SY0-701 Practice Test 10 — 10 Questions

Question 1

A security analyst is reviewing web server logs from an e-commerce application. The logs show repeated requests containing URLs with appended strings such as: `' OR '1'='1' --` and `'; DROP TABLE Users; --`. The application returned HTTP 200 responses with unexpected data in several instances. Which type of attack is most likely being attempted?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SQL injection. The repeated requests contain classic SQL injection payloads, such as `' OR '1'='1' --` (used to bypass authentication or extract data) and `'; DROP TABLE Users; --` (used to delete database tables). The HTTP 200 responses with unexpected data confirm that the application is vulnerable to SQL injection, as the injected SQL code is being executed against the backend database. This attack targets the SQL database layer, not LDAP directories or operating system commands.

Answer

LDAP injection

Answer

Command injection

Answer

Cross-site scripting (XSS)

Question 2

A defense contractor is deploying a new document management system that will store classified military intelligence. The security policy requires that user access to each document is strictly determined by the document's classification label (e.g., Confidential, Secret, Top Secret) and the user's verified security clearance level. Furthermore, system administrators must not be able to change these access rules or grant themselves access to documents above their clearance. Which access control model is best suited for this requirement?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) is the correct choice because it enforces access decisions based on security labels (e.g., classification levels) and user clearances, which are centrally managed and cannot be overridden by users or administrators. In this scenario, the system must strictly enforce that a user's clearance level matches or exceeds the document's classification label, and administrators cannot modify these rules or elevate their own access—a core property of MAC systems like SELinux or those implementing Bell-LaPadula.

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)

Question 3

A public-facing file transfer server is running an appliance firmware version that is now end-of-life. The vendor has stated that no further security patches will be released. Management wants the best long-term fix before the next audit. What should be done?

Accepted Answer

Replace or upgrade the end-of-life firmware with a supported version.. Running end-of-life firmware means no security patches will be released, leaving the server vulnerable to known exploits. The best long-term fix is to replace or upgrade to a supported firmware version that receives ongoing security updates, ensuring the system remains secure for the next audit and beyond.

Answer

Increase logging and keep the current firmware until a problem appears.

Answer

Move the server to a different subnet and continue using the same firmware.

Answer

Change the administrator password and leave the device in place.

Question 4

A security analyst is reviewing the source code of a custom network service written in C. The service allocates a 256-byte buffer and uses the strcpy() function to copy incoming data into that buffer without verifying the length of the input. If an attacker sends a specially crafted payload that exceeds 256 bytes, which security control would be most effective at detecting and preventing the resulting exploitation at runtime?

Accepted Answer

Stack canaries. Stack canaries are the most effective runtime control for detecting and preventing buffer overflow exploitation. When a buffer overflow overwrites the stack, it corrupts a canary value placed between the buffer and the return address; before the function returns, the canary is checked, and if altered, the program terminates immediately, preventing arbitrary code execution.

Answer

Transport Layer Security (TLS)

Answer

Code signing

Answer

Data Execution Prevention (DEP)

Question 5

After an internal PKI was rebuilt, users now see certificate warnings when connecting to the company intranet portal. The portal certificate chains to a new CA, but endpoint trust stores do not recognize it yet. What should the administrator deploy?

Accepted Answer

The root CA certificate for the new PKI to trusted endpoint stores.. The root CA certificate must be distributed to all endpoint trust stores to establish trust in the new PKI. Without the root CA in the trusted root certification authorities store, the certificate chain is incomplete, causing browsers to display certificate warnings. Deploying the root CA certificate via Group Policy or MDM resolves this by allowing endpoints to validate the portal's certificate chain.

Answer

The portal's private key so users can validate the certificate locally.

Answer

A new certificate signing request on each endpoint.

Answer

A self-signed certificate on the portal to avoid future CA problems.

Question 6

A SOC analyst sees 38 failed logins for a finance user account from one public IP address over 4 minutes, followed by one successful login. What should the analyst do first?

Accepted Answer

Correlate the authentication logs with user activity and VPN records to verify whether the login pattern is expected.. The analyst must first verify whether the failed logins followed by a successful login represent a brute-force attack or legitimate behavior, such as a user mistyping their password and then succeeding. Correlating authentication logs with user activity and VPN records helps confirm if the public IP belongs to a known remote user or VPN endpoint, which is a standard first step in incident response to avoid false positives.

Answer

Immediately delete the account to stop any further access attempts.

Answer

Assume the account is compromised and notify all users to change their passwords.

Answer

Close the alert because one successful login means the activity was normal.

Question 7

A manager asks the security team to let Human Resources inspect the files on a laptop suspected of containing stolen customer data before IT touches it. What is the best response?

Accepted Answer

Create a forensic image of the device, document the handoff, and maintain chain of custody before any analysis.. The first priority in any investigation involving potential evidence is to preserve the data in its original state. Creating a forensic image (bit-for-bit copy) ensures that the original media is not altered, and documenting the handoff with a chain of custody form provides a verifiable audit trail. This process adheres to forensic best practices and legal requirements, preventing spoliation of evidence before any analysis begins.

Answer

Let HR browse the files first so they can confirm whether the data is sensitive.

Answer

Copy the files to a shared drive so multiple departments can review them quickly.

Answer

Factory reset the laptop immediately to prevent further leakage of customer data.

Question 8

A company uses an encryption key for a database backup process. The key is being replaced because the old one is near the end of its approved use period. What is this action called?

Accepted Answer

Key rotation, because an older key is replaced with a new one on schedule.. Key rotation is the scheduled replacement of an older encryption key with a new one, typically performed before the end of the key's cryptoperiod to maintain security and compliance. In this scenario, the database backup key is being replaced because it is near the end of its approved use period, which directly matches the definition of key rotation. This practice limits the amount of data encrypted with a single key and reduces the impact of a potential key compromise.

Answer

Key compression, because the key is made smaller before use.

Answer

Key translation, because the key is converted into another language.

Answer

Key formatting, because the key is stored in a different file type.

Question 9

Based on the exhibit, what is the best response to the facilities manager's request?

Accepted Answer

Deny the request and direct the manager to use an approved work-contact list or seek privacy review.. The facilities manager's request to export employee contact information for a separate system likely violates data privacy policies and potentially regulations like GDPR or CCPA. Option B is correct because the proper procedure is to deny the ad-hoc export and direct the manager to use an approved work-contact list or seek a privacy review, ensuring data handling complies with organizational data governance and privacy requirements.

Answer

Provide the export because the requester is a manager with a legitimate business relationship to employees.

Answer

Send the data to the manager if the manager promises not to share it externally.

Answer

Store the export in a shared drive so multiple teams can use it for convenience.

Question 10

A payroll SaaS provider has passed initial review, but before contract signing it announces that customer data will be processed by a new subcontractor in another country. The business wants to keep the onboarding timeline short, but security still needs assurance that the change does not increase exposure. What is the BEST next step?

Accepted Answer

Update the third-party risk assessment and require evidence of the subcontractor's controls before approval.. The introduction of a new subcontractor in a different country represents a material change to the data processing environment, which invalidates the initial risk assessment. Security must update the third-party risk assessment to evaluate the subcontractor's controls, such as data protection, encryption standards, and compliance with local regulations, before approval. This ensures that the change does not increase exposure, even if the primary provider passed initial review.

Answer

Approve the vendor because the primary provider already passed the initial review.

Answer

Wait until the first quarterly audit to review the subcontractor change.

Answer

Accept the change if the vendor provides a marketing brochure describing its security program.