SY0-701 Practice Test 4 — 10 Questions

Question 1

Based on the exhibit, which change best improves secure administration for the scheduled task?

Accepted Answer

Use a dedicated service account with only the required permissions and allow the task to run whether or not anyone is logged on.. Option C is correct because using a dedicated service account with minimal required permissions follows the principle of least privilege, reducing the attack surface. Allowing the task to run whether or not anyone is logged on ensures the scheduled task executes reliably without depending on a user session, which is essential for automated administrative tasks. This approach also avoids the security risks of using the built-in Administrator account, which has excessive privileges and is a common target for attackers.

Answer

Keep the Administrator account and leave the task running only when a user is logged on.

Answer

Move the script to the desktop so it is easier for technicians to monitor manually.

Answer

Disable the task and have staff run the script manually whenever they remember to do it.

Question 2

Based on the exhibit, which metric best indicates improved phishing resistance?

Accepted Answer

Phish report rate.. The phish report rate measures how many users report a simulated phishing email to the security team, which directly indicates their ability to recognize and respond to phishing attempts. A higher report rate demonstrates improved security awareness and resistance because users are actively identifying threats rather than ignoring or falling for them. This metric is a key performance indicator in security awareness programs because it reflects behavioral change, not just training completion.

Answer

Training completion rate.

Answer

Number of phishing emails sent by attackers.

Answer

Total number of help desk tickets.

Question 3

Based on the exhibit, which change best improves both recovery time and recovery point for the ERP database?

A mid-sized company has a two-hour RTO and a 30-minute RPO, but its current backup design cannot meet either objective during restore testing.

Accepted Answer

Implement frequent transaction log backups and a pre-staged standby or automated recovery image.. Option C is correct because implementing frequent transaction log backups (e.g., every 5–10 minutes) allows point-in-time recovery, reducing the recovery point objective (RPO) to minutes. A pre-staged standby or automated recovery image reduces recovery time objective (RTO) by eliminating the need to restore from scratch, enabling near-instant failover. This directly addresses the company's inability to meet its 30-minute RPO and 2-hour RTO during restore testing.

Answer

Add a second nightly full backup at 23:30 to the same NAS device.

Answer

Move the NAS to a different VLAN but keep the backup schedule unchanged.

Answer

Increase backup retention from one month to one year.

Question 4

Based on the exhibit, which change best reduces exposure for the public web application while keeping the backend tiers protected?

The current design is:
Internet -> Firewall -> DMZ VLAN 10: reverse proxy
Private App VLAN 20: application server 10.10.20.20
Private DB VLAN 30: database server 10.10.30.30
User VLAN 40: internal workstations

ACL summary:
1. permit tcp any -> 10.10.10.10 eq 443
2. permit tcp 10.10.10.10 -> 10.10.20.20 eq 8443
3. permit tcp 10.10.20.20 -> 10.10.30.30 eq 1433
4. deny ip any -> 10.10.30.30

Accepted Answer

Keep the reverse proxy in the DMZ and place the application and database servers in private subnets behind it.. Option B is correct because it maintains the defense-in-depth architecture: the reverse proxy in the DMZ (VLAN 10) terminates external HTTPS (TCP/443) and forwards only necessary traffic to the application server in a private VLAN (VLAN 20) over TCP/8443, while the database server remains isolated in a separate private VLAN (VLAN 30) with strict ACLs. This layered segmentation ensures that the public web application's exposure is limited to the reverse proxy, and backend tiers (app and DB) are not directly reachable from the internet, reducing the attack surface while preserving functional separation.

Answer

Move the database server into the DMZ so the public proxy can reach it directly.

Answer

Allow inbound Internet access directly to the application server on 8443, but restrict the database.

Answer

Collapse all servers into one VLAN and rely on strong passwords for protection.

Question 5

During routine checks, configuration management finds several branch firewalls drifted from the approved baseline because a contractor changed settings locally. An automation job now compares each device nightly and automatically reapplies the approved configuration without waiting for a human ticket. Which control type is the automation?

Accepted Answer

Corrective control. The automation job corrects a detected drift by automatically reapplying the approved configuration, which is a classic corrective control. Corrective controls are designed to remediate or reverse an unwanted change or security event after it has been detected. In this scenario, the nightly comparison is detective, but the automatic reapplication is the corrective action.

Answer

Directive control

Answer

Detective control

Answer

Deterrent control

Question 6

A billing application has an RTO of 2 hours and an RPO of 30 minutes. The current recovery method requires rebuilding the VM from scratch and then restoring last night's backup, which takes over six hours. Which solution best meets the stated recovery objectives?

