CCNA Security Operations Questions — Page 4 of 4

226

MCQmedium

A Linux host is patched, but the scanner still flags the package as vulnerable. The vendor advisory says the distribution backported the fix, so the package version did not change. What should the analyst do before closing the ticket?

A.Verify the vendor advisory and package metadata, then document evidence of the fixed build.

B.Close the ticket immediately because the patch was installed successfully.

C.Raise the severity of the finding because the scanner still reports it.

D.Disable the scanner until the next maintenance window to avoid repeated alerts.

AnswerA

A version number alone can be misleading when a vendor backports a fix without changing the upstream version. The analyst should confirm the remediation using vendor notes, package release metadata, or other authoritative evidence. That ensures the finding is truly remediated before the ticket is closed and prevents a false assumption based only on a scanner result.

Why this answer

When a vendor backports a security fix to an older package version without incrementing the version number, the vulnerability scanner may still flag the package based on its version string. The analyst must verify the vendor advisory and package metadata (e.g., using `rpm -q --changelog` or `dpkg --status`) to confirm the fix is present, then document this evidence to close the ticket with proper justification.

Exam trap

The trap here is that candidates assume a patched system always has a newer package version, but CompTIA tests the understanding that backported fixes keep the same version string, requiring manual verification of the changelog or vendor advisory.

How to eliminate wrong answers

Option B is wrong because closing the ticket without verification ignores the scanner's alert and the need for evidence that the backported fix is actually installed. Option C is wrong because raising the severity is inappropriate; the package is not vulnerable, and the scanner's false positive does not warrant escalation. Option D is wrong because disabling the scanner avoids the issue rather than resolving it, and the scanner should be tuned or the finding documented as a false positive.

Practice this question →

227

Multi-Selectmedium

After restoring a virtual file server from backup, users can open shares, but the accounting application shows the previous day's transactions are missing. Which two steps should the administrator take next? Select two.

Select 2 answers

A.Verify whether the backup included application-consistent data and transaction logs

B.Restore the missing records from the latest pre-incident application backup or log backup

C.Leave the server as is because file shares are accessible

D.Delete the current backup set to avoid restoring the wrong version again

E.Reimage the server immediately without checking the restore point

AnswersA, B

This is the essential first step because a file-level or crash-consistent backup of a virtual machine may capture the disk state but does not guarantee that applications like SQL Server or Exchange have flushed all committed transactions to disk. Application-consistent backups use VSS or equivalent mechanisms to quiesce the application, ensuring the data files and transaction logs are in a recoverable, synchronized state. Inspecting the backup's metadata and logs reveals whether it supports point-in-time recovery or whether you must fall back to a different recovery source.

Why this answer

The accounting application's missing transactions indicate the backup may not have captured application-consistent data, such as open transaction logs or database writes. Without application consistency (e.g., using Volume Shadow Copy Service or a database-aware backup agent), the restore point may reflect a crash-consistent state where recent transactions were lost. Verifying the backup type ensures the administrator understands whether the data is recoverable from transaction logs or requires a separate application-level restore.

Exam trap

The trap here is that candidates assume file share accessibility equals full data recovery, overlooking the distinction between file-level and application-consistent backups, which is a core concept in CompTIA SY0-701 Domain 3.0 (Security Operations).

Practice this question →

228

MCQmedium

A file server is actively renaming documents and generating ransom notes. The server hosts a shared drive used by finance, and users are still online. What is the best immediate action?

A.Shut the server down immediately to stop all activity as fast as possible.

B.Isolate the server from the network to contain the spread while preserving evidence.

C.Restore the file server from backup before checking whether the infection is still active.

D.Run a full antivirus scan and wait for the results before taking any other action.

AnswerB

Network isolation is the best immediate containment step because it limits lateral movement and reduces the chance that ransomware spreads to other systems or continues encrypting shared data. It is also less destructive than a hard shutdown, which can interfere with evidence collection. In incident response, containment should stop the impact while preserving the ability to investigate what happened.

Why this answer

Isolating the server from the network stops the ransomware from encrypting more files or spreading laterally, while preserving volatile evidence (e.g., running processes, memory contents) needed for forensic analysis. In a live incident, immediate disconnection (not shutdown) is the standard containment step per NIST SP 800-61 and SANS incident response guidelines, as it halts the attack without destroying data in memory or logs.

Exam trap

The trap here is that candidates confuse 'stopping the attack' with 'shutting down the system,' but CompTIA emphasizes that isolation (disconnecting the network cable or disabling the port) is the first step in containment to preserve evidence and avoid data loss.

How to eliminate wrong answers

Option A is wrong because shutting down the server destroys volatile evidence (e.g., active network connections, running ransomware processes in RAM) and may trigger the ransomware to delete or further encrypt files on shutdown, as many modern ransomware variants have persistence mechanisms that activate on system halt. Option C is wrong because restoring from backup before confirming the infection is neutralized risks re-infection if the backup itself is compromised or if the ransomware is still active on the network, and it bypasses the need for forensic preservation. Option D is wrong because running a full antivirus scan while the server is still online allows the ransomware to continue encrypting files and spreading to other systems, and signature-based scans often miss polymorphic or zero-day ransomware strains.

Practice this question →

229

MCQmedium

A security analyst at a financial firm detects an unusual spike in outbound network traffic from a database server that normally only communicates with internal web servers. The traffic is directed to numerous external IP addresses in various countries. According to established incident response procedures, what should be the analyst's immediate next step?

A.Disconnect the server from the network at the switch level.

B.Run a comprehensive antivirus scan on the server.

C.Notify the Chief Information Security Officer (CISO) of the incident.

D.Power off the server to prevent further damage.

AnswerA

Isolating the server at the switch port is the proper containment step because it severs the network path used for data exfiltration without disrupting the host's power or volatile memory. This preserves running processes, open network connections, and other live forensic evidence, aligning with the NIST incident response framework's containment phase. It immediately halts the unauthorized data transfer while allowing the analyst to gather evidence from the live system.

