SY0-701 Practice Test 13 — 15 Questions

Question 1

An investigator needs a copy of a suspect laptop drive for analysis without changing the original media. What should be used?

Accepted Answer

A full forensic image taken with a write blocker. A full forensic image taken with a write blocker is the correct method because it creates a bit-for-bit copy of the entire drive, including all partitions, unallocated space, and metadata, without altering the original media. The write blocker hardware or software ensures that no write commands reach the suspect drive, preserving its integrity for legal and evidentiary purposes. This approach is required by forensic standards such as NIST SP 800-86 and ensures the copy is admissible as evidence.

Answer

A simple file copy of the user folder

Answer

A compressed archive of the desktop contents

Answer

The original drive mounted normally on the investigator machine

Question 2

Based on the exhibit, what is the best next control to prevent noncompliant mobile devices from accessing corporate email while still allowing IT to wipe company data from lost phones?

Accepted Answer

Enforce conditional access so only compliant MDM-enrolled devices can reach email and enable selective wipe for corporate data.. It combines conditional access policies (e.g., Microsoft Entra Conditional Access or Intune compliance policies) to block noncompliant devices from accessing corporate email, while using MDM selective wipe to remove only corporate data (e.g., email, documents) without affecting personal data on the device. This approach enforces security without requiring a full device wipe, preserving user privacy and IT control.

Answer

Require users to set a longer password on the email app and keep the current access policy.

Answer

Disable email on all mobile devices and force users to use desktop computers only.

Answer

Rely on a remote full factory reset whenever a device is lost or reported stolen.

Question 3

A vulnerability dashboard shows four new findings. Which one should be remediated first by the operations team?

- A low-severity issue on an offline lab VM
- A medium-severity issue on a payroll server with no known exploit
- A critical issue on an internet-facing web server with an available exploit
- A high-severity issue on a test workstation that is not domain joined

Accepted Answer

The critical issue on the internet-facing web server with an available exploit.. The critical issue on the internet-facing web server with an available exploit should be remediated first because it combines the highest severity (critical) with an active, exploitable vulnerability on an asset exposed to the public internet. In vulnerability management, remediation priority is determined by risk, which is a function of severity, exploitability, and asset exposure. An internet-facing web server with a known exploit represents an immediate threat that can be remotely compromised, unlike the other findings which are on isolated or less critical systems.

Answer

The low-severity issue on the offline lab VM.

Answer

The medium-severity issue on the payroll server with no known exploit.

Answer

The high-severity issue on the test workstation that is not domain joined.

Question 4

A legacy payroll application cannot support multifactor authentication yet, but the business still needs to reduce risk while the application is being modernized. The security team limits access to a hardened jump host, requires manager approval for access requests, and adds extra logging until the application can be upgraded. What type of control is this?

Accepted Answer

Compensating control. Compensating controls are alternative security measures implemented when primary controls (like MFA) cannot be applied due to technical limitations. In this scenario, the jump host restriction, manager approval, and enhanced logging serve as compensating controls to reduce risk until the legacy payroll application can be modernized to support MFA.

Answer

Corrective control

Answer

Deterrent control

Answer

Preventive control

Question 5

Users in a warehouse report an SMS claiming a missed delivery. The link opens a login page that closely matches the company portal, and several users later receive unauthorized password reset emails. What attack is most likely?

Accepted Answer

Smishing, because the malicious lure is delivered through text messaging.. The attack is smishing because the initial lure is delivered via SMS (Short Message Service), directing victims to a fraudulent login page. This aligns with the definition of smishing, a form of phishing that uses text messages to trick recipients into revealing sensitive information. The subsequent unauthorized password reset emails confirm credential compromise, which is the typical goal of smishing attacks.

Answer

Vishing, because the attackers are likely trying to get a callback from the victims.

Answer

Spear phishing, because the message appears customized for warehouse employees.

Answer

Baiting, because the fake delivery notice tempts users to click for a reward.

