.

How to eliminate wrong answers

Option A is wrong because shutting down the laptop destroys volatile evidence (e.g., memory-resident malware, encryption keys, active network connections) and may trigger anti-forensic routines. Option C is wrong because running a full antivirus scan while the system is still on the network allows the ransomware to continue encrypting files and spreading via SMB, and scans can be evaded by modern malware. Option D is wrong because reimaging wipes all evidence of the attack, including the ransomware binary, logs, and artifacts needed for incident response and attribution.

Practice this question →

172

MCQmedium

Following a ransomware incident, management wants to verify that backups are usable and that a restored file server will meet recovery expectations before declaring the system trusted again. Which action is best?

A.Review the backup job logs and mark the backups as valid.

B.Perform a documented restore test in an isolated environment and validate the recovered data.

C.Increase the retention period so more restore points are available later.

D.Create a new full backup immediately after the incident and trust that one instead.

AnswerB

A documented restore test in an isolated environment is the definitive verification because it actually exercises the recovery process from the backup media to a fully functional state, proving the data can be recovered and used. Isolating the environment prevents any latent ransomware from spreading into the production network, while validating the recovered data ensures files are uncorrupted and services meet continuity requirements. This aligns with the 3-2-1 rule's recovery objective and provides the evidence management needs.

Why this answer

Performing a documented restore test in an isolated environment is the only action that directly validates the integrity and usability of backups, ensuring the restored file server meets recovery point objective (RPO) and recovery time objective (RTO) expectations. This process verifies that the backup data is not corrupted, encrypted, or incomplete, which is critical after a ransomware incident where backups may have been targeted. Without such a test, management cannot confidently declare the system trusted, as logs or retention changes do not prove data recoverability.

Exam trap

The trap here is that candidates assume backup logs or increased retention are sufficient to prove recoverability, but CompTIA emphasizes that only a documented restore test in an isolated environment provides the empirical evidence needed to declare a system trusted after a security incident.

How to eliminate wrong answers

Option A is wrong because reviewing backup job logs only confirms that the backup process completed without errors, but it does not verify that the actual data is usable, free from ransomware encryption, or restorable to a functional state. Option C is wrong because increasing the retention period merely preserves more restore points for future use, but it does not validate the current backups' integrity or usability, and it may retain compromised backups. Option D is wrong because creating a new full backup immediately after the incident does not guarantee that the backup is free from malware or that the restored system will meet recovery expectations; it only provides a fresh copy without validation.

Practice this question →

173

MCQmedium

A SOC analyst detects that a user's workstation is sending large volumes of data to an unusual external IP address during non-business hours. The analyst has already isolated the workstation by disconnecting it from the network. What is the NEXT step in the incident response process?

A.Reimage the workstation to remove any malware

B.Perform a forensic analysis of the workstation to collect evidence

C.Reset the user's password to prevent further unauthorized access

D.Notify law enforcement immediately

AnswerB

After containment, performing forensic analysis on the workstation is the correct next step because it preserves volatile data (memory, network connections, running processes) and non-volatile evidence (logs, files, registry) in a forensically sound manner. This process establishes a chain of custody and enables investigators to identify the malware, infection vector, and scope of the exfiltration, which is essential for informed remediation and potential legal action.

Why this answer

After isolating the workstation, the next step in the incident response process is to perform forensic analysis to collect evidence. This aligns with the NIST SP 800-61 framework, where containment (isolation) is followed by eradication and recovery, but evidence collection must occur before any destructive actions like reimaging. The forensic analysis preserves volatile data (e.g., memory, network connections) and non-volatile data (e.g., disk artifacts) to determine the scope and cause of the data exfiltration.

Exam trap

The trap here is that candidates often confuse containment with eradication, selecting reimaging (Option A) prematurely without recognizing that evidence preservation is a mandatory step before any destructive remediation in the incident response process.

Why the other options are wrong

Reimaging the workstation destroys potential evidence before forensic analysis can be performed, violating the preservation step of incident response.

Resetting the user's password is a containment step, but the workstation is already isolated. The next step in the incident response process after containment is eradication or recovery, but more importantly, forensic analysis must be performed before any changes to preserve evidence.

Notifying law enforcement is premature at this stage; the incident response process requires evidence collection and internal investigation first to confirm the incident and gather necessary information before involving external authorities.

Practice this question →

174

MCQmedium

Several Windows servers were built from the same image, and all of them use the same local Administrator password. What is the best operational hardening change?

A.Keep the shared password but store it in a spreadsheet with restricted access.

B.Implement a tool that automatically sets unique local admin passwords on each server.

C.Remove all administrator accounts from the servers.

D.Change the password manually once a year on one server only.

AnswerB

This is the best hardening change because shared local administrator passwords create an easy lateral-movement path if one server or credential is exposed. A password management solution that generates unique local admin passwords reduces blast radius while preserving administrative access. It also supports safer operational management because the passwords can still be retrieved or rotated through controlled processes instead of being duplicated across systems.

Why this answer

Using a tool like Local Administrator Password Solution (LAPS) automates the rotation of unique, complex passwords for each server's local administrator account. This eliminates the risk of lateral movement if one server's credentials are compromised, as each machine has a distinct password stored securely in Active Directory.

Exam trap

The trap here is that candidates may think storing the password securely (Option A) is sufficient, but the core issue is the shared password itself, not just its storage; the exam emphasizes eliminating shared credentials across systems to prevent lateral movement.

How to eliminate wrong answers

Option A is wrong because storing the shared password in a spreadsheet, even with restricted access, still leaves a single point of failure; if the spreadsheet is breached, all servers are compromised. Option C is wrong because removing all administrator accounts would break essential administrative functions and is not a recommended hardening practice; instead, you should rename or disable the built-in Administrator account. Option D is wrong because manually changing the password once a year on only one server does not address the shared password issue across all servers and leaves the others vulnerable indefinitely.

Practice this question →

175

MCQmedium

A branch office stores nightly backups on a NAS that is joined to the same Active Directory domain as the production servers. After a ransomware incident, management wants a backup design that is much harder for attackers to encrypt or delete. Which approach is the best improvement?

A.Increase the backup frequency to every hour while keeping the same NAS design.

B.Store all backups on the same network segment for faster restore access.

C.Maintain an offline or immutable backup copy in a separate administrative boundary.

D.Use only snapshots on the production storage array because they are instant to restore.

AnswerC

An offline or immutable backup copy in a separate administrative boundary is the correct strategy because it removes the backup from the domain's trust and permission model. Offline backups are physically or logically air-gapped, while immutable backups (e.g., WORM storage or object lock) prevent even a compromised administrator from modifying or deleting data within the retention window. The separate administrative boundary ensures that an attacker who takes over the production domain cannot leverage those credentials to reach the backup, preserving a known-good recovery point for incident response and disaster recovery.

Why this answer

Maintaining an offline or immutable backup copy in a separate administrative boundary ensures that attackers cannot encrypt or delete the backups, even if they compromise the Active Directory domain. An offline backup (e.g., tape or disconnected disk) is physically isolated, while immutable backups (e.g., using S3 Object Lock or a NAS with WORM capabilities) prevent modification or deletion for a defined retention period. This design breaks the attacker's ability to propagate ransomware to the backup repository, addressing the core requirement of making backups much harder to encrypt or delete.

Exam trap

The trap here is that candidates often assume increasing backup frequency or keeping backups on the same network segment improves recovery speed, but they overlook the fundamental need for isolation and immutability to protect against ransomware encryption and deletion.

How to eliminate wrong answers

Option A is wrong because increasing backup frequency to every hour on the same NAS joined to Active Directory does not prevent attackers from encrypting or deleting the backups; if the NAS is compromised via the domain, all copies remain vulnerable. Option B is wrong because storing all backups on the same network segment as production servers increases the attack surface and allows ransomware to spread laterally to the backup storage, defeating the goal of isolation.

Practice this question →

176

MCQeasy

A critical patch must be applied to a retail point-of-sale server. What is the best way to reduce business disruption?

A.Apply the patch during the busiest business hours to make the change sooner.

B.Schedule the patch during an approved maintenance window.

C.Skip the patch and rely on hope that the issue will not be exploited.

D.Turn off all backups so the patch process runs faster.

AnswerB

A maintenance window is the best choice because it lets the organization perform the update when user impact is expected to be lowest. This is a core change-control practice for systems that support business operations. It gives the team time to test, monitor, and recover if something goes wrong without affecting customers during peak use.

Why this answer

Scheduling the patch during an approved maintenance window is the best practice to minimize business disruption because it allows the organization to plan for downtime during low-activity periods, coordinate with stakeholders, and ensure rollback procedures are in place. For a retail point-of-sale (POS) server, applying a critical patch outside of business hours prevents transaction interruptions and potential revenue loss, aligning with change management policies that prioritize availability and security.

Exam trap

The trap here is that candidates may choose Option A, thinking that applying a patch sooner reduces risk, but they overlook the immediate business disruption and the importance of change management processes that prioritize availability over speed.

How to eliminate wrong answers

Option A is wrong because applying a patch during busiest business hours would directly disrupt customer transactions, causing immediate revenue loss and potential data integrity issues, which contradicts the goal of reducing business disruption. Option C is wrong because skipping a critical patch leaves the POS server vulnerable to known exploits, such as remote code execution or data breaches, which can lead to greater long-term disruption and regulatory non-compliance. Option D is wrong because turning off backups eliminates the ability to restore the system to a known good state if the patch causes a failure, increasing the risk of extended downtime and data loss.

Practice this question →

177

MCQmedium

A security analyst detects a high volume of failed authentication attempts from IP address 203.0.113.1 against a web application. The attempts use different usernames, such as 'admin', 'root', 'test', and several common names. Account lockout policies are configured to lock an account after five failed attempts. Despite this, the analyst sees the attempts continuing over several hours. Which of the following security controls is most likely missing or improperly configured?

A.Increase the account lockout threshold to a lower number

B.Implement geofencing to block traffic from the attacker's region

C.Configure rate limiting per source IP address

D.Enable detailed failed login attempt logging

AnswerC

Rate limiting on the application or firewall level restricts the number of authentication attempts from a single IP address over a given time period, regardless of the username being tried. This directly counters the attacker's strategy of rotating usernames to bypass account lockout.

Why this answer

Rate limiting per source IP address is the correct control because it restricts the number of authentication requests from a single IP (203.0.113.1) within a given time window, regardless of the usernames used. Account lockout policies are ineffective here because the attacker is rotating through different usernames (e.g., 'admin', 'root', 'test'), so no single account reaches the five-failed-attempt threshold. By limiting the request rate from the source IP, the analyst can throttle the attacker's brute-force attempts without affecting legitimate users.

Exam trap

The trap here is that candidates assume account lockout policies are sufficient for all brute-force attacks, but they fail to recognize that rotating usernames (a 'password spraying' attack) bypasses per-account lockout, making per-source-IP rate limiting the correct mitigation.

Why the other options are wrong

The account lockout threshold is already set to lock after five attempts, but the attack uses different usernames, so lockout per user is ineffective. Lowering the threshold further would not stop the attack since each username is tried only a few times.

Geofencing blocks traffic based on geographic location, but the attacker's IP address 203.0.113.1 is a documentation-only address (not assigned to any real region), and the attack could easily be routed through proxies or VPNs in other regions. The core issue is the volume of attempts from a single source, which rate limiting addresses directly.

Practice this question →

178

MCQmedium

An IDS generates an alert for possible SQL injection against an internal reporting portal at 02:00. The web logs show the source IP belongs to the company's approved vulnerability scanner, the request path matches the scheduled test window, and the WAF blocked the request. What is the most appropriate analyst conclusion?