Why this answer

Disconnecting the server at the switch level (e.g., shutting down the switch port or placing it in a quarantine VLAN) is the immediate containment step per incident response procedures. This stops the outbound data exfiltration without risking data loss or corruption that could occur from a hard power-off, and it preserves volatile memory evidence for forensic analysis.

Exam trap

The trap here is that candidates confuse 'immediate containment' with 'immediate notification' or 'immediate remediation,' but the SY0-701 incident response framework prioritizes stopping the active threat (containment) over escalation or scanning.

Why the other options are wrong

Running a comprehensive antivirus scan is a time-consuming step that delays containment. In this scenario, the immediate priority is to stop the data exfiltration by disconnecting the server from the network, not to analyze the malware.

In this scenario, the immediate priority is containment to prevent data exfiltration. Notifying the CISO is a later step after containment and initial analysis, not the immediate next action.

Powering off the server would destroy volatile evidence (e.g., memory contents, active network connections) and may not stop data exfiltration if the attacker has persistence. The immediate priority is containment via network isolation, not power-off.

Practice this question →

230

MCQmedium

A branch office uses a NAS for nightly backups, but the NAS is joined to the same domain as the production servers. After ransomware encrypted both production data and backups, management wants the most effective change to reduce the chance of backup tampering without a major redesign. Which control should be implemented?

A.Increase the retention period so deleted files can be recovered for longer.

B.Move backups to a larger NAS with more available storage capacity.

C.Keep one backup copy offline or immutable and outside the production domain.

D.Run backups more frequently to the same NAS so newer files are captured sooner.

AnswerC

An offline or immutable copy is the strongest practical protection against ransomware that can reach the network backup target. Separating that copy from the production domain also reduces the chance that compromised admin credentials can alter it. This improves resilience without requiring a full redesign, and it gives the organization a trusted recovery source even if online backups are encrypted or deleted.

Why this answer

Keeping one backup copy offline or immutable and outside the production domain ensures that even if ransomware compromises the domain, it cannot encrypt or tamper with that isolated copy. This breaks the chain of trust between the production environment and the backup storage, directly addressing the root cause of the incident.

Exam trap

The trap here is that candidates often choose more frequent backups or larger storage, thinking that having more copies or more space provides protection, when the real vulnerability is the shared domain trust that allows ransomware to access and encrypt backups.

How to eliminate wrong answers

Option A is wrong because increasing the retention period only keeps deleted files longer, but does not prevent ransomware from encrypting or deleting the backups themselves on the same domain-joined NAS. Option B is wrong because moving to a larger NAS with more storage capacity does not change the fact that the NAS is still joined to the same domain, leaving backups vulnerable to the same ransomware attack. Option D is wrong because running backups more frequently to the same NAS only creates more copies that are all equally susceptible to encryption or deletion by ransomware that has domain access.

Practice this question →

231

MCQmedium

A web team is moving a customer portal behind a new inspection device. They need something that can examine HTTP requests, block malicious patterns like injection attempts, and still allow normal browsing. Which control is most appropriate?

A.IDS, because it alerts on suspicious traffic without affecting application delivery.

B.WAF, because it understands web requests and can block malicious application-layer traffic.

C.DLP, because it can stop sensitive data from being posted to the portal.

D.NAC, because it verifies whether devices are allowed onto the network.

AnswerB

A web application firewall is deployed inline in front of the portal and operates at Layer 7, where it decodes and inspects HTTP/HTTPS requests, including headers, cookies, parameters, and request bodies. By matching traffic against signature-based rules (such as the OWASP Core Rule Set) and behavior, it can distinguish normal requests from SQL injection, cross-site scripting, and other application-layer attacks, then actively block or sanitize them before they reach the backend. This real-time, application-aware blocking is exactly what the team needs for a customer-facing portal that accepts untrusted input.

Why this answer

A WAF (Web Application Firewall) is the correct choice because it operates at Layer 7 (application layer) and is specifically designed to inspect HTTP/HTTPS traffic. It can parse web requests, identify malicious patterns such as SQL injection or XSS payloads, and block them while allowing legitimate traffic to pass through to the customer portal.

Exam trap

The trap here is that candidates often confuse an IDS with an IPS (Intrusion Prevention System) and assume an IDS can block traffic, but an IDS is passive and only generates alerts, whereas a WAF is an active, inline control that can both detect and block application-layer attacks.

How to eliminate wrong answers

Option A is wrong because an IDS (Intrusion Detection System) is a passive device that only alerts on suspicious traffic; it cannot block malicious requests inline, so it would not prevent injection attempts from reaching the portal. Option C is wrong because DLP (Data Loss Prevention) focuses on detecting and preventing unauthorized transmission of sensitive data, not on blocking web application attacks like injection attempts. Option D is wrong because NAC (Network Access Control) verifies device compliance and access rights at the network layer, but it does not inspect application-layer HTTP requests or block injection patterns.

Practice this question →

232

MCQmedium

After containment and eradication of malware on several laptops, the team restores the devices from known-good images and verifies that users can authenticate and access email. Which action should occur NEXT to complete the incident response lifecycle and reduce future impact?

A.Close the ticket immediately because the systems are working again

B.Perform a lessons-learned review and update playbooks, controls, or detections based on the incident

C.Reimage the laptops again even though they were already restored and tested

D.Disable all email access for the organization until the next quarterly meeting

AnswerB

A lessons-learned review is the formal post-incident activity in the NIST and SANS incident response frameworks. It examines what worked, what failed, and which detection rules, playbooks, or security controls need adjustment, turning the incident into actionable intelligence. Updating playbooks and detections based on the observed TTPs (tactics, techniques, and procedures) reduces recurrence and improves response time for future incidents. This is the correct step because it captures continuous improvement rather than merely restoring service.

Why this answer

The incident response lifecycle includes a post-incident activity phase where the team conducts a lessons-learned review to identify gaps in security controls, update playbooks, and improve detection signatures. This step ensures that the organization reduces the likelihood and impact of similar incidents in the future, completing the lifecycle beyond just restoring operations.

Exam trap

The trap here is that candidates assume the incident response lifecycle ends once systems are restored and operational, overlooking the mandatory post-incident activity phase that ensures continuous improvement and prevents recurrence.

