SY0-701 Practice Test 1 — 10 Questions

Question 1

An HR analyst must send a salary file to an external auditor. The auditor only needs names, departments, and salary totals, not Social Security numbers or bank account details. Which two actions should the analyst take first? Select two.

Accepted Answer

Remove unnecessary sensitive fields before sharing. Option A is correct because removing unnecessary sensitive fields (like Social Security numbers and bank account details) before sharing the file reduces the risk of exposing personally identifiable information (PII) and aligns with the principle of data minimization. This step ensures that only the required data (names, departments, salary totals) is transmitted, which is a foundational security control before any data transfer occurs.

Answer

Upload the file to a public link and send the URL by email

Answer

Rename the file to a less obvious name and send it normally

Answer

Save the file locally on a USB drive and hand-deliver it

Question 2

An investigator receives a suspect laptop drive that may be used in court. Which approach best supports a forensically sound image while protecting the original media?

Accepted Answer

Use a hardware write blocker and create a bit-by-bit forensic image with hashes.. Option B is correct because forensic best practice requires preserving the original media in an unaltered state. A hardware write blocker physically prevents any write commands from reaching the drive, ensuring the original evidence is not modified. Creating a bit-by-bit forensic image (e.g., with `dd` or FTK Imager) captures the entire drive, including slack space and unallocated sectors, and generating cryptographic hashes (SHA-256 or MD5) before and after imaging verifies the image's integrity for court admissibility.

Answer

Mount the drive read-write so the investigator can browse it quickly.

Answer

Copy only the user profile folders with a file manager to save time.

Answer

Boot the laptop normally and use backup software to duplicate the disk.

Question 3

An investigator must collect data from a suspected insider-threat laptop so the evidence could be used in an HR and legal review. Which action best preserves admissibility?

Accepted Answer

Create a forensic image through a write blocker and record hashes before and after acquisition. Option B is correct because creating a forensic image through a write blocker ensures the original evidence is not altered, preserving its integrity for admissibility in HR and legal proceedings. Recording hashes before and after acquisition allows verification that the image is an exact, unmodified copy, which is critical for chain of custody and meeting legal standards such as Daubert or Federal Rules of Evidence.

Answer

Boot the laptop normally and browse the user's files for clues

Answer

Copy the user's documents to a USB drive and continue the investigation later

Answer

Take screenshots of the desktop and delete the original drive contents afterward

Question 4

An NDR tool shows a production web server sending small, periodic DNS queries to random-looking subdomains under a domain the company does not use. The pattern repeats every 60 seconds, even when normal web traffic is idle. What is the best interpretation and next step?

Accepted Answer

Suspect DNS-based command-and-control, then isolate the server and collect logs and packet data for analysis.. The small, periodic DNS queries to random-looking subdomains under an unused domain are a classic indicator of DNS-based command-and-control (C2) communication. Attackers often use DNS tunneling to exfiltrate data or send commands, as DNS traffic is typically allowed through firewalls. The fact that the pattern persists even during idle web traffic confirms it is not related to normal server operations, making isolation and forensic collection the appropriate next step.

Answer

This is normal DNS behavior, so no action is needed unless users report an outage.

Answer

Rotate the DNS server’s administrator password and leave the web server online.

Answer

Assume the web server is performing routine certificate renewal checks and ignore the alert.

Question 5

An investigator needs to make a forensic image of a suspect laptop without changing the original drive contents. Which two practices should be used? Select two.

Accepted Answer

Use a hardware or software write blocker during acquisition. A hardware or software write blocker is essential because it intercepts and blocks any write commands from the operating system to the suspect drive, ensuring that no data is altered during acquisition. This preserves the original drive's contents in a forensically sound state, which is a fundamental requirement for evidence admissibility.

Answer

Mount the drive read/write so hidden files are easier to access

Answer

Defragment the drive first to improve imaging speed

Answer

Install triage tools directly on the suspect laptop

Question 6

An operations team manages Linux servers over SSH. The security team wants to stop direct management access from employee laptops, reduce lateral movement if one admin endpoint is compromised, and keep a log of every administrative session. Which two design choices best fit? Select two.

