SY0-701 - Security Operations (28% of the exam) - Section 4.9

Given a scenario, use data sources to support an investigation.

Use log data, firewall logs, packet captures, metadata, and vulnerability scan results to reconstruct an incident timeline and establish its scope. Select packet captures when full session content is needed, and metadata or firewall logs when only connection records are available or full capture is impractical.

log datafirewall logspacket capturesmetadatavulnerability scans

Practice question for this objective

Free sampleSecurity Operationsmedium

A security analyst at a regional law firm is investigating a suspected data exfiltration incident in which a paralegal's workstation may have uploaded client documents to an external service over an encrypted channel during the previous night. The endpoint detection agent shows that a browser process was active during the suspect window, but the analyst needs to confirm the destination IP addresses, the volume of bytes transferred, and the duration of each outbound session without relying on a full packet capture that the firm does not collect at this site. Which data source should the analyst consult first to recover that information?

AThe perimeter firewall connection logs covering the suspect window, filtered by the workstation's source IP address. Correct
BThe Windows security event log on the workstation, filtered for logon and logoff events in the suspect window.
CThe latest authenticated vulnerability scan report for the workstation showing missing patches and weak configurations.
DThe endpoint antivirus quarantine log for the workstation covering the previous twenty-four hours.

Recognise that firewall connection logs are the primary data source for reconstructing outbound flow destinations, volumes, and durations when packet captures are not available. Stateful firewalls record one entry per flow with source and destination addresses, ports, byte counters, and timestamps for session start and end. That metadata is exactly what is needed to characterise an exfiltration attempt over an encrypted channel, even though it does not reveal payload contents, which is why firewall logs are routinely the first stop in this kind of investigation.

Why A is correct: Firewall connection logs record source and destination IP addresses, ports, byte counts, and session duration for each flow, so they directly answer the destinations, volume, and duration questions even when full packet payloads are not captured.

Why B is wrong: Logon and logoff events confirm who was signed in but they do not record outbound destinations, byte counts, or session duration, so they cannot answer any of the three specific questions the analyst needs to close out.

Why C is wrong: A vulnerability scan describes the host's exposure at a point in time but it captures no flow records, so it cannot tell the analyst which destinations were contacted or how much data left the workstation.

Why D is wrong: Quarantine logs only list files the antivirus detected and isolated; they do not record network destinations, byte volumes, or session timing, so they cannot reconstruct the outbound activity the analyst is trying to verify.

See more SY0-701 practice questions, answers explained.

Exam traps in Security Operations

Answers that look right on this material and are not. Each one is a distractor from a different question in the SY0-701 bank for this domain.

A full packet capture records only the source address, destination address, ports, protocol, byte and packet counts for the session, while a flow record additionally preserves the application payload bytes for later reconstruction.
Why it is wrong: This reverses the two technologies. Flow records are the summarised metadata view, and full packet captures are the byte-level record, so a candidate who confuses the two would pick this option.
Application and system logs preserve the complete byte stream of every encrypted session reaching the server, while packet captures contain only summary counters such as bytes transferred per minute for each host.
Why it is wrong: This reverses the two sources. Captures hold the byte stream, while logs hold application events, and summary counters are a property of flow records rather than full captures.
The firewall flow log for the workstation, filtered to destination port 443 during the beaconing window.
Why it is wrong: Firewall flow records contain addresses, ports, and byte counts but they discard the packet payload, so the SNI, cipher list, and JA3 fingerprint inside the TLS handshake cannot be reconstructed from them.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.