How to eliminate wrong answers

Option A is wrong because closing the ticket immediately after restoration skips the critical post-incident review phase, leaving vulnerabilities unaddressed and missing opportunities to improve defenses. Option C is wrong because reimaging the laptops again is redundant and wastes resources; the devices have already been restored from known-good images and verified for functionality. Option D is wrong because disabling all email access until a quarterly meeting is an extreme, unnecessary measure that disrupts business operations and does not address the root cause or improve security posture.

Practice this question →

233

MCQmedium

A security analyst receives an alert from the intrusion detection system indicating that a workstation in the finance department has established an outbound connection to a known malicious IP address using an encrypted protocol. The analyst verifies the alert and checks the user's activity logs, which show no legitimate business reason for the connection. According to the incident response process, what should the analyst do NEXT?

A.Begin the eradication phase by immediately reimaging the workstation.

B.Isolate the workstation from the network to contain the threat.

C.Conduct a full forensic analysis of the workstation's hard drive.

D.Update the firewall rule to block all outbound traffic to the malicious IP.

AnswerB

Isolation is the immediate containment step in the NIST incident response lifecycle, and it should be performed as soon as a compromise is confirmed. By moving the workstation to a quarantine VLAN, disabling its network interface, or physically disconnecting it, you sever the active command-and-control channel and prevent the attacker from using this host to pivot laterally. This action also preserves volatile evidence in memory for later forensic acquisition, making it the correct first response to an intrusion alert.

Why this answer

According to the NIST SP 800-61 incident response process, containment is the immediate priority after verification to prevent further damage or data exfiltration. Since the workstation has an active encrypted outbound connection to a known malicious IP with no legitimate business reason, isolating the network interface (e.g., disabling the port, blocking the MAC address, or unplugging the cable) stops the threat from communicating while preserving the system state for later analysis. This aligns with the containment phase, which must precede eradication or full forensic analysis.

Exam trap

The SY0-701 exam often tests the order of the incident response phases (Preparation, Detection & Analysis, Containment, Eradication, Recovery, Post-Incident) and the trap here is that candidates jump to eradication or forensic analysis without first containing the active threat, which violates the fundamental priority of stopping the bleeding before cleaning up.

Why the other options are wrong

In the incident response process, containment (isolating the workstation) must precede eradication (reimaging). Reimaging without containment could allow the threat to spread or lose volatile evidence.

In the incident response process, containment (isolating the workstation) must occur before eradication or forensic analysis. Conducting a full forensic analysis at this stage would delay containment and allow the threat to persist or spread.

After confirming an active threat, the immediate priority is containment (isolating the workstation) to prevent further damage, not updating firewall rules, which is a longer-term preventive measure.

Practice this question →

234

MCQeasy

After a file server is restored from backup, users can open the share, but the business wants to be sure the recovery was successful. What should the administrator verify next?

A.Only that the restore completed without any error message.

B.That representative files open correctly and the restored data matches the required recovery point.

C.That the server has enough free disk space for future growth.

D.That the backup software icon appears green on the console.

AnswerB

This is the best answer because restore verification should confirm both data usability and recovery accuracy. A successful job status alone is not enough; the team should test sample files, confirm permissions, and ensure the data reflects the expected recovery point objective. That proves the backup can actually support operations after an outage and not just complete technically.

Why this answer

Verifying that representative files open correctly and match the required recovery point (RPO) confirms data integrity and completeness, not just that the restore process ran without errors. This aligns with the backup validation principle of performing a data integrity check, such as comparing file hashes or checking timestamps, to ensure the restored data is usable and meets the business's recovery objectives.

Exam trap

The trap here is that candidates assume a successful restore job status (no errors) is sufficient, but CompTIA tests the understanding that validation requires actual data verification against the recovery point, not just process completion.

How to eliminate wrong answers

Option A is wrong because a restore completing without error messages only confirms the process finished, not that the data is intact or usable; silent corruption or missing files can occur. Option C is wrong because verifying free disk space for future growth is a capacity planning task unrelated to validating the success of a specific recovery operation. Option D is wrong because a green icon on the backup software console only indicates the backup job ran, not that the restored data is correct or meets the recovery point objective.

Practice this question →

235

MCQmedium

An email gateway receives a macro-enabled spreadsheet from an external supplier. Signature-based scanning does not flag it, but the security team wants to observe whether it drops files, creates persistence, or contacts suspicious domains before delivery to the user. Which tool best meets this need?

A.DLP, because it prevents any document from leaving the organization.

B.Sandboxing, because it detonates the file and observes malicious behavior safely.

C.NAC, because it can block the supplier's laptop from the network.

D.A SIEM, because it can block the attachment and quarantine the message.

AnswerB

Sandboxing is designed to execute suspicious files in a controlled environment and watch what they do. That makes it ideal when signature-based tools miss a potentially malicious attachment and the team wants to see whether it drops files, modifies persistence settings, or reaches out to command-and-control infrastructure. It gives analysts behavior-based insight before the attachment reaches the end user.

Why this answer

Sandboxing is the correct choice because it detonates the file in an isolated, controlled environment to observe its runtime behavior, such as dropping files, creating persistence mechanisms, or making outbound connections to suspicious domains. Unlike signature-based scanning, sandboxing can detect unknown or zero-day malware by analyzing behavioral indicators without risking the production network.

Exam trap

CompTIA often tests the distinction between passive detection (signature-based, SIEM correlation) and active behavioral analysis (sandboxing), leading candidates to choose SIEM because they confuse log aggregation with dynamic file analysis.

How to eliminate wrong answers

Option A is wrong because DLP (Data Loss Prevention) focuses on preventing unauthorized exfiltration of sensitive data, not on analyzing file behavior for malware. Option C is wrong because NAC (Network Access Control) enforces access policies based on device compliance, not on detonating and analyzing attachments. Option D is wrong because a SIEM (Security Information and Event Management) aggregates and correlates logs for detection and alerting, but it does not actively detonate files or observe runtime behavior; it relies on data from other tools.

Practice this question →

236

Drag & Dropmedium

Drag and drop the steps for the RADIUS authentication process into the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

RADIUS uses UDP; the NAS acts as a client to the RADIUS server, which authenticates and authorizes the user.