Accepted Answer

Require administrators to connect to a bastion host or jump server before reaching the Linux servers.. Option A is correct because a bastion host (jump server) acts as a single, hardened entry point that administrators must connect to before reaching internal Linux servers. This eliminates direct SSH access from employee laptops, reducing the attack surface and preventing lateral movement if an admin endpoint is compromised. The bastion host can also enforce centralized logging of all administrative sessions, meeting the security team's requirement for session recording.

Answer

Let all corporate laptops connect directly to SSH on the servers if MFA is enabled.

Answer

Expose SSH to the internet because key-based authentication is already strong.

Answer

Use split tunneling for admin traffic so management packets can bypass the VPN.

Question 7

An investigator needs a copy of a suspect laptop drive for analysis without changing the original media. What should be used?

Accepted Answer

A full forensic image taken with a write blocker. A full forensic image taken with a write blocker is the correct method because it creates a bit-for-bit copy of the entire drive, including all partitions, unallocated space, and metadata, without altering the original media. The write blocker hardware or software ensures that no write commands reach the suspect drive, preserving its integrity for legal and evidentiary purposes. This approach is required by forensic standards such as NIST SP 800-86 and ensures the copy is admissible as evidence.

Answer

A simple file copy of the user folder

Answer

A compressed archive of the desktop contents

Answer

The original drive mounted normally on the investigator machine

Question 8

An organization is redesigning its office network. Guest Wi-Fi must reach the internet only, employee laptops need access to internal apps, and a payment-processing system must be separated from general user traffic but still reach one database server. Which design best meets these requirements?

Accepted Answer

Create separate VLANs or subnets for guest, user, and payment zones, then filter inter-zone traffic with firewalls or ACLs.. Option B is correct because it uses VLANs or subnets to segment guest, employee, and payment-processing traffic into separate broadcast domains, then applies firewall rules or ACLs to control inter-zone traffic. This allows guest Wi-Fi to be restricted to internet-only access, employee laptops to reach internal apps, and the payment system to communicate only with its specific database server while being isolated from general user traffic.

Answer

Place all devices on one flat network and rely on host firewalls for isolation.

Answer

Put the payment system in a DMZ and allow direct internet access for database synchronization.

Answer

Use NAT on every endpoint so internal devices cannot be individually identified on the network.

Question 9

An online retailer is redesigning its public web application so the web server can receive internet traffic, the application server can only be reached by the web tier, and the database server can only be reached by the application tier. Which placement best supports this design?

Accepted Answer

Put the web server in a public zone, the application server in a private zone, and the database server in an isolated internal zone.. Option B is correct because it implements a classic three-tier architecture with network segmentation. The web server in a public zone (DMZ) accepts internet traffic, the application server in a private zone is isolated from direct internet access and only reachable by the web tier, and the database server in an isolated internal zone is only reachable by the application tier. This design enforces the principle of least privilege and minimizes the attack surface by using firewalls or security groups to restrict traffic between tiers.

Answer

Place all three servers on the same private subnet and control access only with strong passwords.

Answer

Put the database in the public zone so the web tier can query it directly from the internet.

Answer

Use a single reverse proxy for all three servers and disable network segmentation to simplify management.

Question 10

An order-entry application must survive a single server failure and continue serving users if the primary site becomes unavailable. Management wants automatic failover, but does not want to pay for fully active production capacity in two regions. Which design is best?

Accepted Answer

Use two servers in one site behind a load balancer and maintain an asynchronously replicated warm standby site.. Option B is correct because it combines a load-balanced active-passive pair at the primary site with an asynchronously replicated warm standby at a secondary site. This design meets the requirement for automatic failover and continued service after a single server failure or primary site outage, while avoiding the cost of fully active multi-region capacity. Asynchronous replication ensures the standby site is ready to take over without requiring synchronous writes that would add latency or require identical production load.

Answer

Run one server and keep nightly backups in cloud object storage.

Answer

Deploy active-active multi-region capacity with identical production load in both regions.

Answer

Add RAID 1 and a spare power supply to the database server.