A.Treat it as a confirmed intrusion and immediately take the portal offline.

B.Close it as expected activity after validating the scanner schedule and source IP.

C.Classify it as malware because the blocked payload proves the scanner is infected.

D.Disable the WAF rule so the scanner can complete without generating more alerts.

AnswerB

The logs align with an authorized scanner operating during a planned maintenance window, and the WAF successfully blocked the payload. After confirming the scan authorization, the alert can be documented and closed as expected activity rather than escalated as a live attack.

Why this answer

The alert matches expected, authorized activity: the source IP belongs to the approved vulnerability scanner, the request occurred during the scheduled test window, and the WAF blocked the malicious payload. This is a classic false positive triggered by legitimate security testing, not an actual intrusion. The analyst should validate the scanner schedule and source IP, then close the alert as expected activity.

Exam trap

The trap here is that candidates see a blocked SQL injection payload and assume it is a real attack, forgetting to verify whether the source is an authorized vulnerability scanner operating during a scheduled test window.

How to eliminate wrong answers

Option A is wrong because taking the portal offline is an overreaction to a false positive; the request was from an authorized scanner and blocked by the WAF, so there is no confirmed intrusion. Option C is wrong because classifying the scanner as infected based solely on a blocked SQL injection payload is a logical leap; scanners intentionally send malicious payloads to test defenses, and the WAF block proves the control worked, not that the scanner is compromised. Option D is wrong because disabling the WAF rule would remove protection against real attacks, and the scanner can still complete its tests with the WAF blocking its payloads—the alerts can be tuned or suppressed instead.

Practice this question →

179

Multi-Selectmedium

A security analyst is investigating a potential data exfiltration incident. The analyst has collected network flow data, proxy logs, and endpoint logs. Which two data sources should the analyst correlate to identify the exfiltration channel and the compromised host? (Choose two.)

Select 2 answers

A.Proxy logs to identify HTTP/HTTPS connections to external destinations.

B.Endpoint logs to identify processes that initiated network connections.

C.Firewall logs to identify blocked inbound connection attempts.

D.DNS logs to identify domain name resolutions from internal hosts.

E.DHCP logs to identify IP address assignments to hosts.

AnswersA, B

Proxy logs record outbound web requests, including the source host, destination URL, and amount of data transferred. By analyzing these logs, the analyst can identify unusual connections to external sites, such as large uploads or connections to known malicious domains, which may indicate exfiltration over HTTP/HTTPS. This helps identify both the channel and the compromised host.

Why this answer

Correlating proxy logs with endpoint logs allows the analyst to link outbound web connections to specific processes on specific hosts. Proxy logs show the destination and volume of data, while endpoint logs show which process initiated the connection. Together, they can identify the exfiltration channel (e.g., HTTP POST to a foreign server) and the compromised host (by hostname or IP).

Exam trap

The trap here is focusing on perimeter logs like firewall or DNS, but those may not provide the process-level context needed to definitively identify the compromised host and channel.

Practice this question →

180

MCQmedium

A nightly backup job shows "Completed successfully" in the backup console, but a test restore fails with an authentication error after the backup service account password was rotated last week. What is the best next step?

A.Increase the retention period so the backup console will keep more copies.

B.Update the backup application with the current service account credentials and rerun a restore validation test.

C.Disable the backup software firewall rule and try the restore again later.

D.Delete and recreate all protected files because the backup repository is probably corrupt.

AnswerB

The backup job may complete successfully using cached, per-job credentials, while the restore operation uses a separate service account whose password was rotated or whose legacy authentication settings were revoked. Updating the backup application with the current service account credentials eliminates the credential mismatch and ensures that the restore process can read the encrypted backup data. Rerunning a restore validation test is essential because 'backup success' is meaningless if the organization cannot actually recover data during a disaster.

Why this answer

The backup job succeeded because the service account had cached credentials or the backup process itself didn't require re-authentication at that point. However, the restore operation failed because the backup application's stored credentials for accessing the backup repository are now stale after the password rotation. Updating the backup application with the current service account credentials (Option B) directly resolves the authentication error and allows a proper restore validation test.

Exam trap

The trap here is that candidates assume a 'Completed successfully' backup job means all related processes are healthy, but the exam tests the distinction between backup success and restore success, highlighting that credential rotation can break restore without affecting backup.

How to eliminate wrong answers

Option A is wrong because increasing the retention period only keeps more backup copies; it does not fix the underlying authentication issue caused by stale credentials. Option C is wrong because disabling a firewall rule is unrelated to an authentication error; the error indicates a credentials mismatch, not a network connectivity or firewall block. Option D is wrong because deleting and recreating files is a destructive action that assumes corruption, but the backup repository is likely intact; the problem is purely an authentication failure during restore, not data corruption.

Practice this question →

181

MCQmedium

An engineering firm backs up its file server every night to a NAS that is always mounted to the production domain. After a ransomware event, management asks for the most effective improvement to reduce the chance that backups are encrypted along with production data. What should be recommended?

A.Increase the backup frequency but leave the NAS always online

B.Keep an offline or immutable backup copy that is not continuously reachable from production

C.Store backups in the same server room for faster restore times

D.Use only local snapshots on the file server because they are simpler to manage

AnswerB

An offline (air-gapped) or immutable backup, such as WORM storage or S3 Object Lock, is not continuously reachable from the production network, so a ransomware intrusion that compromises the file server cannot easily alter or delete these copies. Even with domain admin privileges, an attacker cannot directly issue delete commands to a physically disconnected system or an object-locked repository. This ensures a known-good, unencrypted recovery point remains available, allowing the organization to restore operations without paying a ransom.

Why this answer

An offline or immutable backup copy that is not continuously reachable from the production domain prevents ransomware from encrypting it. Since the NAS is always mounted to the production domain, it is vulnerable to lateral movement and encryption by ransomware. An offline backup (e.g., tape or disconnected disk) or an immutable backup (e.g., using S3 Object Lock or a write-once file system) ensures that even if production data is compromised, the backup remains intact and recoverable.

Exam trap

The trap here is that candidates may think increasing backup frequency or keeping backups local improves security, but the core issue is that the backup must be isolated from the production domain to survive a ransomware attack that encrypts all reachable data.

How to eliminate wrong answers

Option A is wrong because increasing backup frequency while leaving the NAS always online does not protect against encryption; ransomware can encrypt both the live data and the mounted backup during the same attack window. Option C is wrong because storing backups in the same server room does not address the security issue; it only improves restore speed but still leaves the backup accessible to ransomware that has compromised the production network. Option D is wrong because local snapshots on the file server are stored on the same volume or system that is being attacked, so they can be encrypted or deleted by ransomware just like the original data.

Practice this question →

182

MCQmedium

A monthly vulnerability scan identifies a critical vulnerability on a public-facing VPN appliance, but the vendor says no patch is available yet. The service must remain online for remote workers. What is the best compensating control to reduce risk right away?

A.Ignore the finding until the next quarterly review because there is no patch available.

B.Move the appliance to a less critical VLAN and leave all access rules unchanged.

C.Apply virtual patching or traffic filtering to block exploit attempts until remediation is possible.

D.Disable logging so that attackers cannot learn the appliance version from log data.

AnswerC

Applying virtual patching or traffic filtering is the correct immediate response because it blocks or mitigates exploit attempts against the vulnerability while a permanent vendor patch is developed, tested, and deployed. A virtual patch is often implemented as an intrusion prevention system (IPS) rule, web application firewall (WAF) signature, or a firewall rule that specifically detects and drops malicious traffic matching the exploit pattern. This compensating control reduces the real-world risk to the system and can be deployed quickly, but it must be tested to avoid false positives and should be removed once the actual patch is installed.

Why this answer

Virtual patching or traffic filtering (e.g., via an IPS or WAF) provides immediate, compensating protection by inspecting and blocking exploit traffic targeting the vulnerability, without requiring the vendor to release a patch. This allows the VPN appliance to remain online for remote workers while reducing the risk of exploitation until a permanent fix is available.

Exam trap

The trap here is that candidates may assume a missing patch means no action is possible, or that VLAN segmentation alone is sufficient, when in fact compensating controls like virtual patching are the correct immediate response for unpatched critical vulnerabilities on internet-facing systems.

How to eliminate wrong answers

Option A is wrong because ignoring a critical vulnerability until the next quarterly review leaves the organization exposed to active exploitation, especially on a public-facing appliance; risk does not disappear just because no patch exists. Option B is wrong because moving the appliance to a less critical VLAN without changing access rules does not prevent an attacker from reaching the vulnerability—VLANs provide logical separation but do not filter application-layer exploit attempts, and the same access rules would still allow malicious traffic to the device.

Practice this question →

183

MCQeasy

After a phishing account compromise has been contained and the attacker’s mailbox forwarding rule was removed, what should the team do next?

A.Stop the investigation because the forwarding rule was deleted.

B.Reset credentials and verify there are no other persistence methods before recovery.

C.Close the ticket and tell the user to be more careful next time.

D.Wait one week before taking any action so the attacker does not notice.

AnswerB

This option follows the eradication and recovery phases of incident response. Resetting the compromised account's credentials revokes the attacker's direct access, and verifying for other persistence methods (e.g., additional forwarding rules, new admin roles, or scheduled tasks) ensures the intrusion is fully removed before restoring services. It avoids an incomplete recovery that could allow the attacker to slip back in.

Why this answer

After removing a mailbox forwarding rule, the team must reset the compromised account's credentials and verify that no other persistence mechanisms (e.g., additional forwarding rules, OAuth app grants, or mailbox delegation) remain. This ensures the attacker cannot regain access using cached credentials or alternate backdoors, which is critical before returning the account to production.

Exam trap

The trap here is that candidates assume removing the visible persistence mechanism (the forwarding rule) is sufficient, but CompTIA tests the understanding that attackers often deploy multiple backdoors, and credential reset plus full verification is mandatory before recovery.

How to eliminate wrong answers

Option A is wrong because stopping the investigation after deleting a single forwarding rule ignores other potential persistence methods like hidden inbox rules, OAuth tokens, or SMTP auth compromises. Option C is wrong because closing the ticket without remediation leaves the account vulnerable and fails to address the root cause of the compromise. Option D is wrong because waiting a week allows the attacker to re-establish persistence or exfiltrate more data, violating the principle of timely incident response.

Practice this question →

184

Matchingmedium

Match each change-management practice to the best description for reducing patching risk in production.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Use a phased rollout to catch compatibility issues early

Provide a rollback or backout plan if the patch fails

Place the work inside a maintenance window

Create a baseline that supports recovery and comparison

Apply change control and obtain approval

Why these pairings

These change-management practices reduce patching risk by ensuring proper review, scheduling, rollback capability, pre-testing, documentation, and automation to minimize errors.

Practice this question →

185

MCQeasy

EDR flags a workstation because a word processor launched an unusual script and then contacted a rare external domain. What is the best immediate action?

A.Isolate the workstation from the network using the EDR tool.

B.Wait for another alert before taking any action.

C.Delete the word processor immediately.

D.Reboot the workstation to see if the behavior happens again.

AnswerA

This is the best immediate containment step because it stops the workstation from communicating with a possible attacker while preserving the system for further analysis. EDR isolation is designed for exactly this type of suspicious endpoint behavior. It limits lateral movement, reduces data exfiltration risk, and gives responders time to investigate before deciding on cleanup or reboot actions.

Why this answer

Isolating the workstation with the EDR tool is the best immediate action because it contains the potential compromise by cutting off network communication, preventing lateral movement or data exfiltration while preserving forensic evidence. The combination of an unusual script execution from a word processor and a connection to a rare external domain strongly suggests a possible malware infection or remote access trojan (RAT) that requires immediate containment.