Practice this question →

237

MCQmedium

A security analyst detects repeated outbound traffic from a single workstation to an IP address listed on a public threat intelligence feed as a known command-and-control server. The user reports that the workstation is behaving slowly and that antivirus software is up to date. According to incident response best practices, what should the analyst do FIRST?

A.Disconnect the workstation from the network

B.Run a full antivirus scan on the workstation

C.Notify the user that their workstation may be compromised

D.Check the firewall logs to confirm the destination IP

AnswerA

Disconnecting the workstation from the network—by unplugging the Ethernet cable, turning off Wi-Fi, or deactivating the virtual NIC—stops the observed outbound traffic instantly. This containment step severs the command-and-control channel and aborts any ongoing data exfiltration, which is the immediate priority in incident response. It also prevents the malicious process from spreading laterally to other systems on the same segment. While this may lose some volatile network connections, the value of halting the threat outweighs forensic collection at this stage.

Why this answer

The correct first step is to disconnect the workstation from the network to immediately contain the threat and prevent further command-and-control (C2) communication. Since the traffic is already confirmed to a known C2 server via a public threat intelligence feed, the priority is to stop data exfiltration and potential lateral movement, not to gather more evidence or notify the user. Incident response best practices emphasize containment before eradication or notification to minimize damage.

Exam trap

The trap here is that candidates often choose to gather more evidence (Option D) or run a scan (Option B) first, forgetting that containment is the immediate priority once a live C2 connection is confirmed, per the NIST SP 800-61 incident response lifecycle.

Why the other options are wrong

Running a full antivirus scan delays containment; the priority is to stop potential data exfiltration or lateral movement by immediately isolating the workstation from the network.

Notifying the user before containing the threat could cause panic or lead to the user taking actions that disrupt forensic evidence or further compromise the system. Incident response best practices prioritize containment (disconnecting the network) over communication.

Checking firewall logs to confirm the destination IP is a secondary step; the priority is immediate containment by disconnecting the workstation to prevent further C2 communication.

Practice this question →

238

MCQmedium

Following a ransomware incident, management wants proof that the organization can actually recover from its backups before declaring the backups trustworthy. What should the security team do next?

A.Check that the backup job completed successfully during the last seven days.

B.Restore a backup into an isolated test environment and validate the result.

C.Increase the backup retention period to reduce the chance of future loss.

D.Compress the backup files further so they take up less storage.

AnswerB

Restoring a backup into an isolated test environment provides direct, empirical proof that the backup data can be successfully recovered and that the restored systems are functional. This validates backup integrity, the restore process, and whether the data meets recovery point and recovery time objectives, all without risking production systems. It is the only way to demonstrate with confidence that the organization can actually recover from the ransomware attack.

Why this answer

The only way to prove that backups are trustworthy after a ransomware incident is to perform a full restoration into an isolated test environment and validate the integrity, completeness, and functionality of the recovered data. Simply checking that backup jobs completed successfully (Option A) does not verify that the backup data is uncorrupted, free from ransomware, or restorable in a real scenario. A controlled restore test provides tangible evidence that the recovery process works and the data is usable, which is the core requirement of management’s request for proof of recoverability.

Exam trap

The trap here is that candidates often confuse backup completion success with backup recoverability, assuming that a successful backup job log is sufficient proof, when in reality only a full restore test in an isolated environment can validate that the data is usable and free from corruption or ransomware payloads.

How to eliminate wrong answers

Option A is wrong because verifying that a backup job completed successfully only confirms that the backup process ran without errors; it does not validate that the backup data is intact, free from encryption by ransomware, or restorable to a usable state. Option C is wrong because increasing the backup retention period only retains more historical copies of data, but does not test or prove that any of those backups can actually be recovered successfully. Option D is wrong because compressing backup files further reduces storage usage but does not test the recoverability of the data; in fact, excessive compression could introduce corruption or increase restore time without providing any validation of backup trustworthiness.

Practice this question →

239

MCQeasy

A SIEM alert shows 120 failed logins for one user account from three different countries within 10 minutes, followed by a successful login. What should the analyst do first?

A.Close the alert because the login eventually succeeded.

B.Verify the activity with related logs and check whether the account owner confirms the login.

C.Immediately delete the account to stop further access.

D.Reimage the user's laptop before collecting any information.

AnswerB

The correct first step in alert triage is to validate the alert by correlating related logs—such as authentication servers, VPN gateways, and endpoint activity—to determine the source IPs, geolocation, time patterns, and whether the failures were followed by a success from the same or different origin. Simultaneously, contacting the account owner confirms whether they initiated the logins, which distinguishes a legitimate user's forgotten password from a malicious brute-force attempt. This verification process ensures the alert is not a false positive and provides necessary context for deciding on further containment, eradication, or recovery actions.

Why this answer

The analyst must first validate the alert by correlating the SIEM data with additional logs (e.g., authentication logs, firewall logs) and contacting the account owner to confirm whether the successful login was legitimate. This follows the incident response process of verification before action, preventing unnecessary disruption if the activity is benign (e.g., the user traveling with VPN).

Exam trap

The trap here is that candidates assume a successful login after failures means the attack succeeded and jump to containment (Option C or D), but the SY0-701 emphasizes that verification with the user and additional logs is the mandatory first step in the incident response process.

How to eliminate wrong answers

Option A is wrong because a successful login after multiple failed attempts is a classic sign of a brute-force or credential-stuffing attack; closing the alert ignores the potential compromise. Option C is wrong because immediately deleting the account destroys evidence and may lock out a legitimate user without investigation, violating the principle of least disruption. Option D is wrong because reimaging the laptop is a drastic containment step that should only occur after confirming compromise and preserving forensic evidence; it also assumes the attack vector is local, which may not be the case (e.g., remote credential abuse).

Practice this question →

240

MCQeasy

A security scan finds a critical patch missing on a public-facing web server. The patch has already been tested in the lab and approved for deployment. What should the operations team do next?

