ITForMe Beta Sign in
SEC+ SY0-701 V7 Threats, vulnerabilities, and mitigations Runs in your browser · no setup Original practice · Review pending

Analyze a credential attack path

Correlate a phishing lure, token activity, and privilege use, then choose scoped mitigations.

Estimated13 min
DifficultyIntermediate
Points7
Scenario brief

A user reported a fake document-share page. Minutes later, a new session used the account to enumerate cloud resources.

Content record

Original practice · Review pending

Mapped to CompTIA SY0-701 objectives · Internal validation 2026-09-30 · Original ITForMe practice mapped to published objectives; not an official exam question. A named independent subject-matter expert has not yet verified the question and answer key.

Community review →
2.2Explain common threat vectors and attack surfaces. 2.4Given a scenario, analyze indicators of malicious activity. 2.5Explain the purpose of mitigation techniques used to secure the enterprise.
Show review record and official sources

Method: Clean-room scenario and answer key checked against Security+ SY0-701 objectives 2.2, 2.4, and 2.5; independent SME review remains pending.

Current-profile check: 2026-08-12 · Next review due 2026-11-16

01

Inspect the evidence

Use only the information provided to complete the tasks.

Timeline

table
TimeEvidence
10:02Lookalike sign-in link opened
10:05New unmanaged-device token issued
10:08Resource enumeration from new ASN
10:10User reports unexpected MFA prompt
02

Complete the response

Partial credit is available for matching, ordering, and multi-select tasks.

Changes will save automatically.
01
multi select

Select the THREE observations that connect the lure to likely account misuse.

3 pts
Need a hint?

Evaluate each option independently against the scenario evidence instead of treating the list as one decision.

Show another hint

Choose only options that directly satisfy the prompt; being generally true is not enough.

02
ordering

Order the scoped response and mitigation work. The attacker's session is still active, and the identity provider retains its sign-in and audit logs after a session is revoked.

4 pts

Drag the rows or use the arrow buttons to reorder.

  1. 1 Revoke sessions and secure the affected identity
  2. 2 Preserve sign-in, token, and audit evidence
  3. 3 Block the confirmed lure and indicators
  4. 4 Apply phishing-resistant authentication and review risky sign-in policy
Need a hint?

Identify the prerequisite that must happen first and the verification or documentation that belongs last.

Show another hint

For the middle steps, ask what must already be true before each action can safely happen.

Ready to check your work?Unanswered tasks and matches earn no points. A partial submission is scored and saved in your history.
Persistent progress

Attempt history

Every submission is retained. Starting another attempt never replaces or unlocks the previous one.

No attempts yet

Your first submitted score and detailed answer review will appear here.

Community quality control

Question or answer look wrong?

Proposals and votes help staff prioritize review. They never change the scoring key automatically.

Full review queue →
No community corrections yet

Be the first to flag unclear wording, an answer-key issue, or a source that needs another look.

Propose a correction