Exam trap

The trap here is that candidates may think rebooting (Option D) is a safe first step, but it can destroy volatile evidence and does not contain the threat, whereas isolation via EDR is the correct containment action per incident response best practices.

How to eliminate wrong answers

Option B is wrong because waiting for another alert could allow the threat to spread or exfiltrate data, violating the principle of timely containment in incident response. Option C is wrong because deleting the word processor does not address the underlying malicious script or process that may still be running, and it destroys potential forensic evidence. Option D is wrong because rebooting the workstation may terminate the suspicious process but does not prevent the system from being re-infected or the attacker from re-establishing access, and it could also clear volatile memory evidence.

Practice this question →

186

MCQmedium

A SOC analyst receives a SIEM alert for a possible brute-force attack against a remote access portal. The alert shows 240 failed logins from the same source IP over 4 minutes, followed by one successful login. Before escalating as an incident, what is the BEST evidence to check to determine whether the alert is a false positive caused by approved activity?

A.Whether the source IP belongs to the company help desk

B.Whether there is a change ticket or test plan for the access portal and the activity matches the approved maintenance window

C.Whether the user account has MFA enabled

D.Whether the firewall is in inline mode

AnswerB

A change ticket or test plan that specifically covers the access portal, combined with the login activity occurring within the approved maintenance window, is the strongest evidence that the SIEM alert is a false positive. This documentation confirms intent and authorization, which no technical indicator can provide. It directly aligns with change management processes and incident response triage best practices, allowing the analyst to close the alert without unnecessary escalation.

Why this answer

A change ticket or test plan that matches the observed activity (240 failed logins followed by a successful login during an approved maintenance window) would indicate that the alert is a false positive caused by authorized testing or maintenance, not a malicious brute-force attack. This is the best evidence because it directly ties the SIEM alert to approved, scheduled activity, which is a standard operational control for change management.

Exam trap

The trap here is that candidates may assume a help desk IP or MFA automatically validates the activity, but only a documented change ticket or test plan provides the necessary evidence to classify the alert as a false positive under standard incident response procedures.

How to eliminate wrong answers

Option A is wrong because the source IP belonging to the company help desk does not automatically make the activity approved; help desk staff could still be performing unauthorized or malicious actions, and the IP alone does not provide evidence of a change ticket or test plan. Option C is wrong because MFA being enabled on the user account does not explain the 240 failed logins from a single source IP; MFA is a security control that would mitigate the impact of a successful login but does not prove the activity was approved or that the alert is a false positive.

Practice this question →

187

MCQhard

Based on the exhibit, which change best improves both recovery time and recovery point for the ERP database? A mid-sized company has a two-hour RTO and a 30-minute RPO, but its current backup design cannot meet either objective during restore testing.

A.Add a second nightly full backup at 23:30 to the same NAS device.

B.Move the NAS to a different VLAN but keep the backup schedule unchanged.

C.Implement frequent transaction log backups and a pre-staged standby or automated recovery image.

D.Increase backup retention from one month to one year.

AnswerC

Transaction log backups reduce the amount of data lost between full backups, improving the RPO. A pre-staged standby or automated recovery image shortens rebuild time, improving the RTO. Together, these changes directly address both recovery objectives instead of simply storing the same backups more safely or for longer. The test results show that the current restore approach is far too slow and too coarse.

Why this answer

Implementing frequent transaction log backups (e.g., every 5–10 minutes) allows point-in-time recovery, reducing the recovery point objective (RPO) to minutes. A pre-staged standby or automated recovery image reduces recovery time objective (RTO) by eliminating the need to restore from scratch, enabling near-instant failover. This directly addresses the company's inability to meet its 30-minute RPO and 2-hour RTO during restore testing.

Exam trap

The trap here is that candidates confuse backup frequency (e.g., more full backups) with recovery point improvement, failing to recognize that only transaction log backups or incremental changes can reduce RPO below the full backup interval, and that pre-staging is required to meet aggressive RTOs.

How to eliminate wrong answers

Option A is wrong because adding a second nightly full backup to the same NAS device does not reduce the recovery point window (still up to 24 hours of data loss) and does not improve recovery time (restore still takes hours from a full backup). Option B is wrong because moving the NAS to a different VLAN addresses network segmentation or security, not backup performance or recovery objectives; it has no impact on RTO or RPO. Option D is wrong because increasing retention from one month to one year only extends how far back data can be restored, not how quickly or with how little data loss; it does not improve RTO or RPO.

Practice this question →

188

MCQeasy

A vulnerability scan finds a critical flaw on a public-facing server and a medium flaw on a lab system that is not connected to the production network. Which issue should be fixed first?

A.The medium flaw on the isolated lab system, because all vulnerabilities should be fixed in alphabetical order.

B.The critical flaw on the public-facing server, because it has higher business risk.

C.Both systems can wait until the next quarterly patch cycle.

D.The lab system, because internal systems always outrank external systems.

AnswerB

The critical flaw on the public-facing server is the clear first priority because the combination of high severity and direct internet exposure dramatically increases both the probability of exploitation and the potential business impact. Critical vulnerabilities often have publicly available proof-of-concept exploits or are leveraged in automated attacks, so the remediation window is short. Addressing this server first reduces the likelihood of a successful attack that could affect customers, brand reputation, or regulatory compliance.

Why this answer

The critical flaw on the public-facing server should be fixed first because it presents a higher business risk. A public-facing server is directly accessible from the internet, making it a prime target for attackers. Exploiting a critical vulnerability could lead to data breaches, service disruption, or unauthorized access, with immediate and severe business impact.

In contrast, the medium flaw on an isolated lab system poses no direct threat to production operations or sensitive data.

Exam trap

The trap here is that candidates may assume all vulnerabilities must be fixed in order of severity alone, ignoring the crucial factor of asset exposure and business context, or they may mistakenly believe that internal systems are always more critical than external ones.

How to eliminate wrong answers

Option A is wrong because fixing vulnerabilities in alphabetical order is not a valid prioritization method; risk-based prioritization based on severity and exposure is the industry standard. Option C is wrong because delaying remediation of a critical flaw on a public-facing server until the next quarterly patch cycle could leave the organization exposed to exploitation for an unacceptable period; critical vulnerabilities often require immediate patching or compensating controls. Option D is wrong because internal systems do not always outrank external systems; in fact, public-facing systems typically have higher risk due to internet exposure, and isolated lab systems have minimal business risk.

Practice this question →

189

MCQeasy

During a disaster recovery test, what is the most important thing to confirm about the backup?

A.That the backup files exist in storage.

B.That the data can be restored and is usable after recovery.

C.That the backup system uses encryption.

D.That the backup is stored on tape instead of disk.

AnswerB

The real purpose of a backup is successful recovery. During testing, the team should verify that the data restores correctly and that applications or users can actually use it afterward. This confirms the backup supports business continuity and is not merely sitting in storage as an unreadable copy.

Why this answer

The most important thing to confirm about a backup during a disaster recovery test is that the data can be restored and is usable after recovery. This validates the integrity and completeness of the backup, ensuring that the recovery point objective (RPO) and recovery time objective (RTO) can be met. Simply verifying that backup files exist does not guarantee they are not corrupted or that the restoration process will succeed, which is why a full restore test is critical.

Exam trap

The trap here is that candidates often confuse backup existence with backup usability, assuming that if the backup file is present and encrypted, it must be restorable, but CompTIA emphasizes that only a successful restore test confirms recoverability.

How to eliminate wrong answers

Option A is wrong because merely confirming that backup files exist in storage does not validate their integrity, consistency, or ability to be restored; a backup file could be present but corrupted or incomplete. Option C is wrong because encryption protects data at rest or in transit but has no bearing on whether the backup can be successfully restored and used; encryption is a security control, not a recovery validation. Option D is wrong because the storage medium (tape vs. disk) is irrelevant to the core requirement of recoverability; both media can hold valid or invalid backups, and the choice depends on factors like speed, cost, and retention, not on the ability to restore.

Practice this question →

190

MCQmedium

An EDR console reports possible beaconing from a workstation because it makes outbound HTTPS connections to the same cloud IP every 15 minutes. The workstation belongs to the patch-management team, and the destination resolves to a vendor update service. Which evidence best supports closing the alert as a false positive?

A.The workstation user says the activity looks normal and no files were encrypted.

B.The source IP appears on a blocklist, so the alert must be malicious.

C.Process lineage and signed agent logs show the patch client initiated the traffic on schedule.

D.The workstation has antivirus installed, which means outbound beaconing is impossible.

AnswerC

Process lineage and agent logs provide strong proof that the traffic came from the approved patch client. When the destination is a known vendor service and the timing matches the expected update schedule, the repeated connections are likely normal behavior. This is exactly the kind of evidence analysts should use to validate a detection instead of escalating a benign operational pattern.

Why this answer

It provides verifiable evidence that the outbound HTTPS connections are legitimate: the process lineage and signed agent logs confirm the patch-management client initiated the traffic on its scheduled update cycle. This aligns with the expected behavior of a patch-management tool, which often uses HTTPS to a vendor update service at regular intervals. The EDR's beaconing detection is a false positive because the traffic is not malicious but rather a routine, authorized activity.

Exam trap

The trap here is that candidates may assume any periodic outbound connection is malicious beaconing, ignoring that legitimate software update services often use scheduled HTTPS connections to the same IP, and that process lineage and signed logs are the definitive evidence to validate the traffic's legitimacy.

How to eliminate wrong answers

Option A is wrong because user testimony and the absence of file encryption are subjective and do not provide technical proof that the network traffic is legitimate; beaconing can occur without immediate encryption events. Option B is wrong because the source IP appearing on a blocklist does not automatically make the alert malicious—blocklists often include legitimate services, and the destination is a known vendor update service. Option D is wrong because having antivirus installed does not prevent outbound beaconing; antivirus software does not block legitimate HTTPS connections initiated by authorized processes, and beaconing can still occur even with AV present.

Practice this question →

191

MCQeasy

A technician restores a file server from backup, but the business wants confidence that the recovery process will work during an outage. What should the team do most often to validate the backups?

A.Review the backup vendor brochure for proof that recovery will work.

B.Perform regular restore tests using sample files or systems.

C.Increase the backup retention period without testing restores.

D.Change the backup password every day and skip verification.

AnswerB

Performing regular restore tests entails recovering sample files or an entire system from backup to a scratch or isolated environment to prove the data is readable and complete. This process validates not only the backup media but also the backup software's ability to reassemble files, directories, and application state correctly. It directly verifies achievement of recovery point and recovery time objectives, giving confidence that a real disaster can be recovered.

Why this answer

The only way to gain confidence that backups can be successfully restored during an actual outage is to perform regular, documented restore tests. This validates the integrity of the backup media, the correctness of the restoration procedure, and the recoverability of data within the required recovery time objective (RTO). Without testing, assumptions about backup reliability remain unverified, which can lead to catastrophic data loss when a real disaster occurs.

Exam trap

The trap here is that candidates assume that simply having backups or extending retention is sufficient, but CompTIA emphasizes that only actual restore testing provides verifiable proof of recoverability, not the presence of backup files or vendor claims.

How to eliminate wrong answers

Option A is wrong because a vendor brochure only describes theoretical capabilities under ideal conditions, not the actual performance or compatibility of the backup solution with the specific server hardware, software, and data sets in use. Option C is wrong because increasing retention without testing does nothing to validate that the stored backup files are not corrupt, incomplete, or incompatible with the current restore environment. Option D is wrong because changing the backup password daily adds unnecessary administrative overhead and skipping verification removes the only automated check for backup integrity, making it impossible to detect silent data corruption or failed backup jobs.