A.Ignore the finding because the server is already protected by a firewall

B.Deploy the patch through the normal change process as soon as possible

C.Mark the vulnerability as accepted risk without notifying the business

D.Remove the web server from the asset inventory to prevent the scanner from finding it

AnswerB

This is correct because it balances urgency with stability: the patch should already have been tested and validated through the organization's change advisory board, so deploying it through the standard change process minimizes operational risk while eliminating the known vulnerability. Rapid deployment reduces the time-to-exploit, especially since public servers are continuously probed by automated scanners. Deferring the patch leaves a confirmed, vendor-flagged critical vulnerability exposed.

Why this answer

The patch has already been tested and approved, meaning it is ready for deployment. The operations team should follow the normal change management process to deploy the patch as soon as possible, ensuring the public-facing web server is secured against the critical vulnerability without bypassing organizational controls.

Exam trap

The trap here is that candidates assume a firewall or risk acceptance can substitute for patching a known vulnerability, but the exam emphasizes that compensating controls (like firewalls) do not eliminate the need for patch management, and risk acceptance requires formal business notification and approval.

How to eliminate wrong answers

Option A is wrong because a firewall does not patch application-layer vulnerabilities; it only filters traffic at the network and transport layers, leaving the web server's software flaw exploitable if an attacker reaches the service. Option C is wrong because marking a critical vulnerability as an accepted risk without notifying the business bypasses the formal risk acceptance process, which requires documented approval from management and a clear understanding of the business impact.

Practice this question →

241

MCQmedium

An employee reports a ransomware note on a finance laptop. The laptop is still powered on, connected to Wi-Fi, and the user says they were just working in a spreadsheet. Management wants the fastest safe response that also preserves evidence. What should the responder do first?

A.Shut the laptop down immediately to prevent further encryption activity.

B.Isolate the laptop from the network while keeping it powered on for volatile evidence collection.

C.Ask the user to close all open applications and log off normally.

D.Start deleting suspicious files to reduce the impact of the ransomware.

AnswerB

The best first action is to contain the threat without destroying live evidence. Disconnecting network access limits further spread or command-and-control activity, while keeping the system powered on preserves memory, running processes, and other volatile artifacts that may be critical to the investigation. This balances containment with evidence preservation, which is exactly what responders need at the start of an incident.

Why this answer

The immediate priority is to contain the ransomware while preserving volatile evidence (e.g., memory contents, running processes, network connections) that could be critical for forensic analysis. Powering off the laptop (Option A) would destroy volatile data and may allow the ransomware to persist or trigger additional encryption on reboot. Isolating the network connection stops the ransomware from communicating with its command-and-control server or spreading laterally, while keeping the system powered on allows a responder to capture memory with tools like FTK Imager or LiME before performing a controlled shutdown.

Exam trap

The SY0-701 exam often tests the misconception that shutting down a compromised system is the safest immediate action, but the trap here is that volatile evidence is lost and the ransomware may have anti-forensic shutdown triggers, making network isolation the correct first step.

How to eliminate wrong answers

Option A is wrong because immediately shutting down the laptop destroys volatile evidence (RAM, running processes, network connections) that could reveal the ransomware variant, encryption keys, or attacker infrastructure; it may also trigger a destructive payload on shutdown. Option C is wrong because asking the user to close applications and log off normally could trigger additional encryption, overwrite evidence in memory, or allow the ransomware to complete its encryption cycle; logging off may also terminate critical forensic artifacts like open network connections or process handles.

Practice this question →

242

MCQmedium

A critical vulnerability is discovered on an internet-facing VPN appliance that cannot be patched for six weeks because the vendor has not released a fix. The VPN service must remain available. What is the best operational response?

A.Leave the appliance unchanged until the vendor releases a patch.

B.Apply compensating controls such as restricting source IPs and increasing monitoring.

C.Disable all logging so the appliance performs better under load.

D.Replace the VPN with a less secure remote access method to avoid the vulnerability.

AnswerB

When a patch is not yet available, compensating controls such as restricting source IP addresses via firewall allow-lists, enforcing multi-factor authentication, and increasing security monitoring are the appropriate interim measures. These controls reduce the likelihood of exploitation by limiting who can reach the VPN management interface and by generating alerts on abnormal access patterns, while maintaining essential service availability. The goal is to buy time for a proper patch deployment without leaving the device entirely defenseless.

Why this answer

When a vulnerability cannot be patched immediately, compensating controls such as restricting source IPs via ACLs and increasing monitoring (e.g., enabling detailed logging and alerting on anomalous traffic) reduce the attack surface and improve detection of exploitation attempts. This approach maintains service availability while mitigating risk until the vendor releases a fix.

Exam trap

The trap here is that candidates may think leaving the appliance unchanged (Option A) is acceptable if no patch exists, but the exam expects proactive risk reduction through compensating controls rather than passive acceptance of the vulnerability.

How to eliminate wrong answers

Option A is wrong because leaving the appliance unchanged without any mitigation leaves the organization fully exposed to exploitation of the known vulnerability, which is unacceptable for a critical internet-facing device. Option C is wrong because disabling logging reduces visibility into potential attacks, making it harder to detect and respond to exploitation, and does not address the vulnerability itself. Option D is wrong because replacing the VPN with a less secure remote access method introduces new risks and likely violates security policies, whereas the goal is to maintain security while keeping the service available.

Practice this question →

243

MCQmedium

A systems administrator says the backup software reports success every night, but no one has restored a server from backup in over a year. The business wants confidence that a file server can be recovered within the agreed recovery window. What is the best next action?

A.Trust the success status because completed jobs prove the backups are usable.

B.Perform a scheduled restore test in an isolated environment and measure the recovery time.

C.Delete older backups so that only the most recent set remains.

D.Extend retention indefinitely to avoid ever losing a recoverable copy.

AnswerB

Performing a scheduled restore test in an isolated environment directly validates that the backup media contains usable data and that the restore procedure works end-to-end. This practice confirms the organization can meet its recovery point objective (RPO) and recovery time objective (RTO) by measuring how long the restore actually takes. It also surfaces hidden issues such as missing dependencies or permission problems while avoiding production disruption.

