SY0-701 practice questions: Security Operations

Answer: D. Objective 4.1 lists BYOD, COPE and CYOD as the mobile deployment models. Two questions separate them - who owns the hardware and who chooses it - and only the first has operational consequences worth testing. Ownership sets the limit of what management may do: a corporate-owned handset can be wiped completely, while on a personally owned device the organisation may act on the container it created and nothing else. Enrolment, a management platform and permitted personal use appear in all three models and identify none of them. Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 4: Security Operations

Answer: B. Objective 4.8 lists root cause analysis alongside the incident response process phases, training, testing, threat hunting and digital forensics. A root cause analysis asks why the incident was possible, which is a different question from what happened and who did what: the ticket answers the second question completely and the same failure still occurred eleven weeks later in another team. NIST SP 800-61 Rev. 2 puts the same distinction into post-incident activity, where the questions to be answered include what corrective actions can prevent similar incidents in the future - an action that follows from the condition that permitted the incident, not from the individual step that was missed on the night. Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 4: Security Operations

Answer: D. Objective 4.5 lists Group Policy under operating system security, and the setting that ends up on a machine is decided by processing order rather than by level or strictness. Microsoft's Group Policy Hierarchy page states: "By default, Group Policy is inherited and cumulative", and gives the order: the local GPO, then GPOs linked to sites, then GPOs linked to domains, then GPOs linked to organizational units - "For nested organizational units, GPOs linked to parent organizational units are applied before GPOs linked to child organizational units are applied." It adds: "The order in which GPOs are processed is significant because when policy is applied, it overwrites policy that was applied earlier." In this scenario the Finance GPO is processed last and its 30 minutes stands. The outcome changes only with the exceptions the scenario rules out: an enforced link on a higher-level GPO, blocked inheritance or security filtering. Source: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/group-policy-hierarchy

Answer: A. Logs from firewalls and routers mostly record blocked connection attempts with little detail about the activity, so they are not typically a primary source of precursors or indicators. They remain valuable for identifying network trends and correlating events detected by other devices. Source: NIST SP 800-61 Rev. 2 (2012), SP80061r2-p37 3.2.3 Sources of Precursors and Indicators, p. 37 Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 4: Security Operations

Answer: B. Some organizations redirect the attacker to a sandbox, a form of containment, to monitor activity and gather evidence; the team should discuss this with its legal department. Other ways of monitoring should not be used, since allowing a known compromise to continue may create liability and delayed containment is dangerous (pp.45-46). Source: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide (2012), 3.3.1 Choosing a Containment Strategy (SP80061r2-p46), p. 46 Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 4: Security Operations