Practice this question →

192

MCQmedium

A SIEM reports a successful sign-in to a SaaS admin portal from a new country, followed three minutes later by multiple configuration changes to mailbox forwarding rules. The account owner says they were in the office and did not approve any changes. What should the analyst check next?

A.The identity provider and MFA logs to confirm whether the session was legitimately authenticated or hijacked.

B.The office printer logs to see whether the user printed the mailbox rules.

C.The antivirus signature version on the user’s laptop only.

D.The DNS cache on the user’s laptop to find the forwarding rule target.

AnswerA

Because the sign-in succeeded and configuration changes followed quickly, the key question is whether the session was legitimately established or taken over. Identity provider logs, MFA approvals, token issuance, and session details can confirm whether the login came from the owner or from a stolen credential/session. This is the most direct way to validate the alert before taking disruptive action.

Why this answer

The SIEM alert shows a successful sign-in from a new country followed by suspicious configuration changes, which is a classic indicator of session hijacking or credential theft. Checking the identity provider (IdP) and MFA logs allows the analyst to verify if the authentication was legitimate (e.g., from a known device/IP) or if the session token was stolen and reused, as MFA can be bypassed via token replay or consent phishing. This step directly addresses the core question of whether the session was authorized or compromised.

Exam trap

The trap here is that candidates may focus on endpoint indicators (antivirus, DNS) or unrelated logs (printer) instead of recognizing that the core issue is authentication integrity, which must be verified through identity provider and MFA logs.

How to eliminate wrong answers

Option B is wrong because office printer logs are irrelevant to mailbox forwarding rule changes; they record print jobs, not authentication or email configuration events. Option C is wrong because antivirus signature versions on the user's laptop only indicate whether malware definitions are up to date, but they do not provide evidence of session hijacking or unauthorized configuration changes in a cloud SaaS portal. Option D is wrong because the DNS cache on the user's laptop stores domain-to-IP mappings, not the target address of mailbox forwarding rules; forwarding rule targets are stored in the email server's transport rules or mailbox settings, not in local DNS.

Practice this question →

193

Multi-Selecteasy

A workstation is suspected of running malware and contacting an unknown host. Which two actions belong in the containment phase? Select two.

Select 2 answers

A.Isolate the workstation from the network.

B.Block the malicious IP or domain at the firewall or proxy.

C.Reimage the workstation immediately before collecting evidence.

D.Tell the user to keep working until tomorrow.

E.Delete recent logs to reduce noise.

AnswersA, B

Isolating the workstation from the network, by unplugging the cable or disabling the Wi-Fi adapter, immediately severs all communication paths to the unknown host. This stops malicious traffic, prevents lateral movement to other systems, and preserves both memory and disk artifacts in their current state for forensic acquisition, making it the preferred first containment step in incident response.

Why this answer

Isolating the workstation from the network (A) immediately stops the malware's ability to communicate with the command-and-control (C2) server, preventing data exfiltration and further propagation. Blocking the malicious IP or domain at the firewall or proxy (B) is a containment action that prevents any system on the network from reaching the known malicious host, even if other hosts are already compromised. Both actions align with the NIST SP 800-61 containment strategy of stopping the spread and impact of an incident.

Exam trap

The trap here is that candidates confuse the containment phase with the eradication phase, mistakenly thinking that reimaging (Option C) is a containment action when it is actually an eradication step that should only occur after evidence collection and analysis.

Practice this question →

194

MCQhard

Based on the exhibit, what is the best-supported conclusion for the SOC analyst?

A.The traffic is normal web browsing to a content delivery network.

B.The host is likely using DNS tunneling or DNS-based command and control.

C.The issue is most likely ARP spoofing on the local switch port.

D.The evidence most strongly indicates a password spraying campaign.

AnswerB

The repeated TXT queries, predictable timing, small UDP payloads, and absence of proxy traffic strongly suggest data or commands are being carried over DNS. The unique subdomains and steady beacon interval are classic indicators of DNS tunneling or DNS-based command-and-control. The signed PDF reader only shows how the activity may have started, not that it is benign.

Why this answer

The exhibit shows a high volume of DNS queries to multiple unusual domains with long subdomain strings, which is a classic indicator of DNS tunneling or DNS-based command and control (C2). DNS tunneling encodes data in DNS queries and responses, allowing attackers to exfiltrate data or communicate with a C2 server while bypassing traditional network controls. The SOC analyst should recognize this pattern as anomalous DNS activity rather than normal web browsing.

Exam trap

The trap here is that candidates may confuse DNS tunneling with normal DNS resolution for CDN services, but the key differentiator is the abnormal volume and structure of the DNS queries, not the destination IP addresses.

How to eliminate wrong answers

Option A is wrong because normal web browsing to a content delivery network (CDN) would generate HTTP/HTTPS traffic to known CDN domains, not an excessive number of DNS queries to obscure, randomly generated subdomains. Option C is wrong because ARP spoofing operates at Layer 2 and would manifest as duplicate IP addresses or unusual ARP traffic, not as a high volume of DNS queries. Option D is wrong because a password spraying campaign involves repeated login attempts across multiple accounts, which would appear as authentication logs (e.g., Windows Event ID 4625) rather than DNS query patterns.

Practice this question →

195

MCQmedium

A manager asks the security team to let Human Resources inspect the files on a laptop suspected of containing stolen customer data before IT touches it. What is the best response?

A.Let HR browse the files first so they can confirm whether the data is sensitive.

B.Create a forensic image of the device, document the handoff, and maintain chain of custody before any analysis.

C.Copy the files to a shared drive so multiple departments can review them quickly.

D.Factory reset the laptop immediately to prevent further leakage of customer data.

AnswerB

When a device may contain evidence, the priority is to preserve it in a way that supports later analysis and legal defensibility. Creating a forensic image captures the data without modifying the original device, and documenting each transfer maintains chain of custody. This approach protects evidence integrity and allows authorized investigators to review the copy instead of the live system. It is the correct response before HR or others inspect the contents.

Why this answer

The first priority in any investigation involving potential evidence is to preserve the data in its original state. Creating a forensic image (bit-for-bit copy) ensures that the original media is not altered, and documenting the handoff with a chain of custody form provides a verifiable audit trail. This process adheres to forensic best practices and legal requirements, preventing spoliation of evidence before any analysis begins.

Exam trap

The trap here is that candidates may think HR needs immediate access to confirm sensitivity, but they overlook the forensic requirement to preserve the original state of the evidence before any access or analysis occurs.

How to eliminate wrong answers

Option A is wrong because allowing HR to browse the files directly on the live laptop would modify metadata (e.g., file access times, last opened dates) and could potentially alter or delete data, compromising the integrity of the evidence. Option C is wrong because copying files to a shared drive without first creating a forensic image risks altering file timestamps and metadata during the copy process, and it bypasses proper chain of custody, making the evidence inadmissible. Option D is wrong because factory resetting the laptop would destroy all data, including any evidence of the alleged theft, making it impossible to conduct a forensic investigation and potentially violating legal hold requirements.

Practice this question →

196

MCQmedium

A SIEM alert flags an interactive logon to a Windows file server from a service account that normally only runs scheduled tasks. The alert occurred at 01:12, but the maintenance window for that server is every Sunday at 02:00. The account also accessed a different server five minutes later. What should the analyst do first?

A.Ignore the alert because service accounts often authenticate outside normal business hours.

B.Correlate the activity with the change calendar, scheduled-task logs, and ticketing records before escalating.

C.Immediately disable the service account to stop any potential attacker activity.

D.Reimage the file server to remove any possible compromise.

AnswerB

The best first step in triage is to determine whether the activity is authorized or anomalous. Because service-account use can be legitimate, the analyst should correlate the logon with maintenance windows, scheduled-task history, and approved change records. That quickly separates normal administrative activity from suspicious lateral movement without prematurely disrupting operations.

Why this answer

The analyst must first gather context to determine if the alert is a false positive or a genuine security incident. The interactive logon at 01:12 is outside the scheduled maintenance window (Sunday 02:00), and the account’s subsequent access to another server warrants correlation with change calendars, scheduled-task logs, and ticketing records to verify if the activity was authorized. This step prevents unnecessary disruption while ensuring that any anomalous behavior is properly investigated before escalation.

Exam trap

The trap here is that candidates may assume any activity outside business hours is automatically malicious or, conversely, that service accounts always authenticate at odd hours, leading them to ignore the alert—when the key is to recognize that the interactive logon type and the deviation from the maintenance window are the specific anomalies requiring correlation.

How to eliminate wrong answers

Option A is wrong because ignoring the alert based solely on the time of day overlooks the specific anomaly: the account performed an interactive logon (type 2 or 10) rather than its usual scheduled-task logon (type 5), and the activity occurred outside the defined maintenance window. Option C is wrong because immediately disabling the service account without investigation could disrupt legitimate operations and destroy forensic evidence; the analyst should first verify if the activity was authorized via change records. Option D is wrong because reimaging the server is a drastic, irreversible step that should only be taken after confirming compromise through proper forensic analysis and incident response procedures.

Practice this question →

197

Multi-Selectmedium

An organization is implementing a new Security Information and Event Management (SIEM) system. Which three of the following are primary capabilities that a SIEM provides to support security operations? (Choose three.)

Select 3 answers

.Correlation of log data from multiple sources to identify patterns of suspicious activity

.Real-time alerting based on predefined security rules and anomalies

.Long-term storage and retention of logs for compliance and forensic analysis

.Automated patching of operating system vulnerabilities across the enterprise

.Blocking malicious network traffic at the perimeter firewall

.Performing vulnerability scans on internal hosts and applications

Why this answer

A SIEM system's primary capabilities include aggregating and correlating log data from diverse sources (servers, firewalls, endpoints) to detect patterns indicative of security incidents. It provides real-time alerting by applying predefined correlation rules and anomaly detection algorithms to streaming log events. Additionally, SIEM solutions offer long-term log storage and retention, which is essential for compliance audits (e.g., PCI DSS, HIPAA) and post-incident forensic analysis.

Exam trap

The trap here is that candidates confuse a SIEM's ability to ingest and analyze data from other security tools with the ability to perform those tools' native functions (like patching, blocking, or scanning), leading them to select options that describe actions a SIEM cannot directly execute.

Practice this question →

198

MCQmedium

A file server in the accounting department begins renaming documents and dropping ransom notes. The SOC confirms encryption is still in progress, and the server hosts a share used by several finance teams. What should the incident response team do first?

A.Disconnect the server from the network to contain the spread.

B.Restore the file share from backup immediately while the server is still connected.

C.Power off the server immediately without any other action.

D.Notify users to change their passwords before any technical action is taken.

AnswerA

Immediately disconnecting the server from the network (unplugging the NIC, disabling the switch port, or isolating the VLAN) contains the active ransomware by stopping it from encrypting additional network shares, communicating with its command-and-control server, or moving laterally to other hosts. This network cutover is the first-priority containment action after active encryption is confirmed because it minimizes blast radius while preserving the machine's volatile memory and running processes for forensic triage. Unlike a hard shutdown, it keeps the host in a state where investigators can later image the disk and extract indicators of compromise.

Why this answer

Disconnecting the server from the network is the immediate containment step to prevent the ransomware from encrypting additional files on the share or spreading laterally to other systems. Since encryption is still in progress, isolating the server stops the attacker's process from accessing more files and blocks any command-and-control (C2) communication. This aligns with the NIST incident response framework's containment phase, prioritizing stopping the spread over recovery or notification.

Exam trap

The trap here is that candidates may prioritize data recovery (Option B) or user notification (Option D) over containment, failing to recognize that the immediate priority is stopping active encryption to limit damage.