Question 6

After a suspicious laptop is imaged with a write blocker, the original drive is sealed and stored. Before a second analyst examines the image, what is the most important next step to preserve admissibility?

Accepted Answer

Document the transfer in the chain-of-custody log and verify the image hash still matches the acquisition value.. Before a second analyst accesses the image, the most critical step is to update the chain-of-custody log to document the transfer of custody and to verify the integrity of the image by comparing its current hash value against the original acquisition hash. This ensures that the evidence has not been altered or corrupted since it was first imaged, which is essential for maintaining admissibility in legal proceedings under rules such as the Federal Rules of Evidence.

Answer

Mount the image read/write so the analyst can browse faster.

Answer

Copy the image to a USB drive for easier transport.

Answer

Rename the evidence file to match the case number.

Question 7

Based on the exhibit, which finding is the best candidate for immediate remediation or emergency mitigation?

Accepted Answer

VPN-EDGE01, because a critical internet-facing RCE with public exploit code has the highest risk.. VPN-EDGE01 is an internet-facing device with a critical remote code execution (RCE) vulnerability that has public exploit code available. This combination of high severity, network exposure, and weaponized exploit makes it the highest risk and most urgent for immediate remediation or emergency mitigation.

Answer

FILE-02, because file servers often affect many users and should always come before perimeter systems.

Answer

TEST-VM-17, because any high-severity issue deserves the fastest response regardless of exposure.

Answer

PRINTER-3F, because default credentials are the easiest issue to exploit and therefore the most dangerous.

Question 8

A SIEM reviews VPN authentication logs and sees 36 different usernames each receive one failed login attempt from the same source IP over 20 minutes, followed by one successful login to an unrelated account. Which attack is most likely?

Accepted Answer

Password spraying against many accounts with a low number of attempts per account.. The SIEM observed 36 different usernames each receiving one failed login attempt from the same source IP over 20 minutes, followed by one successful login to an unrelated account. This pattern is characteristic of a password spraying attack, where an attacker tries a small number of common passwords against many accounts to avoid account lockout thresholds, and then uses a successful credential to pivot to another account. The low number of attempts per account (one each) and the wide spread of usernames distinguish it from brute-force or targeted attacks.

Answer

A brute-force attack focused on a single locked account.

Answer

A replay attack using captured authentication data.

Answer

A port scan that accidentally triggered authentication failures.

Question 9

A server room uses raised flooring and sits below a chilled-water pipe. Facilities wants the earliest warning if water starts accumulating under the floor tiles. Which control should be added?

Accepted Answer

Install leak-detection sensors or a moisture detection cable tied to alerts.. Leak-detection sensors or moisture-detection cables are specifically designed to detect water accumulation under raised floors, providing the earliest possible warning. These sensors trigger alerts when moisture is present, allowing facilities to respond before water damages equipment or causes downtime. This directly addresses the risk of a chilled-water pipe leak in a server room environment.

Answer

Add more motion detectors near the racks.

Answer

Use badge readers on the server room door.

Answer

Install smoke detectors only.

Question 10

An internal finance application has an RTO of 2 hours and an RPO of 30 minutes. Current backups restore in about 6 hours because the team must rebuild the server from scratch. Which change best aligns the recovery design to the business requirement?

Accepted Answer

Add a warm standby or replicated recovery system that can be brought online within the RTO. The business requires an RTO of 2 hours and an RPO of 30 minutes, but current backups take 6 hours to restore because the server must be rebuilt from scratch. Adding a warm standby or replicated recovery system allows the application to be brought online within the RTO by maintaining a pre-configured, partially synchronized environment that can be activated quickly, reducing recovery time from hours to minutes. This aligns the recovery design with the business continuity requirements by meeting both the RTO and RPO targets.

Answer

Keep the same design and simply increase backup retention

Answer

Switch to weekly full backups only

Answer

Reduce logging on the application server to improve restore speed

Question 11

Based on the exhibit, what is the BEST response by the employee?

