Security+ SY0-701 practice test

An HR analyst must send a salary file to an external auditor. The auditor only needs names, departments, and salary totals, not Social Security numbers or bank account details. Which two actions should the analyst take first? Select two.

Trap 1: Upload the file to a public link and send the URL by email

A public link makes the file easier to access, but it also greatly increases the chance of unauthorized disclosure.

Trap 2: Rename the file to a less obvious name and send it normally

Renaming the file does not protect the contents, so sensitive data is still exposed during transmission and storage.

Trap 3: Save the file locally on a USB drive and hand-deliver it

Physical delivery may seem controlled, but it adds handling risk and does not remove unneeded sensitive data from the file.

A
Remove unnecessary sensitive fields before sharing
Data minimization reduces exposure by ensuring the auditor receives only the information needed for the stated business purpose.
B
Use an approved encrypted transfer method
Encryption protects the file while it is being sent, which reduces the chance that an unauthorized party can read it.
C
Upload the file to a public link and send the URL by email
Why wrong: A public link makes the file easier to access, but it also greatly increases the chance of unauthorized disclosure.
D
Rename the file to a less obvious name and send it normally
Why wrong: Renaming the file does not protect the contents, so sensitive data is still exposed during transmission and storage.
E
Save the file locally on a USB drive and hand-deliver it
Why wrong: Physical delivery may seem controlled, but it adds handling risk and does not remove unneeded sensitive data from the file.

Question 2mediummultiple choice

An investigator receives a suspect laptop drive that may be used in court. Which approach best supports a forensically sound image while protecting the original media?

Trap 1: Mount the drive read-write so the investigator can browse it…

Read-write mounting risks modifying metadata, timestamps, or file system structures. That weakens the ability to prove the original drive was not altered.

Trap 2: Copy only the user profile folders with a file manager to save time.

A file copy omits slack space, deleted data, and other artifacts that may be crucial in a forensic investigation. It also provides weaker integrity assurance than a complete forensic image.

Trap 3: Boot the laptop normally and use backup software to duplicate the…

Booting the system changes the evidence state, and backup software is not the same as forensic acquisition. The goal here is preservation, not convenience.

A
Mount the drive read-write so the investigator can browse it quickly.
Why wrong: Read-write mounting risks modifying metadata, timestamps, or file system structures. That weakens the ability to prove the original drive was not altered.
B
Use a hardware write blocker and create a bit-by-bit forensic image with hashes.
This is the best practice because a hardware write blocker prevents any accidental writes to the source drive, and a bit-by-bit image captures the exact data structure for analysis. Hashing the source or image before and after acquisition provides integrity verification, which is essential when evidence may be challenged later. Together, these steps protect the original media and support chain of custody and courtroom admissibility.
C
Copy only the user profile folders with a file manager to save time.
Why wrong: A file copy omits slack space, deleted data, and other artifacts that may be crucial in a forensic investigation. It also provides weaker integrity assurance than a complete forensic image.
D
Boot the laptop normally and use backup software to duplicate the disk.
Why wrong: Booting the system changes the evidence state, and backup software is not the same as forensic acquisition. The goal here is preservation, not convenience.

Question 3mediummultiple choice

An investigator must collect data from a suspected insider-threat laptop so the evidence could be used in an HR and legal review. Which action best preserves admissibility?

Trap 1: Boot the laptop normally and browse the user's files for clues

Booting the system normally can change timestamps, modify files, and alter evidence in ways that weaken chain of custody.

Trap 2: Copy the user's documents to a USB drive and continue the…

A simple file copy is not a forensic acquisition method and can miss metadata, deleted artifacts, and other important evidence.

Trap 3: Take screenshots of the desktop and delete the original drive…

Screenshots are only partial evidence, and deleting the original drive would destroy the source material needed for forensic validation.

A
Boot the laptop normally and browse the user's files for clues
Why wrong: Booting the system normally can change timestamps, modify files, and alter evidence in ways that weaken chain of custody.
B
Create a forensic image through a write blocker and record hashes before and after acquisition
This is the correct preservation method because it avoids altering the original disk and creates verifiable integrity checks. Using a write blocker prevents writes to the source media, and hashes document that the image matches the evidence. Detailed chain-of-custody records then support admissibility in HR, disciplinary, or legal proceedings.
C
Copy the user's documents to a USB drive and continue the investigation later
Why wrong: A simple file copy is not a forensic acquisition method and can miss metadata, deleted artifacts, and other important evidence.
D
Take screenshots of the desktop and delete the original drive contents afterward
Why wrong: Screenshots are only partial evidence, and deleting the original drive would destroy the source material needed for forensic validation.

Read the full DNS explanation →

Question 4mediummultiple choice

An NDR tool shows a production web server sending small, periodic DNS queries to random-looking subdomains under a domain the company does not use. The pattern repeats every 60 seconds, even when normal web traffic is idle. What is the best interpretation and next step?

Trap 1: This is normal DNS behavior, so no action is needed unless users…

The repeated, structured pattern and random-looking subdomains are not typical of normal business DNS activity. Ignoring it could allow continued compromise.

Trap 2: Rotate the DNS server’s administrator password and leave the web…

Changing a DNS admin password does not address suspicious outbound traffic from the web server itself. The issue is likely on the endpoint or network path.