How to eliminate wrong answers

Option B is wrong because restoring from backup while the server is still connected risks re-encrypting the restored files if the ransomware process is active, and it violates the containment-first principle. Option C is wrong because powering off the server may cause loss of volatile forensic data (e.g., memory-resident encryption keys, running processes) and can trigger anti-forensic behaviors in some ransomware strains. Option D is wrong because notifying users to change passwords before technical containment wastes critical time; the immediate threat is active encryption, not credential compromise, and password changes should occur after containment and eradication.

Practice this question →

199

MCQmedium

EDR flags encoded PowerShell launched by a spreadsheet application, followed by an attempt to access LSASS and outbound HTTPS traffic to a rare domain. What should the analyst do first from the EDR console?

A.Reboot the endpoint to terminate the suspicious processes

B.Isolate the endpoint from the network while keeping it powered on

C.Uninstall the spreadsheet application immediately

D.Block the rare domain and close the alert

AnswerB

Network isolation stops the endpoint from reaching the attacker's command-and-control server and blocks lateral movement to other systems, while keeping the machine powered on preserves the volatile memory contents needed for forensic analysis (processes, injected code, network connections). This is an active containment action that does not delete on-disk artifacts or kill the live processes prematurely, so the response team can capture a memory dump and inspect the encoded PowerShell payload in its original context. On managed endpoints this is accomplished via EDR-integrated network quarantine, which applies a host firewall deny-all rule at the virtual switch or agent level rather than physically disconnecting the cable.

Why this answer

Isolating the endpoint from the network while keeping it powered on preserves volatile evidence (e.g., running processes, memory contents) and prevents the attacker from exfiltrating data or establishing further C2 communication. The EDR console allows immediate network isolation without losing the ability to perform live forensics or memory analysis. This aligns with the incident response priority of containment before eradication or recovery.

Exam trap

The trap here is that candidates confuse immediate containment (isolation) with eradication (reboot or uninstall), failing to recognize that preserving volatile evidence is critical for understanding the attack vector and scope before taking destructive actions.

How to eliminate wrong answers

Option A is wrong because rebooting the endpoint destroys volatile evidence in memory (e.g., LSASS dump artifacts, injected code) and may allow persistence mechanisms to re-execute on startup, potentially losing the forensic trail. Option C is wrong because uninstalling the spreadsheet application is a premature remediation step that destroys evidence and does not address the active threat; the analyst must first contain the endpoint to prevent lateral movement or data exfiltration.

Practice this question →

200

MCQmedium

An EDR alert flags suspicious PowerShell on a finance workstation. Windows logs show the script started immediately after a patch-management tool launched from the software distribution server. The script only queries installed software and writes results to a log file. What is the most likely conclusion?

A.The alert is likely a false positive because the activity matches approved patch-management behavior

B.The workstation is definitely compromised because PowerShell is always malicious

C.The endpoint should be immediately wiped because the script wrote to a log file

D.The software distribution server should be blocked from the network permanently

AnswerA

This alert is best classified as a false positive because the detected PowerShell activity aligns with a known, approved patch-management workflow. In enterprise environments, patch-management platforms routinely execute PowerShell scripts on endpoints to inventory software, check patch status, and install updates, often in coordination with the local distribution server. The existence of a matching policy or change-control record, combined with the script's behavior and the trusted source (the distribution server), strongly indicates legitimate administrative activity rather than malicious code execution. EDR alerts must be correlated with environmental context and known-good baselines before escalating to an incident.

Why this answer

The EDR alert is likely a false positive because the PowerShell script's behavior—querying installed software and writing results to a log file—is consistent with legitimate patch-management inventory tasks. The script's execution immediately after the patch-management tool launched from the software distribution server indicates it was triggered by that tool as part of its normal operations, not by an attacker. Since the activity matches approved patch-management behavior and shows no signs of malicious intent (e.g., data exfiltration, lateral movement, or persistence), the alert should be investigated but is most likely a false positive.

Exam trap

The trap here is that candidates often assume any PowerShell execution is malicious, but the SY0-701 exam tests the ability to correlate process ancestry and script behavior to distinguish legitimate administrative activity from actual threats.

How to eliminate wrong answers

Option B is wrong because it incorrectly assumes PowerShell is always malicious, ignoring that PowerShell is a legitimate administrative tool widely used for automation and inventory tasks in enterprise environments. Option C is wrong because writing to a log file is a standard, non-malicious operation; immediate wiping is an extreme and unnecessary response that would disrupt business operations without evidence of compromise. Option D is wrong because permanently blocking the software distribution server would break critical patch-management workflows; the server is the likely source of the legitimate script, not a threat actor.

Practice this question →

201

MCQeasy

A firewall rule must be changed to allow a vendor update server. Which step best reduces the chance of an unexpected outage?

A.Make the change directly in production without review to save time.

B.Document the change, get approval, and include a rollback plan.

C.Disable the firewall temporarily while the update is tested.

D.Apply the rule but do not tell anyone so there is less paperwork.

AnswerB

This is the best answer because secure change management uses approval and rollback planning to reduce operational risk. Documenting the requested change ensures the impact is reviewed, and a rollback plan gives the team a way to quickly restore service if the update causes problems. These controls help prevent outages caused by rushed or poorly understood production changes.

Why this answer

Following a formal change management process—documenting the change, obtaining approval, and including a rollback plan—ensures that the firewall rule modification is reviewed for potential impacts, authorized by stakeholders, and can be reverted if it causes an outage. This structured approach minimizes the risk of unexpected downtime by validating the change in a controlled manner and providing a safety net.

Exam trap

CompTIA often tests the misconception that speed or convenience (like disabling the firewall or skipping approval) is acceptable for urgent changes, but the exam emphasizes that proper change management is always required to prevent outages and maintain security.

How to eliminate wrong answers

Option A is wrong because making the change directly in production without review bypasses change management, increasing the risk of misconfiguration or unintended access that could cause an outage. Option C is wrong because disabling the firewall temporarily exposes the network to all traffic, creating a security vulnerability and potentially causing a different type of outage from malicious activity. Option D is wrong because applying the rule without notification violates change control policies, prevents stakeholders from preparing for potential impacts, and eliminates the ability to coordinate a rollback if issues arise.

Practice this question →

202

MCQeasy

A company wants to make sure it can recover quickly after ransomware, even if the production network is unavailable. Which backup approach is the best choice?

A.Store backups only on the same file server so they are easy to access.

B.Keep an offline copy of backups that is disconnected from production systems.

C.Use a single monthly backup and never test restores to save time.

D.Save backups in the same cloud account using the same admin credentials.

AnswerB

An offline backup, such as a disk disconnected from the network or stored in an air-gapped environment, is not addressable by production systems or the ransomware running on them. Because the attacker cannot reach the media during the encryption or deletion phase, the copy remains intact and provides a clean, authoritative restore source. This directly supports the 3-2-1 backup rule: three copies, two different media, one offsite and offline, ensuring recoverability even when every online copy is compromised.

Why this answer

An offline (air-gapped) backup, such as a tape stored in a safe or a disconnected external drive, ensures that ransomware cannot encrypt or delete the backup data. This approach guarantees recoverability even when the production network is completely compromised or unavailable, aligning with the 3-2-1 backup rule (three copies, two media types, one offsite/offline).

Exam trap

The trap here is that candidates may think 'offline' means simply not connected to the internet, but the key is physical or logical disconnection from the production network to prevent ransomware from reaching the backup during an active attack.

How to eliminate wrong answers

Option A is wrong because storing backups on the same file server means they share the same attack surface; ransomware can encrypt or delete them alongside production data, making recovery impossible. Option C is wrong because a single monthly backup without testing restores violates the principle of recovery point objective (RPO) and recovery time objective (RTO); untested backups may be corrupt or incomplete, and the long interval between backups risks significant data loss.

Practice this question →

203

MCQeasy

A SOC analyst sees 20 failed logins for one user account, followed by a successful login 30 seconds later from the same office subnet. The user confirms they mistyped the password several times. What is the best conclusion?

A.It is definitely a brute-force attack and should be treated as confirmed compromise.

B.It is most likely a false positive caused by user error and should be documented after verification.

C.It is evidence of malware on the user's workstation until the device is rebuilt.

D.It proves the password was changed by an attacker and the account must be disabled immediately.

AnswerB

The most plausible explanation is that the user mistyped their password repeatedly due to human error, such as Caps Lock being active, an expired password, or a typo, and the login attempts originated from a location consistent with the user's typical behavior. The analyst should verify the user's account, correlate the timestamps with the user's reported activity, and document the incident as a false positive for compliance and future correlation. This approach aligns with the incident response principle of validating alerts with context before escalating, avoiding alert fatigue and unnecessary operational disruption.

Why this answer

The scenario shows 20 failed logins followed by a successful login from the same office subnet, and the user confirms they mistyped the password. This pattern is consistent with user error (e.g., Caps Lock or typo), not an automated brute-force attack, which would typically show a much higher volume of attempts from diverse IPs. The best conclusion is a false positive, which should be documented after verification to maintain accurate incident records.

Exam trap

The trap here is that candidates may overreact to multiple failed logins as a brute-force attack, ignoring the user's confirmation and the same-subnet source, which are classic indicators of user error rather than malicious activity.

How to eliminate wrong answers

Option A is wrong because a brute-force attack would involve hundreds or thousands of attempts from multiple IP addresses, not just 20 from the same subnet, and a successful login from the user's own subnet with user confirmation of error makes an attack unlikely. Option C is wrong because there is no evidence of malware; failed logins followed by a successful login from the same subnet are not indicative of malware activity, and rebuilding the device is an extreme, unnecessary response. Option D is wrong because the successful login occurred from the same office subnet, not an attacker's IP, and the user confirmed they mistyped the password; there is no evidence the password was changed, and disabling the account would be premature without further investigation.

Practice this question →

204

MCQmedium

A SOC analyst confirms that an employee entered credentials into a phishing site and that the mailbox now shows a new forwarding rule sending messages to an external address. The account is still signed in on a laptop and a mobile phone. What is the best next action?

A.Wait for the user to log out naturally before taking action.

B.Revoke active sessions and force a password reset for the account.

C.Archive the mailbox and close the ticket after notifying the user.

D.Delete the forwarding rule only and consider the incident closed.

AnswerB

Revoking active sessions immediately invalidates any authentication tokens, cookies, or session identifiers the attacker may have captured, cutting off their current access to the mailbox. Forcing a password reset ensures that the compromised password is no longer valid, preventing the attacker from re-authenticating even if they attempt to log in again. This dual action directly addresses both the active session compromise and the credential compromise, which is essential for containing the incident.

Why this answer

The immediate priority is to contain the compromised account by terminating all active sessions (revoking OAuth tokens, clearing SAML sessions) and forcing a password reset to prevent further unauthorized access. The mailbox forwarding rule indicates the attacker has established persistence, and the active sessions on the laptop and mobile phone mean the attacker could still be using the account. Revoking sessions ensures the attacker cannot continue exfiltration or lateral movement, while the password reset invalidates the stolen credentials.

Exam trap

The trap here is that candidates may think waiting for the user to log out (Option A) is acceptable because the user is still signed in, but in security operations, you must assume the attacker has active access and act immediately to revoke sessions rather than relying on user behavior.

How to eliminate wrong answers

Option A is wrong because waiting for the user to log out naturally gives the attacker continued access to the account, allowing further data exfiltration via the forwarding rule or other malicious actions. Option C is wrong because archiving the mailbox and closing the ticket without revoking sessions or resetting the password leaves the account compromised, the forwarding rule active, and the attacker still able to access the account and modify settings.

Practice this question →

205

MCQmedium

A SOC analyst confirms that a workstation is encrypting local files and attempting SMB connections to nearby hosts. The user is still logged in, and the business wants to limit spread without destroying evidence. What is the best immediate action?

