SY0-701 Practice Test 12 — 15 Questions

Question 1

A help desk technician reviews a ticket where a user says they logged out of the payroll portal, but another employee who found the session cookie in a browser debug log could still access the account until the session expired. Which attack best matches this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Session hijacking, because a stolen session token was reused to impersonate the user.. The described behavior—where a session cookie stolen from a browser debug log is reused by another employee to access the payroll portal—is a classic session hijacking attack. Session hijacking occurs when an attacker captures a valid session token (e.g., a cookie containing a session ID) and uses it to impersonate the authenticated user, bypassing the need for credentials. In this case, the session cookie was not invalidated upon logout, allowing the attacker to reuse it until the session's expiration time.

Answer

Pretexting, because the attacker pretended to be an authorized employee on a phone call.

Answer

CSRF, because the victim was tricked into sending unwanted requests from their browser.

Answer

Insecure deserialization, because serialized objects were accepted without validation.

Question 2

A small company is redesigning its network for a public web application. The web front end must be reachable from the internet, but the database should never be exposed directly to external or general user traffic. Which architecture is the best choice?

Accepted Answer

Place the web server in a DMZ and keep the database in a private internal subnet with only required application traffic allowed.. It implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) where it is reachable from the internet, while the database is placed in a private internal subnet with strict firewall rules that only allow the required application traffic (e.g., TCP port 3306 for MySQL or 1433 for MSSQL) from the web server. This ensures the database is never directly exposed to external or general user traffic, reducing the attack surface and preventing direct internet-based attacks on the database.

Answer

Place both the web server and database in the same internal subnet and rely on host firewalls.

Answer

Place the database in the DMZ so the web server can query it directly without internal routing.

Answer

Keep both systems public but restrict access with NAT and strong administrator passwords.

Question 3

Based on the exhibit, which temporary control best reduces risk until the patch is released?

Accepted Answer

Place the service behind a reverse proxy or WAF and restrict access with source IP allow lists.. Placing the service behind a reverse proxy or Web Application Firewall (WAF) with source IP allow lists provides a temporary compensating control that reduces the attack surface until the vendor releases a patch. The reverse proxy or WAF can inspect and filter malicious traffic, while IP allow lists restrict access to trusted sources only, mitigating the risk of exploitation without removing the service entirely.

Answer

Increase scan frequency to daily and leave the service exposed.

Answer

Disable TLS so the traffic can be inspected more easily.

Answer

Move administrative access to the same 443 listener as user traffic.

Question 4

Based on the exhibit, which supply-chain threat is most likely?

Accepted Answer

Dependency compromise. The exhibit shows a dependency on a third-party library (e.g., a JavaScript package from a CDN or a software component from an external repository). A dependency compromise occurs when an attacker injects malicious code into that trusted third-party component, which is then pulled into the organization's environment during updates or builds. This is the most likely supply-chain threat because it directly exploits the trust placed in external dependencies.

Answer

Brute-force attack

Answer

SQL injection

Answer

Privilege escalation

Question 5

Based on the exhibit, which attack is the developer most likely observing?

Accepted Answer

Server-side request forgery (SSRF). The developer is most likely observing a server-side request forgery (SSRF) attack because the log shows the application making an outbound HTTP request to an internal IP address (10.0.0.1) initiated by user-supplied input (the 'url' parameter). SSRF occurs when an attacker manipulates the server to send crafted requests to internal or external resources, bypassing access controls. The exhibit's pattern of a server-side request to a private IP range directly indicates SSRF, not client-side or database attacks.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

CSRF

Question 6

A help desk technician receives a phone call from someone who claims to be the CFO. The caller knows the executive team structure, says they are traveling, and insists the technician reset MFA to 'avoid delaying a wire transfer.' Which social engineering technique is the caller primarily using?

Accepted Answer

Pretexting, because the caller builds a believable story to manipulate the employee. The caller is using pretexting because they have fabricated a scenario (the CFO traveling and needing an urgent wire transfer) and assumed a false identity to manipulate the help desk technician into resetting MFA. Pretexting relies on a crafted story or pretext to gain trust and bypass security controls, which is exactly what the caller is doing here.

Answer

Baiting, because the caller is offering something valuable in exchange for action

Answer

Vishing, because the attack happens by voice call

Answer

Smishing, because the attacker is using a mobile device

Question 7

A security analyst is investigating a web application that allows users to input a filename to view its contents. The application passes the user input directly to a system command without sanitization. An attacker submits the input 'file.txt; cat /etc/passwd' and successfully retrieves the contents of the password file. Which type of attack occurred?

Accepted Answer

Command injection. The application passes user input directly to a system command without sanitization. The attacker's input 'file.txt; cat /etc/passwd' uses a semicolon to terminate the intended command and execute a second command, which retrieves the password file. This is a classic command injection attack, where arbitrary system commands are executed via the vulnerable interface.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Directory traversal

Question 8

After an employee successfully signs in to a file-sharing portal, the portal checks whether the employee can upload files to a specific project folder. Which AAA concept is being used?

Accepted Answer

Authorization, because the system is deciding what the signed-in user is allowed to do.. After the user successfully signs in (authentication), the portal checks permissions to determine if they can upload files to a specific project folder. This is the definition of authorization: verifying what an authenticated user is allowed to do. The system is enforcing access control based on the user's identity and the folder's permissions.