Accepted Answer

Use a warm standby replica with frequent log shipping or near-continuous replication.. Option D is correct because a warm standby replica with frequent log shipping or near-continuous replication can achieve an RPO of 30 minutes or less by minimizing data loss, and an RTO of 2 hours by allowing rapid failover to the replica. This directly addresses the current recovery method's failure to meet the RTO (6+ hours vs. 2 hours) and RPO (last night's backup vs. 30 minutes). Technologies like SQL Server log shipping or VMware vSphere replication provide near-continuous data synchronization, enabling recovery within the stated objectives.

Answer

Keep the current backup schedule and shorten the documentation for the restore procedure.

Answer

Switch to weekly full backups and manually verify them after business hours.

Answer

Store backups on the same production host so restores are faster.

Question 7

An employee receives an email that appears to be from the CEO and asks for gift cards before a meeting. What should the employee do first?

Accepted Answer

Report the message through the approved security channel and verify the request by a separate method.. Option A is correct because the first action in response to a suspected phishing or social engineering attack is to report it through the approved security channel, which ensures the incident is logged and can be investigated. Separately verifying the request—such as by calling the CEO or using a known, trusted contact method—confirms the legitimacy of the request without relying on the potentially compromised email thread. This aligns with security policy best practices for incident response and prevents unauthorized disclosure of funds or credentials.

Answer

Buy the gift cards immediately so the CEO is not delayed.

Answer

Forward the email to coworkers so they can watch for the same request.

Answer

Reply to the sender and ask for more details in the same email thread.

Question 8

A scanner reports a critical vulnerability on an internal Linux server. The administrator verifies the package is installed, but the vulnerable code path is only present in a plugin that has been disabled and removed from the service startup. The server cannot be patched until a vendor maintenance window next month. What is the best next step?

Accepted Answer

Create a time-limited exception and apply compensating controls until patching is possible. Option B is correct because the vulnerability exists in a disabled plugin, meaning the attack surface is reduced but not eliminated; residual risk remains if the plugin is re-enabled or if other dependencies are affected. Creating a time-limited exception with compensating controls (e.g., firewall rules, file permissions, SELinux policies) allows the organization to formally accept the risk until the vendor patch is applied, which aligns with standard vulnerability management processes.

Answer

Ignore the finding because the scanner is clearly wrong

Answer

Reinstall the disabled plugin so the scanner output matches the running configuration

Answer

Expose the server to the internet for faster monitoring and patch testing

Question 9

Based on the exhibit, what is the MOST likely explanation for the network traffic?

The affected host is not showing a large amount of internet-bound traffic, but its DNS behavior is highly unusual.

Accepted Answer

DNS tunneling used for command-and-control or data transfer. The exhibit shows a host with minimal internet-bound traffic but highly unusual DNS behavior, such as frequent queries to a single domain or large DNS query sizes. This pattern is characteristic of DNS tunneling, where data is encoded in DNS queries and responses to bypass network controls, often used for command-and-control (C2) communication or covert data exfiltration. The lack of other traffic indicates the host is not performing normal web browsing or data transfers, making DNS tunneling the most likely explanation.

Answer

ARP poisoning causing the host to redirect traffic to a rogue gateway

Answer

A browser cache synchronization feature repeatedly polling a cloud service

Answer

A misconfigured static route sending all web traffic to the wrong subnet

Question 10

Company-owned tablets are used by field staff for both corporate email and approved personal apps. Security must isolate company data from personal data, allow remote wipe of only the corporate workspace, and block access if the device is rooted or encryption is disabled. Which approach best fits?

Accepted Answer

Use MDM or UEM with a managed work profile or container, compliance checks, and selective wipe.. Option B is correct because Mobile Device Management (MDM) or Unified Endpoint Management (UEM) with a managed work profile (e.g., Android Work Profile or iOS Managed Open In) creates a separate, encrypted container for corporate data. This allows compliance checks to detect rooted devices or disabled encryption, and enables a selective wipe that removes only the corporate workspace without affecting personal apps or data.

Answer

Use a consumer anti-malware app and perform a full-device wipe if the tablet is lost.

Answer

Install a VPN app on the tablets and let users choose their own lock-screen settings.

Answer

Use application allowlisting alone and avoid enrolling the tablets in a management platform.

SY0-701 Practice Test 4 — 10 Questions

Exhibit

SY0-701 Practice Test 4 — 10 Questions

Exhibit