A.Power the workstation off immediately and leave it in place

B.Quarantine the workstation from the network using EDR or switch port containment

C.Run a full antivirus scan while the workstation remains connected

D.Wipe and reimage the workstation from a standard build image

AnswerB

This is the best immediate containment action because it stops further spread while preserving evidence. EDR quarantine or disabling the switch port isolates the infected host without unnecessarily powering it down. The SOC can then collect volatile and disk evidence, determine the scope of infection, and proceed with eradication and recovery steps in the proper incident response sequence.

Why this answer

Quarantining the workstation via EDR or switch port containment immediately stops the SMB-based lateral movement and further encryption of network shares, while preserving the volatile evidence (memory, running processes, encryption keys) for forensic analysis. This aligns with the business requirement to limit spread without destroying evidence, as powering off or reimaging would lose critical forensic data.

Exam trap

The trap here is that candidates think powering off (Option A) is the fastest way to stop spread, but CompTIA emphasizes preserving evidence and avoiding destruction of volatile data, making network quarantine the correct choice.

How to eliminate wrong answers

Option A is wrong because powering off the workstation destroys volatile evidence (e.g., encryption keys in memory, active network connections) and may trigger anti-forensic mechanisms in the ransomware. Option C is wrong because running a full antivirus scan while the workstation remains connected allows the ransomware to continue encrypting local files and spreading via SMB to nearby hosts, violating the goal to limit spread. Option D is wrong because wiping and reimaging destroys all evidence, including the ransomware binary, encryption artifacts, and forensic traces needed for incident response and attribution.

Practice this question →

206

Multi-Selectmedium

A security analyst is reviewing the organization's incident response procedures. According to the NIST SP 800-61 framework, which four of the following are recognized phases of the incident response lifecycle? (Choose four.)

Select 4 answers

.Preparation

.Detection and Analysis

.Containment, Eradication, and Recovery

.Post-Incident Activity

.Threat Hunting

.Risk Assessment

Why this answer

The NIST SP 800-61 Revision 2 framework defines the incident response lifecycle as consisting of four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. These phases form a continuous cycle, with lessons learned from Post-Incident Activity feeding back into Preparation. The question asks for the four recognized phases, and these four options directly match the NIST model.

Exam trap

The trap here is that candidates may confuse proactive security activities like Threat Hunting or Risk Assessment with the formal incident response phases, but NIST SP 800-61 strictly lists only the four phases given as correct answers.

Practice this question →

207

MCQeasy

A legacy application cannot be patched for two weeks, but the security team still wants to reduce risk in the meantime. What is the best temporary measure?

A.Do nothing until the patch window opens.

B.Add a compensating control such as restricting access to the system.

C.Disable all logging so the system runs faster.

D.Rename the application so attackers cannot find it.

AnswerB

Restricting access is a compensating control: it reduces the exposure window created by the unpatched legacy application without modifying it. Patching is unavailable for two weeks, so access restriction is the only measure that lowers risk during that period.

Why this answer

Implementing a compensating control, such as restricting network access via firewall rules or disabling unnecessary services, reduces the attack surface while the legacy application remains unpatched. This aligns with the principle of defense-in-depth, where temporary mitigations like access control lists (ACLs) or host-based firewalls can block exploit vectors until the patch is applied.

Exam trap

The trap here is that candidates may choose 'Do nothing' assuming patching is the only valid action, but CompTIA expects you to recognize that compensating controls are a standard risk management strategy when immediate patching is not feasible.

How to eliminate wrong answers

Option A is wrong because doing nothing leaves the vulnerability exposed, increasing the risk of exploitation during the two-week window, which violates the security team's goal of risk reduction. Option C is wrong because disabling logging degrades visibility and audit capabilities, making it harder to detect or investigate attacks, and does not address the underlying vulnerability.

Practice this question →

208

MCQmedium

A weekly scan reports three findings: a medium-severity missing patch on a lab VM with no network access, a high-severity default credential on a management interface reachable from the internet, and a low-severity outdated browser plug-in on a visitor kiosk. Which issue should be remediated first?

A.The medium-severity missing patch on the isolated lab VM.

B.The low-severity outdated browser plug-in on the visitor kiosk.

C.The high-severity default credential on the management interface exposed to the internet.

D.All three issues have the same priority because they were found in the same scan cycle.

AnswerC

Default credentials on a management interface exposed to the internet represent a critical risk because they are publicly known, easily tested by automated tools, and provide immediate administrative access if successfully used. The internet exposure makes the vulnerability remotely exploitable without authentication, and a management interface often has elevated privileges, enabling full system control. This combination of high severity, high exploitability, and direct internet accessibility must be the top priority.

Why this answer

The high-severity default credential on a management interface reachable from the internet represents an immediate, exploitable risk. Default credentials are well-known and can be used by attackers to gain full administrative control over the device, often leading to a complete compromise of the network. In contrast, the other findings have compensating controls (no network access) or lower impact (outdated browser plug-in), making them lower priority in a risk-based remediation strategy.

Exam trap

The trap here is that candidates focus solely on the severity label (high vs. medium vs. low) without considering the compensating controls or exposure, leading them to incorrectly rank the missing patch or outdated plug-in as higher priority.

How to eliminate wrong answers

Option A is wrong because the lab VM has no network access, which means the missing patch cannot be exploited remotely; the risk is contained and can be remediated later. Option B is wrong because an outdated browser plug-in on a visitor kiosk is low severity and typically has limited attack surface (e.g., no saved credentials, restricted user privileges), so it does not pose an immediate threat compared to an internet-exposed default credential. Option D is wrong because not all findings have the same priority; risk severity is determined by both the vulnerability's severity and the exposure/impact, and the high-severity default credential with internet exposure clearly outweighs the others.

Practice this question →

209

MCQmedium

After a ransomware event, the team restores a file server from backup, but management wants proof that the restore process will work before the backups are declared trusted. What should be done next?

A.Delete the old backup copies to prevent future confusion

B.Perform a test restore in an isolated environment and verify the recovered data

C.Switch to incremental backups only so the next restore is faster

D.Store the backups on the same file server so they are easier to access

AnswerB

A test restore is the best way to validate backup integrity and operational readiness after an incident. Restoring in isolation confirms that the backup can be used successfully without risking production systems. Verification should include checking file integrity, application access if relevant, and whether the restored data meets recovery objectives. This provides evidence that backups remain trustworthy after ransomware.

Why this answer

The only way to prove that backups are trustworthy is to perform a test restore in an isolated environment, verifying the integrity and completeness of the recovered data. This validates that the backup process, media, and software are functioning correctly without risking the production environment. Without a successful test restore, the team cannot confirm that the backups are free from corruption, encryption, or other issues that would prevent a real recovery.

Exam trap

The trap here is that candidates may think simply having backups is sufficient proof of recoverability, but the exam emphasizes that only a successful test restore in an isolated environment can validate the backup's integrity and the restore process itself.

How to eliminate wrong answers

Option A is wrong because deleting old backup copies does not prove the restore process works and actually removes potentially valuable recovery points, violating the 3-2-1 backup rule. Option C is wrong because switching to incremental backups only does not validate the current restore process; it changes the backup strategy without addressing the need for proof of recoverability, and incremental backups actually require a full backup chain to restore, increasing complexity. Option D is wrong because storing backups on the same file server violates the fundamental principle of backup isolation, making them vulnerable to the same ransomware attack that encrypted the original data, and it does not test the restore process at all.

Practice this question →

210

MCQeasy

A new SIEM rule generates many alerts from a scheduled backup job that is known to be legitimate. What should the analyst do to improve alert quality?

A.Disable all logging for the backup server.

B.Tune the rule to exclude the known backup activity pattern.

C.Ignore the alerts permanently because the job is approved.

D.Reimage the backup server to stop the alerts.

AnswerB

Alert tuning should reduce false positives without losing useful detection. If the backup job is documented and legitimate, the analyst can adjust the rule to exclude that approved activity pattern or server. This keeps the SIEM useful and helps responders focus on real suspicious behavior instead of repeated harmless alerts.

Why this answer

Tuning the SIEM rule to exclude the known backup activity pattern reduces false positives while preserving detection of actual threats. By creating an exception for the specific backup server's IP, schedule, or process hash, the analyst maintains visibility into anomalous behavior without being overwhelmed by noise.

Exam trap

The trap here is that candidates may choose to disable logging or ignore alerts, confusing operational convenience with proper security hygiene, when the correct approach is to refine detection logic through tuning.

How to eliminate wrong answers

Option A is wrong because disabling all logging for the backup server would create a blind spot, preventing detection of real threats like ransomware encrypting backup data or unauthorized access to backup files. Option C is wrong because ignoring alerts permanently violates security monitoring best practices and could allow a malicious actor to hide activity within the backup job's noise. Option D is wrong because reimaging the backup server is an extreme, unnecessary measure that does not address the root cause—the SIEM rule's lack of specificity—and would disrupt operations without solving the alert volume issue.

Practice this question →

211

MCQmedium

An organization is retiring a batch of laptops with SSDs. All of the systems used full-disk encryption and stored sensitive internal documents. What is the best action before the devices leave the company?

A.Run a quick format and remove the asset tags after the files are deleted.

B.Perform a cryptographic erase by destroying the encryption keys and document the sanitization process.

C.Degauss the SSDs and then store them in the disposal room until pickup.

D.Overwrite the drives once with random data and consider the devices ready for resale.

AnswerB

For encrypted SSDs, destroying the encryption keys is an effective and practical sanitization method because the data becomes unreadable even if the drive is later examined. This approach matches the media type and the fact that full-disk encryption was used. Proper documentation also supports accountability and compliance. It is stronger than merely deleting files or performing a superficial format, which may leave recoverable data behind.

Why this answer

A cryptographic erase (also known as a crypto-scrub) renders the encrypted data permanently inaccessible by securely destroying the encryption keys. Since the SSDs used full-disk encryption (FDE), the data is already encrypted at rest, and without the keys, the ciphertext is effectively unrecoverable. This method is fast, reliable, and compliant with sanitization standards like NIST SP 800-88, making it the best action before the devices leave the organization.

Exam trap

The trap here is that candidates often choose degaussing (Option C) for SSDs, mistakenly applying a technique that works only for magnetic media like HDDs, while ignoring that cryptographic erase is the proper and efficient method for encrypted solid-state drives.

How to eliminate wrong answers

Option A is wrong because a quick format only removes the file system pointers, not the actual data; the encrypted content remains on the SSD and could potentially be recovered if the encryption keys are still present. Option C is wrong because degaussing SSDs is ineffective—SSDs use flash memory that is not affected by magnetic fields, and degaussing can physically destroy the drive without guaranteeing data removal. Option D is wrong because overwriting SSDs with random data is unreliable due to wear-leveling and over-provisioning; the SSD firmware may remap bad blocks, leaving remnants of the original encrypted data intact.

Practice this question →

212

MCQmedium

A security analyst receives an automated alert indicating that a standard user account logged in from a geographic location that is unusual for the user, and the login occurred at 3:00 AM local time. The analyst has not yet verified whether this was a successful login or if any additional suspicious activity occurred. According to standard incident response procedures, what should the analyst do NEXT?

A.Disable the user account immediately and reset the password.

B.Conduct a full forensic analysis of the user's workstation.

C.Review the account's recent activity for signs of compromise.

D.Report the incident to law enforcement.

AnswerC

Reviewing recent activity (e.g., successful logins, file access, privilege escalation attempts) is the appropriate analysis step to validate the alert. This helps determine if the account is compromised and guides subsequent containment and eradication actions.

