SY0-701 Practice Test 11 — 15 Questions

Question 1

A software supplier used by your organization begins subcontracting a critical part of its service to an unknown hosting company. Which contractual control would BEST help manage this supply chain risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Require advance notice and approval for subcontractor changes, plus right-to-audit and security obligations.. It establishes a contractual control that requires the supplier to notify and obtain approval before subcontracting critical services, while also imposing right-to-audit and security obligations. This directly addresses supply chain risk by ensuring the organization can vet and monitor the subcontractor's security posture, as recommended by NIST SP 800-161 for supply chain risk management.

Answer

Require the supplier to send monthly sales updates to the procurement team.

Answer

Ask the supplier to place all responsibility for the subcontractor on the customer.

Answer

Disable all vendor access immediately without reviewing the change.

Question 2

A workstation is suspected of malware infection, and it is still powered on and connected to the network. Which action best preserves volatile evidence before the system is shut down?

Accepted Answer

Capture memory and note running processes before taking further action.. Volatile evidence, such as the contents of RAM (running processes, network connections, open files), is lost when the system is powered off. Capturing a memory dump and recording running processes preserves this critical data for forensic analysis, allowing investigators to identify malware artifacts (e.g., injected code, hidden processes) that exist only in memory. This aligns with the NIST SP 800-86 forensic procedure of prioritizing volatile data collection before system shutdown.

Answer

Immediately power off the workstation to stop any malicious activity.

Answer

Run a full antivirus scan before documenting anything.

Answer

Delete temporary files to reduce the chance of reinfection.

Question 3

A router interface connects the DMZ subnet 10.10.10.0/24 to the internal network. A web server at 10.10.10.25 must reach an application server at 10.10.20.20 on TCP 8443, and all other DMZ-to-internal traffic must be blocked. Which two ACL entries should be applied inbound on the DMZ-facing interface? Select two.

Accepted Answer

permit tcp 10.10.10.25 host 10.10.20.20 eq 8443. It permits TCP traffic from the specific web server (10.10.10.25) to the application server (10.10.20.20) on destination port 8443, which is the only allowed DMZ-to-internal communication. This entry uses the 'host' keyword to specify the exact source IP and the 'eq' keyword to match the required destination port, implementing the principle of least privilege.

Answer

permit tcp host 10.10.20.20 any eq 8443

Answer

permit ip any any

Answer

permit udp 10.10.10.0/24 host 10.10.20.20 eq 8443

Question 4

Based on the exhibit, which control should be enabled to mitigate this issue?

Accepted Answer

Dynamic ARP inspection with DHCP snooping, because it validates ARP replies against trusted bindings.. Dynamic ARP inspection (DAI) with DHCP snooping validates ARP packets against a trusted binding database, preventing man-in-the-middle attacks where an attacker spoofs the MAC address of a legitimate host (e.g., the default gateway) to intercept traffic. The exhibit likely shows a scenario of ARP spoofing or cache poisoning, which DAI directly mitigates by dropping invalid ARP replies. DHCP snooping builds the trusted binding table by recording which IP address is assigned to which MAC address on which port.

Answer

DNSSEC, because it validates DNS records and would stop local address-to-MAC spoofing.

Answer

Port forwarding, because it can direct traffic to the correct internal host more reliably.

Answer

Load balancing, because it would distribute traffic and reduce the impact of connectivity issues.

Question 5

Your company is syncing design files to a cloud object store. The security team wants to reduce risk if the storage account is stolen and also protect the files while they travel across the internet. Which approach is the best fit?

Accepted Answer

Encrypt data in transit with TLS and enable encryption at rest with managed keys.. It addresses both risks: TLS (Transport Layer Security) encrypts data in transit, preventing interception or tampering during upload, while managed keys for encryption at rest protect the files if the storage account credentials are compromised. This dual-layer approach aligns with defense-in-depth and is a standard best practice for cloud object stores like Amazon S3 or Azure Blob Storage.

Answer

Password-protect each archive and upload it over plain HTTP.

Answer

Rename the files before upload so attackers cannot identify them.

Answer

Place the storage service on a private IP address and skip encryption.

Question 6

HR needs to share a copy of employee records with a benefits contractor for testing. The contractor only needs names and coverage selections, not Social Security numbers or bank details. Which two actions best satisfy data handling requirements? Select two.

Accepted Answer

Redact or mask unnecessary sensitive fields before sharing the file.. Redacting or masking sensitive fields like Social Security numbers and bank details ensures that the contractor receives only the necessary data (names and coverage selections) while protecting personally identifiable information (PII). This aligns with the principle of data minimization and compliance with regulations such as GDPR or HIPAA, which require that only the minimum necessary data be shared for a specific purpose. Masking techniques, such as replacing SSNs with placeholders or applying irreversible hashing, prevent unauthorized exposure even if the file is intercepted.

Answer

Send the full employee record set because the contractor is trusted.

Answer

Upload the file to a public collaboration site so the contractor can retrieve it easily.

Answer

Keep an unrestricted copy on multiple shared drives for convenience.

Question 7

A cloud-hosted API lets users supply a URL for the service to fetch an image. Shortly after release, logs show requests to 169.254.169.254 and internal admin addresses. What control best reduces this risk?

Accepted Answer

Restrict outbound requests to an allowlist and block internal address ranges.. Restricting outbound requests to an allowlist and blocking internal address ranges directly mitigates the Server-Side Request Forgery (SSRF) vulnerability. The requests to 169.254.169.254 (the AWS/GCP/Azure metadata endpoint) and internal admin addresses indicate an attacker is using the API to probe internal services. An allowlist ensures the API only connects to trusted external hosts, while blocking private and link-local ranges prevents access to internal infrastructure.