Trap 3: Assume the web server is performing routine certificate renewal…

Certificate renewal traffic does not usually produce random-looking subdomains at a fixed interval to an unknown domain. That explanation does not fit the pattern well.

A
This is normal DNS behavior, so no action is needed unless users report an outage.
Why wrong: The repeated, structured pattern and random-looking subdomains are not typical of normal business DNS activity. Ignoring it could allow continued compromise.
B
Suspect DNS-based command-and-control, then isolate the server and collect logs and packet data for analysis.
Regular outbound DNS queries to random subdomains can indicate tunneling or command-and-control traffic. The fact that it repeats at a fixed interval strengthens that suspicion. The best next step is to contain the host so the activity cannot continue, while preserving logs and packet captures for investigation. This lets the team determine whether malware, a rogue process, or a misconfiguration is responsible without losing evidence.
C
Rotate the DNS server’s administrator password and leave the web server online.
Why wrong: Changing a DNS admin password does not address suspicious outbound traffic from the web server itself. The issue is likely on the endpoint or network path.
D
Assume the web server is performing routine certificate renewal checks and ignore the alert.
Why wrong: Certificate renewal traffic does not usually produce random-looking subdomains at a fixed interval to an unknown domain. That explanation does not fit the pattern well.

Question 5mediummulti select

An investigator needs to make a forensic image of a suspect laptop without changing the original drive contents. Which two practices should be used? Select two.

Trap 1: Mount the drive read/write so hidden files are easier to access

Read/write mounting can alter evidence and defeats the purpose of forensic acquisition.

Trap 2: Defragment the drive first to improve imaging speed

Defragmentation changes the evidence and is inappropriate before imaging.

Trap 3: Install triage tools directly on the suspect laptop

Installing tools on the suspect system modifies it and can contaminate evidence.

A
Use a hardware or software write blocker during acquisition
A write blocker prevents the acquisition tool from modifying the source drive.
B
Record SHA-256 hashes of the source and the image to verify integrity
Matching hashes help prove that the forensic copy is identical to the original evidence.
C
Mount the drive read/write so hidden files are easier to access
Why wrong: Read/write mounting can alter evidence and defeats the purpose of forensic acquisition.
D
Defragment the drive first to improve imaging speed
Why wrong: Defragmentation changes the evidence and is inappropriate before imaging.
E
Install triage tools directly on the suspect laptop
Why wrong: Installing tools on the suspect system modifies it and can contaminate evidence.

Question 6hardmulti select

An operations team manages Linux servers over SSH. The security team wants to stop direct management access from employee laptops, reduce lateral movement if one admin endpoint is compromised, and keep a log of every administrative session. Which two design choices best fit? Select two.

Trap 1: Let all corporate laptops connect directly to SSH on the servers if…

MFA is useful, but direct access from every corporate laptop still expands the attack surface and makes lateral movement much easier after an endpoint compromise. The scenario explicitly asks to stop direct management access and reduce spread, so a central jump path is better than broad direct reachability.

Trap 2: Expose SSH to the internet because key-based authentication is…

Publicly exposing SSH is unnecessary and increases brute-force, scanning, and exploitation risk. Key-based authentication helps, but it does not justify direct internet access to management services. The requirement is to remove direct access from employee laptops, not extend management services to untrusted networks.

Trap 3: Use split tunneling for admin traffic so management packets can…

Split tunneling is generally used to route some traffic outside the secure tunnel, which is the opposite of what this scenario needs. Management traffic should be tightly controlled and inspected, not routed around security controls. Bypassing the VPN would weaken the protected management path.

A
Require administrators to connect to a bastion host or jump server before reaching the Linux servers.
A bastion host is a hardened choke point for privileged access, so all administrative sessions can be concentrated, filtered, and monitored. It prevents direct SSH exposure from general user systems and gives the security team a single place to enforce logging and session control. This is a common hardened management-path pattern.
B
Let all corporate laptops connect directly to SSH on the servers if MFA is enabled.
Why wrong: MFA is useful, but direct access from every corporate laptop still expands the attack surface and makes lateral movement much easier after an endpoint compromise. The scenario explicitly asks to stop direct management access and reduce spread, so a central jump path is better than broad direct reachability.
C
Restrict management interfaces so only the bastion host can reach them and log each session.
Limiting server management interfaces to the bastion host creates a strong network boundary and prevents administrators from bypassing the controlled access path. Session logging provides traceability and supports investigations and accountability. This complements the bastion by ensuring the network architecture enforces the same control model.
D
Expose SSH to the internet because key-based authentication is already strong.
Why wrong: Publicly exposing SSH is unnecessary and increases brute-force, scanning, and exploitation risk. Key-based authentication helps, but it does not justify direct internet access to management services. The requirement is to remove direct access from employee laptops, not extend management services to untrusted networks.
E
Use split tunneling for admin traffic so management packets can bypass the VPN.
Why wrong: Split tunneling is generally used to route some traffic outside the secure tunnel, which is the opposite of what this scenario needs. Management traffic should be tightly controlled and inspected, not routed around security controls. Bypassing the VPN would weaken the protected management path.