Why this answer

According to standard incident response procedures, after receiving an alert about unusual login activity, the analyst should first review the account's recent activity to determine whether the login was successful and if any compromise occurred. This is part of the identification/validation phase before taking containment actions.

Exam trap

SY0-701 often tests the order of incident response steps — candidates jump to containment (disable account) before validation, but the correct next step is always to verify and scope the incident first.

Why the other options are wrong

Disabling the account and resetting the password is premature because the analyst has not yet confirmed the login was successful or that any compromise occurred. Standard incident response procedures require initial triage and verification before taking containment actions.

Conducting a full forensic analysis of the user's workstation is premature at this stage because the alert only indicates an unusual login; the analyst has not yet verified if the login was successful or if any compromise occurred. Standard incident response procedures require initial triage and verification before escalating to forensic analysis.

Reporting to law enforcement is premature at this stage because the analyst has not yet verified if the login was successful or if any malicious activity occurred. Standard incident response procedures require initial triage and confirmation of a security incident before involving external authorities.

Practice this question →

213

Multi-Selecthard

A SIEM report shows this sequence over 25 minutes: the same public IP submitted one failed password attempt against 53 different accounts, then one account successfully authenticated, created an inbox forwarding rule, and downloaded hundreds of messages through the web portal. Which two conclusions are best supported? Select two.

Select 2 answers

A.The pattern is consistent with a password spraying attack.

B.The attacker is performing a brute-force attack against one account.

C.The activity is most likely credential stuffing with multiple known password pairs.

D.The successful account is likely compromised and being used for persistence or mailbox abuse.

E.The events primarily indicate a denial-of-service attack against the mail system.

AnswersA, D

Password spraying is a low-and-slow attack where an adversary tries a small set of common passwords against many accounts, usually one attempt per account per pass to avoid triggering lockout policies. The SIEM sequence of repeated single failed logins across different users from the same source IP over 25 minutes matches this pattern exactly: no individual account is hammered, yet the cumulative authentication attempt volume is high. The eventual successful login indicates that at least one account was using a weak, predictable password that the attacker had guessed in the spraying cycle.

Why this answer

The SIEM shows a single public IP attempting one failed password against 53 different accounts over 25 minutes. This pattern—low-and-slow, one attempt per account—is the hallmark of a password spraying attack, which avoids account lockout thresholds by never hitting the same account repeatedly. The subsequent successful authentication and mailbox abuse confirm the attacker found a weak password for one account.

Exam trap

The trap here is confusing password spraying (one password, many accounts) with brute-force (many passwords, one account) or credential stuffing (many known pairs), leading candidates to pick B or C despite the single-IP, single-attempt-per-account pattern.

Practice this question →

214

MCQeasy

Based on the exhibit, what should the analyst do next to limit the impact of the suspected compromise?

A.Run a full antivirus scan first and wait for the results before taking any other action.

B.Isolate FIN-LT-22 from the network to contain the suspected malware activity.

C.Reboot the laptop to clear the malicious process from memory.

D.Reset the user's password and close the ticket after confirming they can log in again.

AnswerB

Network isolation is the best immediate containment step when an endpoint shows signs of active malicious behavior. It limits further command-and-control traffic, prevents lateral movement, and buys time for investigation. In incident response, containment comes before eradication and recovery when the threat is still active.

Why this answer

Isolating FIN-LT-22 from the network immediately stops the suspected malware from communicating with command-and-control servers or spreading laterally to other hosts. This containment step aligns with the NIST incident response framework's containment phase, which prioritizes limiting damage before eradication or recovery. In a suspected compromise, network isolation (e.g., disabling the switch port or using a host-based firewall rule) is the fastest way to cut off malicious traffic without destroying volatile evidence in memory.

Exam trap

The trap here is that candidates often choose to run an antivirus scan first (Option A) because they assume detection must precede containment, but the SY0-701 exam emphasizes that containment is the immediate priority to limit impact, even before identifying the specific malware.

How to eliminate wrong answers

Option A is wrong because running a full antivirus scan first wastes critical time and may alert the attacker or trigger destructive actions before containment; antivirus also relies on signatures and may miss unknown malware. Option C is wrong because rebooting clears volatile memory (RAM), destroying evidence of the malicious process and potentially allowing persistence mechanisms to re-establish on startup, which violates forensic best practices. Option D is wrong because resetting the user's password does not address the active malware on the endpoint; the attacker could still maintain access via a backdoor or keylogger, and closing the ticket prematurely ignores the need for containment and eradication.

Practice this question →

215

MCQmedium

A security analyst is reviewing authentication logs and observes multiple failed login attempts for a single user account occurring within a short timeframe, followed by a successful login from an IP address located in a country where the user has never traveled. The failed attempts originate from various IP addresses and use different passwords. Which type of attack has most likely occurred?

A.Brute-force attack

B.Credential stuffing

C.Password spraying

D.Dictionary attack

AnswerA

Correct. A brute-force attack is characterized by systematically trying many different passwords against a single account until the correct one is found. The log pattern of multiple failed attempts followed by a success aligns with this method.

Why this answer

(Brute-force attack) because the log shows multiple failed login attempts from various IP addresses using different passwords, followed by a successful login from an unfamiliar country. This pattern indicates a distributed brute-force attack where the attacker systematically tries many passwords against a single account, often using a botnet or proxy rotation to evade IP-based rate limiting. The successful login from a foreign IP confirms the attacker eventually guessed the correct password.

Exam trap

The trap here is that candidates confuse 'multiple failed attempts from various IPs' with credential stuffing, but the key differentiator is that credential stuffing uses known credential pairs, not systematically generated passwords against a single account.

Why the other options are wrong

Credential stuffing uses previously breached username/password pairs from other services, but the question states the failed attempts used different passwords, not reused credentials from breaches.

Password spraying involves trying a single common password against many user accounts, not multiple passwords against a single account as described in the question.

A dictionary attack uses a predefined list of likely passwords (e.g., common words or variations) against a single account, but the question describes failed attempts with 'different passwords' from various IPs, which is more consistent with a brute-force attack that systematically tries many passwords.

Practice this question →

216

MCQmedium

Based on the exhibit, which action should the incident response team take next to eradicate the threat?

A.Return the workstation to the user since the outbound connection was blocked.

B.Delete only the scheduled task and reconnect the host to monitor for more alerts.

C.Reimage the endpoint from a known-good build and reset potentially exposed credentials.

D.Close the incident because memory capture has already preserved the evidence.

AnswerC

The logs show a likely malicious macro, encoded PowerShell, a dropped script, and persistence through a scheduled task. That combination indicates a high-confidence compromise with uncertain scope. Reimaging removes hidden persistence more reliably than piecemeal cleanup, and credential resets are appropriate because finance activity occurred on the device and credentials may have been captured.

Why this answer

The exhibit indicates a confirmed compromise (e.g., a scheduled task establishing outbound C2 traffic). Eradication requires removing all traces of the attacker's foothold, which is best achieved by reimaging the endpoint from a known-good build. Additionally, any credentials that may have been exposed during the compromise must be reset to prevent lateral movement or re-entry.

Exam trap

The trap here is that candidates may think deleting the scheduled task (Option B) is sufficient for eradication, but CompTIA emphasizes that any confirmed compromise requires full reimaging to ensure no hidden persistence remains.

How to eliminate wrong answers

Option A is wrong because simply returning the workstation to the user after blocking an outbound connection does not remove the underlying threat (e.g., the scheduled task or persistence mechanism) and assumes the attacker cannot adapt or use alternate C2 channels. Option B is wrong because deleting only the scheduled task leaves other potential persistence mechanisms (e.g., registry run keys, services, or WMI subscriptions) intact, and reconnecting the host without full remediation risks re-infection or continued attacker access. Option D is wrong because closing the incident after memory capture ignores the need for eradication; evidence preservation does not eliminate the active threat, and the host remains compromised.

Practice this question →

217

MCQeasy

A company laptop is collected as evidence in a suspected theft case. Which action best supports chain of custody?

A.Place the laptop on a desk until the investigator is available.

B.Record each transfer with date, time, handler name, and signatures.

C.Reset the laptop so the legal team can access it more easily.

D.Remove the hard drive and connect it to a personal workstation.

AnswerB

Chain of custody requires a documented record of who handled the evidence, when it changed hands, and under what conditions. These records help prove integrity and admissibility later. Accurate transfer documentation is one of the most important parts of evidence handling in a forensic case.

Why this answer

Chain of custody requires documenting every transfer of evidence with date, time, handler name, and signatures to maintain a verifiable record of who had possession of the laptop at all times. This ensures the evidence is admissible in court by proving it has not been tampered with or altered since collection. Without this documentation, the defense could argue the evidence was compromised, undermining the entire case.

Exam trap

CompTIA often tests the misconception that preserving evidence means making it easier to access (like resetting or removing components), when in fact the priority is maintaining the original state and documenting every touchpoint to ensure legal admissibility.

How to eliminate wrong answers

Option A is wrong because leaving the laptop on a desk unattended violates the principle of secure evidence handling, as it creates an unaccounted gap in custody where the device could be tampered with or accessed by unauthorized individuals. Option C is wrong because resetting the laptop destroys all data, including potential evidence such as logs, files, and user activity, which is irreversible and violates forensic best practices that require preserving the original state of evidence. Option D is wrong because removing the hard drive and connecting it to a personal workstation risks altering the drive's contents (e.g., timestamps, metadata) and introduces potential contamination from the workstation's operating system, breaking the chain of custody and compromising forensic integrity.

Practice this question →

218

MCQmedium

A security analyst notices that a phishing campaign is targeting employees with emails that appear to be from the company's IT support team. The emails contain a link to a website that mimics the corporate password reset portal. Which of the following controls would be MOST effective in preventing users from reaching the malicious website, assuming the link uses HTTPS?

A.Implement a URL filtering policy on the company's web proxy.

B.Deploy an email security gateway that performs sandboxing of attachments.

C.Enable multi-factor authentication on all corporate accounts.

D.Conduct a security awareness training session on phishing.

AnswerA

Implementing URL filtering on the corporate web proxy is a preventive technical control that actively blocks access to known malicious, phishing, or lookalike domains at the network layer. The proxy inspects the requested URL and domain against real-time reputation feeds and policy categories; if the destination matches a threat intel blocklist, the connection is terminated before the browser loads the page. Because it operates in-line on HTTP and HTTPS traffic (using SNI/TLS inspection or DNS resolution), this control disrupts the phishing kill chain regardless of how the link was delivered, including via webmail, social media, or messaging apps. It does not rely on user judgment, making it a more consistent and automated safeguard than awareness training.

Why this answer

A URL filtering policy on the company's web proxy is the most effective control because it can block access to the malicious website based on its domain, category, or reputation, regardless of whether the link uses HTTPS. Since the proxy can perform SSL/TLS inspection (decrypting the HTTPS traffic) or use domain reputation lists, it prevents users from even reaching the phishing site. This directly addresses the core issue of users navigating to a known or suspicious URL.

Exam trap

The trap here is that candidates assume HTTPS encryption makes URL filtering impossible, but the exam expects you to know that web proxies can inspect or block HTTPS traffic using SSL/TLS decryption or domain-based filtering, making URL filtering still effective.

Why the other options are wrong

The question specifies that the link uses HTTPS, so sandboxing attachments is irrelevant because the threat is a link in the email body, not an attachment. Email sandboxing analyzes file attachments for malware, not URLs.

Multi-factor authentication (MFA) protects against credential theft after a user reaches a malicious site, but it does not prevent users from initially accessing the site. The question asks for a control to prevent reaching the malicious website, not to mitigate the impact of credential compromise.

Security awareness training educates users to recognize phishing, but it does not prevent users from reaching the malicious website if they click the link. The question asks for a control that prevents access to the site, not user behavior.