Why this answer

The only way to validate that backups are both restorable and meet the recovery time objective (RTO) is to perform a scheduled restore test in an isolated environment. Backup success logs only confirm that data was copied, not that the data is intact or that the restoration process completes within the agreed window. This aligns with the 3-2-1 backup rule and the principle of 'trust but verify' in backup validation.

Exam trap

The trap here is that candidates assume backup success logs are sufficient proof of recoverability, but CompTIA emphasizes that only a documented restore test can verify the backup's usability and adherence to the RTO.

How to eliminate wrong answers

Option A is wrong because backup success status only indicates that the backup job completed without errors, not that the backup data is restorable or that the recovery process will meet the RTO; data corruption, missing files, or incomplete snapshots can still occur. Option C is wrong because deleting older backups reduces the number of recovery points and increases the risk of data loss, especially if the most recent backup is corrupted or fails to restore. Option D is wrong because extending retention indefinitely does not address the core issue of verifying recoverability and can lead to storage bloat, increased costs, and compliance violations without proving that a restore is possible within the RTO.

Practice this question →

244

MCQeasy

A user reports that their laptop is suddenly encrypting files and showing a ransom note. What should the incident response team do first?

A.Immediately restore the laptop from backup before collecting any information.

B.Isolate the laptop from the network to limit spread and preserve evidence.

C.Return the laptop to the user and monitor for additional alerts.

D.Apply all pending software updates to the laptop while it remains online.

AnswerB

Isolation is the critical containment step in an active ransomware outbreak: by disconnecting the laptop from the network (unplugging Ethernet, disabling Wi-Fi and Bluetooth), you stop the malware from encrypting any networked file shares or hopping to adjacent hosts via SMB or other propagation mechanisms. This action also preserves the system's live state so that forensic tools can capture memory, running processes, and encryption artifacts without the device being either further contaminated or remotely meddled with by the attacker. Containment must happen before eradication and recovery, per NIST IR lifecycle.

Why this answer

When a laptop suddenly encrypts files and displays a ransom note, it indicates an active ransomware infection. The incident response team's first priority is to isolate the laptop from the network to prevent the ransomware from spreading laterally to other systems and to preserve volatile evidence (e.g., memory contents, running processes) that could be lost if the system is powered off or reconnected. This aligns with the NIST SP 800-61 incident response guidelines, which emphasize containment before eradication or recovery.

Exam trap

The trap here is that candidates may confuse incident response phases and choose a recovery action (like restoring from backup) before containment, or they may mistakenly think applying updates is a valid response to an active infection, when in fact isolation is the mandatory first step per the NIST framework.

How to eliminate wrong answers

Option A is wrong because immediately restoring from backup without first isolating the system could allow the ransomware to re-encrypt the restored files if the infection is still active, and it destroys volatile evidence needed for forensic analysis. Option C is wrong because returning the laptop to the user and monitoring for additional alerts would allow the ransomware to continue encrypting files and potentially spread to other network resources, violating the containment principle. Option D is wrong because applying pending software updates while the laptop remains online does not stop the active encryption process and could trigger additional malicious activity; updates are a preventive measure, not an incident response containment step.

Practice this question →

245

MCQeasy

EDR shows encoded PowerShell launched by a word processor and an outbound connection to a rare domain. What is the best immediate containment action?

A.Isolate the endpoint from the network using the EDR console.

B.Uninstall the word processor from every workstation.

C.Wait to see whether more alerts appear before responding.

D.Send a notice to all users reminding them not to open attachments.

AnswerA

Network isolation through EDR quickly limits attacker access and prevents further command-and-control communication. It also preserves the host for investigation while stopping spread to other systems. This is a standard first containment step when behavior strongly suggests active compromise.

Why this answer

Isolating the endpoint from the network using the EDR console is the best immediate containment action because it stops the outbound connection to the rare domain, preventing potential command-and-control (C2) communication or data exfiltration. The encoded PowerShell launched by a word processor strongly suggests a malicious macro or exploit, and isolating the host contains the threat without disrupting the entire network. This aligns with the incident response priority of containment before eradication or recovery.

Exam trap

The trap here is that candidates may choose a broad administrative action (like uninstalling software or sending user notices) instead of the precise, immediate technical containment step that stops the active threat at the network level.

How to eliminate wrong answers

Option B is wrong because uninstalling the word processor from every workstation is a broad, disruptive action that does not address the immediate threat on the affected host and may remove legitimate software needed for business operations. Option C is wrong because waiting for more alerts allows the potential C2 channel to remain active, increasing the risk of lateral movement or data theft. Option D is wrong because sending a user notice is a preventive or awareness measure, not an immediate containment action, and it does not stop the active malicious process or network connection.

Practice this question →

246

MCQeasy

A security administrator is implementing a new backup strategy. The organization requires that backups be encrypted at rest and that the encryption keys be managed separately from the backup data. Which of the following should the administrator implement to meet these requirements?

A.Use a cloud backup service that encrypts data at rest with a provider-managed key.

B.Enable AES-256 encryption on the backup target storage array and store the encryption key in a configuration file on the backup server.

C.Store backups on an encrypted USB drive and keep the drive in a safe.

D.Use a backup solution that supports client-side encryption with a key management server (KMS).

AnswerD

Client-side encryption with a KMS allows the backup data to be encrypted before it leaves the source, and the keys are stored and managed in a separate KMS. This meets both requirements: encryption at rest and separate key management. The KMS can enforce access controls and key rotation policies independently of the backup storage.

Why this answer

Client-side encryption with a key management server (KMS) ensures that data is encrypted before transmission and stored encrypted, while the keys are managed in a separate, secure system. This separation of duties prevents a compromise of the backup storage from exposing the keys, and allows for centralized key lifecycle management.

Exam trap

The trap here is assuming that any encryption at rest satisfies the requirement, but the key must be managed separately from the data to prevent a single point of compromise.

Practice this question →

247

MCQmedium

The web team is placing a public customer portal behind a control that can inspect HTTP requests, block malicious payloads such as SQL injection and cross-site scripting, and still allow legitimate application traffic without rewriting the app. Which control should they deploy?

A.An IDS placed on the same network segment as the web server.

B.A DLP appliance between users and the portal.