Answer

Authentication, because the user proved their identity with credentials.

Answer

Accounting, because the portal is recording the folder permissions for later review.

Answer

Nonrepudiation, because the portal proves the user cannot deny uploading a file.

Question 9

An analyst on the HR application team needs access to a production database replica only long enough to verify a column-mapping issue. The analyst should not be able to browse salary fields, export tables, or keep access after the task ends. Which principle best matches the desired access model?

Accepted Answer

Need-to-know. The need-to-know principle restricts access to only the information required to perform a specific task. In this scenario, the analyst needs access to verify a column-mapping issue but must not see salary fields, export tables, or retain access afterward. Need-to-know ensures access is limited to the exact data and duration necessary, which aligns with granting temporary, scoped access to a production database replica without broader data exposure.

Answer

Least privilege

Answer

Separation of duties

Answer

Defense in depth

Question 10

A company manages 300 laptops and wants to reduce risk from missed patches while avoiding a widespread outage if an update has compatibility issues. Which patching approach is the best choice?

Accepted Answer

Use a phased rollout with a pilot group, then expand deployment after validation, while keeping a standard baseline configuration.. A phased rollout with a pilot group allows the IT team to validate patches on a small subset of laptops before full deployment, reducing the risk of widespread outages from compatibility issues. Maintaining a standard baseline configuration ensures consistency across all 300 laptops, which simplifies patch management and reduces the likelihood of missed patches. This approach balances risk mitigation with operational continuity, aligning with best practices for enterprise patch management.

Answer

Install patches manually on each laptop after users report problems.

Answer

Deploy all patches to every laptop immediately with no testing.

Answer

Wait for annual maintenance windows so all changes happen at once.

Question 11

An auditor asks for evidence that the new workstation hardening baseline is actually applied across all finance laptops. Which evidence is the best to provide?

Accepted Answer

An automated compliance report from the configuration management tool showing baseline status across all devices.. An automated compliance report from a configuration management tool (e.g., Microsoft Intune, SCCM, or Ansible) provides verifiable, centralized evidence that the hardening baseline is applied across all finance laptops. Unlike manual screenshots or policy documents, this report shows real-time or historical compliance status for every device, proving enforcement at scale.

Answer

A copy of the hardening policy that says all laptops must be secured.

Answer

A manager’s email confirming that the baseline was announced to the team.

Answer

Screenshots from one finance laptop showing the baseline settings.

Question 12

You are handed a company laptop suspected in an insider theft case. Legal says the evidence may be needed in court. Which action best preserves admissibility?

Accepted Answer

Create a forensic image using a write blocker and record hash values.. Creating a forensic image with a write blocker ensures the original evidence remains unaltered, preserving its integrity for court admissibility. Recording hash values (e.g., SHA-256) provides a cryptographic fingerprint that can later verify the image is an exact copy, meeting legal standards for chain of custody and authenticity.

Answer

Browse the drive directly on the original laptop to identify the most relevant files.

Answer

Email the user asking them to return any copies they may have made.

Answer

Mount the drive read-write so searching and exporting data will be faster.

Question 13

A branch office uses a NAS for nightly backups, but the NAS is joined to the same domain as the production servers. After ransomware encrypted both production data and backups, management wants the most effective change to reduce the chance of backup tampering without a major redesign. Which control should be implemented?

Accepted Answer

Keep one backup copy offline or immutable and outside the production domain.. Keeping one backup copy offline or immutable and outside the production domain ensures that even if ransomware compromises the domain, it cannot encrypt or tamper with that isolated copy. This breaks the chain of trust between the production environment and the backup storage, directly addressing the root cause of the incident.

Answer

Increase the retention period so deleted files can be recovered for longer.

Answer

Move backups to a larger NAS with more available storage capacity.

Answer

Run backups more frequently to the same NAS so newer files are captured sooner.

Question 14

The CIO wants to compare two mitigation options for a payment system outage and justify the budget request in dollars. The team already knows the likely downtime window, annual incident frequency, and estimated revenue loss per hour. Which approach would best support the decision?

Accepted Answer

Quantitative risk analysis. Quantitative risk analysis (Option B) is correct because it uses numerical data—such as the likely downtime window, annual incident frequency, and estimated revenue loss per hour—to calculate a monetary value (e.g., Annualized Loss Expectancy). This directly supports the CIO's need to compare mitigation options in dollars and justify a budget request with hard numbers, unlike qualitative methods that rely on subjective ratings.

Answer

Qualitative risk analysis

Answer

Risk avoidance

Answer

Risk acceptance

Question 15

A vendor distributes a Linux package through multiple mirrors. Security wants to verify that the package really came from the vendor and was not altered after publication, even if a mirror or CDN is compromised. Which cryptographic mechanism should be checked?

Accepted Answer

A digital signature created with the vendor's private key. A digital signature created with the vendor's private key provides both authentication (proving the package came from the vendor) and integrity (detecting any alteration after signing). Even if a mirror or CDN is compromised, the signature verification will fail if the package has been tampered with, because only the vendor's corresponding public key can validate the signature. This is the standard mechanism used by package managers like APT (with signed Release files) and RPM (with GPG signatures).

Answer

A hash value published on the mirror site alone

Answer

Symmetric encryption of the package with a shared secret

Answer

Key stretching with a slow password algorithm