Answer

Allow the API to follow any redirect so it works with more image sources.

Answer

Store the fetched image in encrypted form before sending it to users.

Answer

Increase the session timeout to reduce repeated logins by legitimate users.

Question 8

Based on the exhibit, what type of malware is most likely present?

Accepted Answer

Logic bomb. The exhibit shows a script that checks for a specific employee name and, if the condition is met, deletes critical system files. This is a classic logic bomb: malicious code embedded in a legitimate program that executes when predefined conditions (e.g., a specific user, date, or event) are satisfied. Logic bombs do not self-replicate or continuously spy; they lie dormant until triggered.

Answer

Worm

Answer

Spyware

Answer

Rootkit

Question 9

EDR shows encoded PowerShell launched by a word processor and an outbound connection to a rare domain. What is the best immediate containment action?

Accepted Answer

Isolate the endpoint from the network using the EDR console.. Isolating the endpoint from the network using the EDR console is the best immediate containment action because it stops the outbound connection to the rare domain, preventing potential command-and-control (C2) communication or data exfiltration. The encoded PowerShell launched by a word processor strongly suggests a malicious macro or exploit, and isolating the host contains the threat without disrupting the entire network. This aligns with the incident response priority of containment before eradication or recovery.

Answer

Uninstall the word processor from every workstation.

Answer

Wait to see whether more alerts appear before responding.

Answer

Send a notice to all users reminding them not to open attachments.

Question 10

A caller says they are from IT support and asks a user to read back the one-time MFA code that just arrived on their phone. What type of attack is this most likely?

Accepted Answer

Vishing. This is a vishing (voice phishing) attack because the attacker uses a phone call to socially engineer the victim into revealing a one-time MFA code. Unlike phishing (email) or smishing (SMS), vishing relies on voice communication to bypass technical controls and trick the user into providing the code, which the attacker can then use to authenticate as the victim.

Answer

Phishing

Answer

Smishing

Answer

Baiting

Question 11

A development team needs a centralized service to store, rotate, and control access to encryption keys for applications. Which solution best fits?

Accepted Answer

Key management service, because it centralizes key storage and rotation controls.. A key management service (KMS) centralizes the lifecycle of cryptographic keys, including secure storage, automated rotation, and fine-grained access control via IAM policies. This directly meets the requirement for a centralized service to store, rotate, and control access to encryption keys for applications, as KMS is purpose-built for these tasks.

Answer

Port forwarding rule, because it allows applications to reach the encryption system.

Answer

Load balancer, because it distributes encryption requests across servers.

Answer

Web application firewall, because it protects the keys from injection attacks.

Question 12

A file server suddenly shows renamed files with a new extension, users see a ransom note demanding cryptocurrency, and shadow copies are deleted from the host. Which malware family is the best match?

Accepted Answer

Ransomware, because the attacker is encrypting data and demanding payment to restore access.. Ransomware is the correct classification because the scenario describes file encryption (renamed files with new extensions), a ransom note demanding cryptocurrency, and the deletion of shadow copies (Volume Shadow Copy Service snapshots) to prevent file recovery. These are hallmark behaviors of ransomware, specifically crypto-ransomware, which encrypts data and demands payment for decryption keys.

Answer

Trojan, because the attack requires a disguised program to install itself.

Answer

Spyware, because the attacker is likely trying to monitor file activity.

Answer

Logic bomb, because the malware likely triggered after a specific condition was met.

Question 13

A security operations center (SOC) analyst is overwhelmed by the volume of alerts. The management wants to implement a solution that can automatically respond to common threats, such as blocking an IP address or isolating a compromised endpoint, without requiring human intervention. Which of the following technologies best meets this requirement?

Accepted Answer

Security Orchestration, Automation, and Response (SOAR). SOAR is the correct choice because it is specifically designed to automate response actions to common security incidents, such as blocking an IP address via firewall APIs or isolating an endpoint through EDR integration, without requiring human intervention. This directly addresses the SOC analyst's alert fatigue by enabling playbook-driven, automated remediation.

Answer

Security Information and Event Management (SIEM)

Answer

Endpoint Detection and Response (EDR)

Answer

Cloud Access Security Broker (CASB)

Question 14

An office loses power several times each month, causing servers to shut down without warning. Which control best helps keep the systems running long enough for a safe shutdown?

Accepted Answer

A UPS sized to support the equipment for a short period.. A UPS (Uninterruptible Power Supply) provides battery backup power to connected equipment, allowing servers to continue running for a short duration after a power loss. This gives administrators enough time to perform a safe, orderly shutdown, preventing data corruption and hardware damage from abrupt power loss.

Answer

A better wallpaper design in the server room.

Answer

A stronger password for the power strip.

Answer

More user awareness training about turning monitors off.

Question 15

Based on the exhibit, what wireless threat is most likely occurring?

Accepted Answer

Evil twin access point. The exhibit shows a legitimate access point (SSID: 'CorpNet') with a second, rogue access point broadcasting the same SSID but with a stronger signal. This is the classic behavior of an evil twin attack, where an attacker sets up a fraudulent AP to intercept client connections and capture credentials or sensitive data. The victim's device automatically associates with the stronger signal, believing it is the legitimate network.

Answer

Bluetooth pairing abuse

Answer

NFC skimming

Answer

DNS poisoning