C.A WAF in front of the application.

D.A NAC solution on the switch ports feeding the portal.

AnswerC

A web application firewall is built to inspect HTTP and HTTPS traffic at the application layer and block common web attacks such as SQL injection and XSS. It can protect a public portal without requiring code changes, making it a practical compensating control while the application team improves secure coding. This is the best fit when the goal is to stop malicious web payloads before they reach the app.

Why this answer

A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at the application layer (Layer 7), filtering out malicious payloads like SQL injection and cross-site scripting (XSS) while allowing legitimate requests to pass through. Unlike an IDS, a WAF operates inline and can actively block threats without requiring modifications to the application code, making it the ideal choice for protecting a public-facing web portal.

Exam trap

The trap here is that candidates often confuse an IDS (which only detects) with a WAF (which actively blocks), or they mistakenly think a DLP appliance can filter web application attacks, when in fact DLP focuses on data in motion or at rest, not on application-layer payload inspection.

How to eliminate wrong answers

Option A is wrong because an IDS (Intrusion Detection System) is a passive monitoring device that only alerts on suspicious traffic; it cannot block malicious payloads inline or prevent attacks without additional manual intervention. Option B is wrong because a DLP (Data Loss Prevention) appliance is designed to prevent unauthorized exfiltration of sensitive data, not to inspect and filter HTTP requests for SQL injection or XSS payloads. Option D is wrong because a NAC (Network Access Control) solution controls device access to the network at the switch port level based on compliance policies, but it does not inspect application-layer traffic or block web-based attacks.

Practice this question →

248

MCQmedium

Based on the exhibit, what should the team do next after the account has been contained?

A.Close the incident because the password reset removed the attacker from the environment.

B.Remove mailbox persistence, revoke all tokens and app consent, then monitor for reentry.

C.Reimage the user's laptop before reviewing mailbox settings.

D.Restore the mailbox from backup to remove the forwarding rule and keep the user productive.

AnswerB

The exhibit shows post-compromise persistence through a forwarding rule and unauthorized OAuth consent. After containment, the team must eradicate those artifacts, revoke any remaining tokens or sessions, and verify that no attacker-controlled application retains access. That sequence moves the response from containment into eradication and prepares the account for safe recovery and monitoring.

Why this answer

After containing a compromised account (e.g., disabling it or resetting its password), the attacker may still have established persistence mechanisms such as mailbox forwarding rules, OAuth app consent grants, or session tokens that survive a password reset. Removing these artifacts and revoking all tokens and app consents ensures the attacker cannot regain access via delegated permissions or persistent mailbox rules. Monitoring for reentry is critical to detect any residual access or new compromise attempts.

Exam trap

The trap here is that candidates assume a password reset fully evicts an attacker, overlooking that OAuth tokens and mailbox rules provide persistent access independent of the account password.

How to eliminate wrong answers

Option A is wrong because a password reset alone does not remove attacker‑created mailbox forwarding rules, OAuth app grants, or session tokens; the attacker could still access the mailbox via delegated permissions or persistent rules. Option C is wrong because reimaging the user's laptop addresses local device compromise but does not remediate cloud‑based persistence like mailbox forwarding rules or app consents that exist in the tenant. Option D is wrong because restoring the mailbox from backup removes the forwarding rule but does not revoke OAuth tokens or app consents, and it may reintroduce the same rule if the backup contains the malicious configuration; it also fails to address other persistence vectors.

Practice this question →

249

MCQmedium

A security analyst receives an alert that a user clicked a link in a phishing email and entered their corporate credentials on a fake login page. Which of the following should the analyst do FIRST to minimize further damage?

A.Run a full antivirus scan on the user's workstation

B.Reset the user's password and force re-authentication

C.Disable the user's account and block the compromised system from the network

D.Contact law enforcement and report the phishing site

AnswerC

Disabling the user's account terminates the attacker's authenticated sessions and invalidates stolen credentials, while blocking the compromised system at the network layer severs any existing command-and-control, RDP, or file-transfer connections. This containment step is the immediate priority because it prevents lateral movement and data exfiltration without destroying volatile evidence on the host. In contrast to reactive scanning or password resets, isolating first gives the incident response team a clean boundary to perform forensic acquisition and threat hunting.

Why this answer

Immediately disabling the user's account and blocking the compromised system from the network stops the attacker from using the stolen credentials to authenticate to corporate resources, such as email, VPN, or file shares. This containment step is the highest priority in incident response to prevent lateral movement and further compromise, as the attacker already has valid credentials and could be actively using them.

Exam trap

The trap here is that candidates often choose to reset the password first (Option B) because it seems like a direct fix, but they fail to recognize that the compromised system itself may be under attacker control, and without network isolation, the attacker could still pivot or use other stolen credentials.

Why the other options are wrong

Running a full antivirus scan is a reactive step that does not immediately prevent further unauthorized access or credential misuse. The priority is to contain the breach by disabling the account and isolating the system.

Resetting the password and forcing re-authentication does not immediately isolate the compromised system or prevent the attacker from using the stolen credentials to access other resources before the password change takes effect.

Contacting law enforcement is not the first priority; immediate containment actions like disabling the account and blocking the system are needed to prevent further credential misuse.

Practice this question →

250

MCQmedium

A Linux web server was compromised through an outdated package. The team isolated the host, captured evidence, removed a malicious cron job, patched the vulnerable package, and confirmed no persistence remains. Which incident response phase are they primarily in now?

A.Identification, because the team is still confirming that the event happened.

B.Containment, because the host was isolated from the network.

C.Eradication, because malicious artifacts and the underlying weakness are being removed.

D.Lessons learned, because the server has already been secured.

AnswerC

Eradication is the incident response phase dedicated to removing the adversary's presence entirely — deleting malware, eliminating persistence mechanisms, and remediating the root cause, such as the outdated package that was exploited. The scenario's description of removing malicious artifacts and the underlying weakness directly matches this phase. Unlike containment, which merely limits damage, eradication seeks to ensure the attacker cannot easily return.

Why this answer

The team has already identified the compromise, isolated the host, and removed the malicious cron job. Patching the vulnerable package addresses the root cause, which is the core of the Eradication phase. Confirming no persistence remains verifies that the eradication was successful, making this the current phase.