Practice this question →

219

MCQeasy

A server room is sometimes left open while technicians carry equipment in and out. Which control best helps detect and discourage unauthorized entry?

A.A written reminder poster on the wall

B.A CCTV camera covering the entrance

C.A brighter color for the server room door

D.A larger monitor in the nearby office

AnswerB

A CCTV camera covering the entrance provides continuous surveillance, which both deters opportunistic intrusion and creates a forensic record of anyone who approaches or enters the server room. Video footage serves as an auditable trail that can be reviewed during incident investigations, and modern systems can integrate with motion detection, cloud storage, and retention policies for extended evidence availability. While it does not physically block entry, it actively monitors the perimeter and provides accountability, making it a critical detective and deterrent control.

Why this answer

A CCTV camera covering the entrance provides continuous monitoring and recording of activity, which both detects unauthorized entry in real time and creates a deterrent effect through the awareness of surveillance. Unlike passive measures, it offers forensic evidence and can be integrated with access control systems to alert security personnel of breaches.

Exam trap

The trap here is that candidates may confuse administrative controls like signage with detective controls, overlooking that only active surveillance (CCTV) provides both detection and deterrence for an unsecured physical entry point.

How to eliminate wrong answers

Option A is wrong because a written reminder poster is a passive administrative control that relies on voluntary compliance and provides no detection or deterrence against intentional unauthorized entry. Option C is wrong because a brighter color for the door is purely cosmetic and has no impact on security monitoring, access control, or deterring unauthorized individuals.

Practice this question →

220

Matchingmedium

Match each incident response action to its primary purpose during a suspected endpoint compromise.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Contain the incident and limit spread to other systems

Preserve evidence that could disappear after power-off

Eradicate persistence and return the system to a trusted state

Recover business operations and return service to normal

Complete lessons learned and improve future response

Why these pairings

Incident response actions are sequenced to contain, preserve, analyze, remove, and learn from the incident. Isolating prevents spread; volatile data capture is time-sensitive; imaging preserves evidence; log analysis reveals details; eradication cleans the system; lessons learned improve processes.

Practice this question →

221

MCQmedium

A security analyst in the SOC is investigating a potential DNS tunneling incident. The analyst has identified a workstation that is making thousands of DNS queries to an external domain with base64-encoded subdomains. The analyst suspects that sensitive files from the workstation are being exfiltrated by encoding their contents into the subdomains of the DNS queries. Which of the following log sources will provide the most definitive evidence to confirm that the contents of a specific sensitive file are being transmitted in the DNS queries?

A.The DNS server logs showing the queried domains and subdomains.

B.The workstation's process creation logs showing which process initiated the DNS queries.

C.A full packet capture of the network traffic from the workstation showing the complete DNS messages.

D.The firewall logs showing outbound connections from the workstation to the external DNS server on port 53.

AnswerC

A full packet capture includes the entire DNS query packet, including the complete subdomain portion. The analyst can extract and decode the base64-encoded subdomain data and compare it directly to the contents of a sensitive file on the workstation to definitively confirm data exfiltration.

Why this answer

A full packet capture (PCAP) contains the complete DNS query and response messages, including the raw payload of the subdomain fields. This allows the analyst to extract the base64-encoded data from the subdomains and decode it to verify that it matches the contents of the suspected sensitive file. DNS server logs (option A) typically only record the queried domain names, not the full DNS message payload, and may truncate long subdomains.

Process creation logs (option B) show which executable made the queries but not the data being sent. Firewall logs (option D) only show connection metadata (source, destination, port) and never the DNS query content.

Exam trap

The trap here is that candidates assume DNS server logs contain the full query payload, but in practice they often log only the resolved domain name and may truncate long subdomains, making packet capture the only definitive source for reconstructing exfiltrated data.

Why the other options are wrong

DNS server logs typically show only the queried domain names and subdomains, not the full DNS message payload. Since base64-encoded subdomains are part of the query, the logs would reveal the encoded data, but without the full packet capture, you cannot definitively confirm that the contents of a specific sensitive file are being transmitted—you only see the encoded strings, not the original file content or the exact mapping.

Process creation logs show which process initiated the DNS queries but do not reveal the actual content of the DNS queries, such as the base64-encoded subdomains carrying exfiltrated data.

Firewall logs show only connection metadata (IPs, ports, timestamps) and cannot reveal the contents of DNS queries, so they cannot confirm that file contents are being transmitted.

Practice this question →

222

MCQhard

Based on the exhibit, which change best improves recovery resilience against a repeat ransomware incident?

A.Keep the current design and add more NAS storage capacity.

B.Move the NAS to the same subnet as the file server for faster backups.

C.Use an immutable or offline backup copy that production credentials cannot modify.

D.Shorten the backup retention period to reduce storage use.

AnswerC

The incident showed that the attacker could encrypt both production and the backup share because the backup target stayed online and writable. An immutable or offline copy breaks that dependency and prevents the same credentials from destroying recovery data. In ransomware recovery, backup survivability matters more than convenience, so this change gives the strongest resilience improvement.

Why this answer

Ransomware often encrypts or deletes accessible backups. An immutable or offline backup copy (e.g., using S3 Object Lock, Write Once Read Many (WORM) storage, or air-gapped tape) ensures that even if production credentials are compromised, the backup data cannot be modified or deleted by the attacker. This directly preserves a clean recovery point after a ransomware incident.

Exam trap

The trap here is that candidates often assume faster backups (Option B) or more capacity (Option A) improve resilience, but they overlook the fundamental requirement that backups must be protected from modification by the attacker, which only immutability or an air gap provides.

How to eliminate wrong answers

Option A is wrong because adding more NAS storage capacity does not protect existing backups from being encrypted or deleted by ransomware; it only increases the volume of data at risk. Option B is wrong because moving the NAS to the same subnet as the file server exposes the backup storage to the same network-based attacks and lateral movement, making it easier for ransomware to reach and corrupt the backups. Option D is wrong because shortening the backup retention period reduces the number of available recovery points, increasing the risk of data loss and potentially eliminating the last clean backup before the ransomware attack.

Practice this question →

223

Multi-Selectmedium

EDR flags encoded PowerShell launched by a spreadsheet application and an outbound HTTPS connection to a rare domain. Which two response actions are best to take from the EDR console first? Select two.

Select 2 answers

A.Isolate the endpoint from the network through the EDR platform

B.Collect a triage package or memory snapshot before remediation, if supported

C.Uninstall the spreadsheet application immediately

D.Reboot the endpoint to clear the suspicious script

E.Wait for a second alert before taking any action

AnswersA, B

Endpoint isolation via the EDR agent should be the immediate response because it severs active command-and-control channels and prevents lateral movement to adjacent hosts, while the management plane remains available for authorized forensic actions. Unlike unplugging the network cable, EDR-based isolation allows the responder to push collection tools or pull telemetry, preserving the host's state for memory analysis. This containment step aligns with incident response priorities: stop the spread before eradication, and retain visibility into the attacker's activity.

Why this answer

Isolating the endpoint from the network (A) is correct because it immediately stops the outbound HTTPS connection to the rare domain, preventing potential command-and-control (C2) data exfiltration or further payload download. Collecting a triage package or memory snapshot (B) is correct because the encoded PowerShell script and suspicious process chain are volatile artifacts that may be lost on reboot or remediation, and capturing them preserves forensic evidence for analysis.

Exam trap

CompTIA often tests the misconception that rebooting or uninstalling the application is a valid first response, when in fact both destroy volatile evidence and fail to contain the active threat.

Practice this question →

224

MCQmedium

A monthly scan finds a critical remote-code-execution issue on an internet-facing VPN appliance. The vendor has released a fix, but the appliance can only be rebooted during the weekend maintenance window in five days. What is the BEST immediate action to lower risk until patching can occur?

A.Apply a compensating control such as restricting access to trusted source IPs and disabling nonessential remote access features

B.Wait for the weekend because the exploit is not confirmed

C.Remove logging from the appliance to improve performance during the wait

D.Run another scan every hour and do nothing else

AnswerA

Restricting access to trusted source IPs and disabling nonessential remote access features reduces the appliance's exploitable attack surface without a reboot. This compensating control satisfies the stem's five-day constraint, lowering risk until the vendor fix can be applied during the weekend maintenance window.

Why this answer

Applying a compensating control—such as restricting access to trusted source IPs via an ACL and disabling nonessential remote access features like unused VPN protocols or administrative interfaces—immediately reduces the attack surface. This mitigates the risk of exploitation of the remote-code-execution vulnerability on the internet-facing VPN appliance until the vendor patch can be applied during the scheduled maintenance window. The key is to implement network-layer controls that block untrusted sources from reaching the vulnerable service, buying time without requiring a reboot.

Exam trap

The trap here is that candidates may think waiting for the maintenance window is acceptable because the vulnerability is unconfirmed, but the exam expects proactive risk reduction through compensating controls rather than passive delay.

How to eliminate wrong answers

Option B is wrong because waiting for the weekend assumes the exploit is not confirmed, but a critical remote-code-execution vulnerability on an internet-facing appliance is inherently high-risk; the scan finding indicates a real issue, and delaying action without compensating controls leaves the organization exposed to active exploitation. Option C is wrong because removing logging from the appliance does not lower risk; it actually reduces visibility into potential attacks and may violate compliance requirements, while doing nothing to prevent exploitation of the vulnerability. Option D is wrong because running another scan every hour and doing nothing else provides no risk reduction; scanning repeatedly does not block or mitigate the vulnerability, and it wastes resources without addressing the immediate threat.

Practice this question →

225

MCQmedium

A vulnerability scan finds that an old print server still has SMBv1 enabled. The business says the vendor will not support a patch for at least two months, but the server must stay online. What is the best temporary mitigation?

A.Move the server to a restricted network segment and allow SMB access only from required hosts.

B.Turn off endpoint logging to reduce performance impact until the vendor releases a patch.

C.Increase the password length requirement for all users and keep the server on the same network.

D.Schedule a weekly reboot to clear any malicious sessions and reduce the chance of exploitation.

AnswerA

Isolating the server on a restricted network segment is a sound compensating control; it shrinks the attack surface to only those hosts that legitimately require SMB access, reducing the number of potential exploit sources while the vendor patch is pending. Because SMBv1 is remotely exploitable without authentication in many cases, limiting connectivity via firewall rules is more effective than relying on host-level hardening. This approach aligns with network segmentation principles and does not hide or destroy security-relevant data.

Why this answer

Network segmentation is the most effective temporary mitigation when a patch is unavailable. By moving the print server to a restricted VLAN or firewall zone and applying an access control list (ACL) that permits SMB traffic only from known, required hosts, you reduce the attack surface and prevent widespread exploitation of SMBv1 vulnerabilities (e.g., EternalBlue). This approach follows the principle of least privilege and containment, buying time until the vendor releases a patch.

Exam trap

The trap here is that candidates may choose a reactive measure like rebooting or a non-technical control like password changes, failing to recognize that containment via network segmentation is the only proactive defense that directly limits the exploit's reach without requiring a patch.

How to eliminate wrong answers

Option B is wrong because turning off endpoint logging reduces visibility into potential attacks, making it harder to detect exploitation of SMBv1; it does not address the vulnerability. Option C is wrong because increasing password length does not mitigate the SMBv1 protocol-level flaws (e.g., lack of pre-authentication integrity checks, susceptibility to relay attacks); it only strengthens authentication, which is irrelevant to the unpatched service. Option D is wrong because scheduling a weekly reboot does not prevent exploitation; attackers can re-establish malicious sessions quickly after reboot, and the vulnerability remains fully exploitable between reboots.

Practice this question →