The message appears to come from a trusted internal support team, but the sender details and request do not align with normal procedures.

Accepted Answer

Verify the request using a known internal help desk number or portal before taking any action.. Verifying the request through a known internal help desk number or portal is the standard security practice to confirm the legitimacy of any unexpected communication, especially when sender details and procedures do not align. This approach mitigates the risk of social engineering attacks, such as phishing or business email compromise (BEC), where attackers impersonate trusted entities to trick employees into revealing sensitive information or performing unauthorized actions. By using an independently verified contact method, the employee ensures they are not falling victim to a fraudulent request that could lead to account compromise or data breach.

Answer

Reply with the six-digit code so the help desk can complete the repair quickly.

Answer

Open the linked repair page from the email and sign in immediately to avoid suspension.

Answer

Forward the message to the manager and continue using the account until the suspension occurs.

Question 12

To reduce fraud, a finance system requires one user to create a payment batch, a different user to approve it, and a third role to release it to the bank. An audit recommends adding a "super-user" who can perform all three steps to speed month-end close. Which principle would that recommendation most directly weaken?

Accepted Answer

Separation of duties. The recommendation to create a super-user who can create, approve, and release payment batches directly violates the separation of duties principle. This principle requires that critical tasks be divided among multiple individuals to prevent any single person from having the ability to commit fraud without collusion. By allowing one user to perform all three steps, the system loses the fraud-prevention control that requires independent actors for each stage of the payment lifecycle.

Answer

Least privilege

Answer

Need-to-know

Answer

Defense in depth

Question 13

A cloud support team is changing the way employees access an internal finance portal. Instead of trusting the user's initial login for the rest of the session, the portal now checks identity, device posture, and request context again before allowing access to payroll data or download actions. Which security concept is being implemented?

Accepted Answer

Zero trust. The scenario describes a shift from implicit trust (trusting the initial login for the entire session) to continuous verification of identity, device posture, and request context before granting access to sensitive actions. This is the core principle of Zero Trust, specifically the 'never trust, always verify' model, which treats every access request as if it originates from an untrusted network. The portal is enforcing a policy that re-evaluates trust at each sensitive operation, not just at session start.

Answer

Defense in depth

Answer

Need-to-know

Answer

Least privilege

Question 14

A help desk technician reviews a voicemail in which the caller claims to be from the security team, says the user will be locked out unless they read back a one-time passcode, and leaves a callback number. What type of attack is this?

Accepted Answer

Vishing, because the attacker is using voice communication to pressure the user.. Vishing (voice phishing) uses voice communication—such as phone calls or voicemails—to trick victims into revealing sensitive information. In this scenario, the attacker leaves a voicemail claiming to be from the security team and pressures the user to read back a one-time passcode, which is a classic vishing tactic that exploits trust and urgency over voice channels.

Answer

Smishing, because the attacker is using a text message with a link.

Answer

Baiting, because the attacker is offering a reward to entice the user.

Answer

Pretexting, because the attacker invented a role and story.

Question 15

A security manager is evaluating the effectiveness of a new security awareness training program that all employees completed last quarter. The company has been conducting monthly phishing simulation campaigns for the past year. Which of the following metrics would provide the strongest evidence that the training is achieving its intended goal of changing employee behavior?

Accepted Answer

The percentage of employees who clicked on a simulated phishing email decreased from 18% to 6%.. Directly measures the reduction in risky behavior (clicking phishing links) after training, which is the core goal of security awareness training. A drop from 18% to 6% demonstrates a measurable behavior change, not just knowledge acquisition. This aligns with the Kirkpatrick Model's 'Behavior' level of evaluation, which is the strongest indicator of training effectiveness.

Answer

95% of employees completed the training within the deadline.

Answer

The number of employees reporting phishing attempts to the SOC increased by 40%.

Answer

The number of helpdesk tickets related to password resets decreased by 10%.