Exam trap

The trap here is that candidates confuse the isolation step (Containment) with the overall phase, but the question emphasizes the removal of the malicious cron job and patching, which are definitive Eradication actions.

How to eliminate wrong answers

Option A is wrong because Identification is the initial phase where the incident is discovered and confirmed; here, the team has already moved past that to active remediation. Option B is wrong because Containment focuses on limiting damage (e.g., network isolation), which was already performed; the team is now addressing the root cause and removing artifacts. Option D is wrong because Lessons Learned occurs after recovery is complete and involves post-incident review and documentation, not active patching and artifact removal.

Practice this question →

251

MCQeasy

After a phishing incident, the security team wants to preserve evidence for later review. Which action is most appropriate?

A.Have the user delete the phishing email to avoid further exposure

B.Capture and save the email headers and message content

C.Forward the email to every employee as a warning

D.Change the user's office seat assignment immediately

AnswerB

Preserving the raw email as an .eml or .msg file, or exporting the full message with headers from the web client, gives investigators a complete, immutable artifact for analysis. The 'Received' header chains can be traced back to the originating IP and MTA path, while SPF, DKIM, and DMARC authentication results in the headers reveal whether the message was spoofed or sent from a compromised legitimate account. The message content is also vital for extracting malicious links, attachments, and other Indicators of Compromise (IOCs) and for providing the full payload context needed for detection rule creation and user awareness training.

Why this answer

Preserving the email headers and message content is essential for forensic analysis. Email headers contain routing information, including the originating IP address, authentication results (SPF, DKIM, DMARC), and timestamps, which are critical for tracing the source of the phishing attack and understanding the attack vector. Deleting or forwarding the email would destroy this evidence, compromising the investigation.

Exam trap

The trap here is that candidates may think deleting or forwarding the email is a quick fix to prevent further harm, but the exam emphasizes that evidence preservation (via capture of headers and content) is the first priority in incident response, not containment or notification.

How to eliminate wrong answers

Option A is wrong because deleting the phishing email destroys the evidence needed for forensic analysis, including headers and metadata that could identify the attacker's infrastructure. Option C is wrong because forwarding the email to all employees increases the risk of further compromise, may violate data protection policies, and alters the original message headers, potentially invalidating the evidence. Option D is wrong because changing the user's office seat assignment has no relevance to preserving digital evidence; it is a physical security measure unrelated to incident response or evidence handling.

Practice this question →

252

MCQeasy

A SIEM alert shows a payroll administrator account signed in at 02:10 from a country the employee has never visited. The employee says they are on vacation at home and did not travel. What should the analyst do first?

A.Immediately disable the account and wait for the employee to return.

B.Verify the login context with the user or manager and review recent authentication history.

C.Close the alert as a false positive because the user is on vacation.

D.Reimage the user’s workstation before checking any logs.

AnswerB

This is the best first step because alert triage should confirm whether the activity is truly suspicious before disruptive action is taken. Reviewing the user’s normal login patterns, recent sign-in history, and whether a VPN or travel exception exists helps distinguish a real compromise from an unusual but legitimate event. Good triage reduces unnecessary outages and focuses response effort appropriately.

Why this answer

The first step in incident response is to verify the alert's validity and gather context before taking action. The analyst should review the SIEM logs for authentication details (e.g., source IP, geolocation, timestamp) and confirm with the user or manager whether the login was expected. This aligns with the NIST SP 800-61 incident response process, which emphasizes triage and validation before containment.

Exam trap

The trap here is that candidates may jump to containment (disabling the account) or dismissal (false positive) without performing the critical triage step of verifying the login context, which the exam emphasizes as the first action in the incident response process.

How to eliminate wrong answers

Option A is wrong because immediately disabling the account without verification could lock out a legitimate user and disrupt operations, violating the principle of least disruption during initial triage. Option C is wrong because closing the alert as a false positive without investigation ignores the possibility of credential theft or a compromised session, which is a common attack vector. Option D is wrong because reimaging the workstation is a drastic containment step that should only occur after confirming a compromise; it bypasses necessary log analysis and could destroy forensic evidence.

Practice this question →

253

MCQmedium

A SIEM reviews VPN authentication logs and sees 36 different usernames each receive one failed login attempt from the same source IP over 20 minutes, followed by one successful login to an unrelated account. Which attack is most likely?

A.Password spraying against many accounts with a low number of attempts per account.

B.A brute-force attack focused on a single locked account.

C.A replay attack using captured authentication data.

D.A port scan that accidentally triggered authentication failures.

AnswerA

The observed pattern is classic password spraying: an attacker tries one or two common passwords (e.g., 'Company123' or 'Winter2024') against 36 distinct usernames, spacing attempts to stay below lockout thresholds. Because each account sees only a single failure, no account locks, and the attack spreads horizontally rather than hammering one user. A SIEM would see many different users with one failed VPN authentication each, exactly matching this low-and-slow credential-stuffing variation.

Why this answer

The SIEM observed 36 different usernames each receiving one failed login attempt from the same source IP over 20 minutes, followed by one successful login to an unrelated account. This pattern is characteristic of a password spraying attack, where an attacker tries a small number of common passwords against many accounts to avoid account lockout thresholds, and then uses a successful credential to pivot to another account. The low number of attempts per account (one each) and the wide spread of usernames distinguish it from brute-force or targeted attacks.

Exam trap

The trap here is that candidates often confuse password spraying with brute-force attacks, but the key differentiator is the distribution of attempts across many accounts versus many attempts on a single account.

How to eliminate wrong answers

Option B is wrong because a brute-force attack focused on a single locked account would show many failed attempts against that one username, not one attempt each across 36 different usernames. Option C is wrong because a replay attack would involve capturing and reusing valid authentication data (e.g., a Kerberos ticket or NTLM hash), not generating new failed login attempts from a source IP. Option D is wrong because a port scan does not generate authentication failures; it probes for open ports using TCP SYN or UDP packets, and any authentication failures would be coincidental and not follow a pattern of one attempt per username.

Practice this question →