SY0-701 Practice Test 14 — 15 Questions

Question 1

A help desk technician reports that a user's account was locked out three times overnight. The security team reviews the authentication logs and discovers that the lockouts resulted from failed login attempts originating from a single external IP address, each attempt using a slightly different variation of the user's password. Which of the following should the security analyst do FIRST?

Accepted Answer

Investigate the user's recent activity for signs of compromise.. Option C is correct because the pattern of failed login attempts from a single external IP using password variations suggests a brute-force or password-spraying attack. The security analyst must first investigate the user's recent activity to determine if the account was successfully compromised or if the attacker gained access via a successful login attempt before the lockouts occurred. This aligns with the incident response process, where identification and analysis precede containment actions like blocking IPs or resetting passwords.

Answer

Block the external IP address at the perimeter firewall.

Answer

Disable the user account and require a password reset.

Answer

Increase the account lockout threshold to prevent future lockouts.

Question 2

A help desk technician receives an email that appears to come from the payroll provider. The message says the employee's direct deposit will be suspended unless they verify their account through a link. What type of attack is this?

Accepted Answer

Phishing. This is a classic phishing attack because the email impersonates a trusted entity (the payroll provider) and uses social engineering to trick the recipient into clicking a malicious link. Phishing specifically involves fraudulent electronic communications, such as email, to deceive victims into revealing sensitive information or installing malware. The attack vector here is email-based, which aligns directly with the definition of phishing in the SY0-701 domain of threats and vulnerabilities.

Answer

Baiting

Answer

Vishing

Answer

Pretexting

Question 3

A hospital is redesigning its wireless network. Guest devices must reach only the internet. Staff laptops need access to internal applications. Medical devices must communicate with a monitoring server but never with guest devices or the broader employee LAN. What design best meets these goals with the least operational complexity?

Accepted Answer

Create separate VLANs for guest, staff, and medical devices, then enforce traffic rules between them with firewall policies.. Option B is correct because VLANs logically segment the network into isolated broadcast domains for guest, staff, and medical devices, while firewall policies (e.g., using ACLs or stateful inspection) enforce granular traffic rules. This design ensures medical devices can only communicate with the monitoring server, guests are restricted to internet-only access, and staff can reach internal applications, all without requiring complex physical reconfiguration.

Answer

Place all devices on one flat network and rely on endpoint antivirus for protection.

Answer

Use a single wireless SSID with client isolation enabled and NAT all traffic through one gateway.

Answer

Deploy network access control only at login time and allow all devices onto the same internal subnet afterward.

Question 4

A help desk ticket confirms that a user entered corporate credentials into a fake sign-in page. Minutes later, the security team finds a new mailbox forwarding rule and evidence that the attacker added backup MFA codes. After disabling the account, what should the team do next to support containment and recovery?

Accepted Answer

Revoke active sessions and reset the compromised credentials.. Option C is correct because after disabling a compromised account, the immediate next step is to revoke all active sessions and reset the credentials. This ensures the attacker cannot maintain access via existing tokens or session cookies, and the new password invalidates any cached or stolen credentials. This aligns with the NIST SP 800-61 incident response containment phase, which prioritizes cutting off active attacker access before further investigation.

Answer

Wait for the user to confirm the behavior before taking any further steps.

Answer

Reimage the user's laptop before reviewing the account activity.

Answer

Close the ticket because MFA was enabled and should have prevented access.

Question 5

A cloud support team is changing the way employees access an internal finance portal. Instead of trusting the user's initial login for the rest of the session, the portal now checks identity, device posture, and request context again before allowing access to payroll data or download actions. Which security concept is being implemented?

Accepted Answer

Zero trust. The scenario describes a shift from implicit trust (trusting the initial login for the entire session) to continuous verification of identity, device posture, and request context before granting access to sensitive actions. This is the core principle of Zero Trust, specifically the 'never trust, always verify' model, which treats every access request as if it originates from an untrusted network. The portal is enforcing a policy that re-evaluates trust at each sensitive operation, not just at session start.

Answer

Defense in depth

Answer

Need-to-know

Answer

Least privilege

Question 6

A company is placing its public web server so internet users can reach it, but the database server must stay hidden from the internet and be reachable only by the web server. Which design best supports this goal?

Accepted Answer

Place the web server in a DMZ and keep the database server on the internal network. Option B is correct because it uses a DMZ (demilitarized zone) to isolate the public-facing web server from the internal network. The web server in the DMZ is accessible from the internet, while the database server remains on the internal network, reachable only by the web server through a firewall rule that permits traffic on the specific database port (e.g., TCP 3306 for MySQL). This layered security design prevents direct internet access to sensitive data.

Answer

Put both servers on the same flat internal network

Answer

Put the database server in the DMZ and the web server on the internal network

Answer

Disable the firewall so the web server can communicate freely with all hosts

Question 7

A contractor signs in to a project portal that integrates several SaaS apps. Access should be granted only while the user is on a managed device, assigned to the project, and using a fresh second factor. The business also wants the contractor to avoid separate logins to each app. Which three controls best fit this design? Select three.

Accepted Answer

Use federation or SSO so the identity provider issues the session for all approved apps.. Option A is correct because federation or SSO allows the identity provider to issue a single session token (e.g., SAML assertion or OIDC ID token) that is accepted by all integrated SaaS apps. This eliminates the need for separate logins, directly meeting the requirement to avoid multiple authentication prompts while maintaining centralized session control.

Answer

Create a shared project account so access can be revoked by changing one password.

Answer

Issue long-lived refresh tokens that never expire unless the user reports a problem.

Question 8

A finance workstation is suspected of running malware. It is still powered on, the user is logged in, and the network cable is connected. Which two actions best preserve volatile evidence before shutdown? Select two.

Accepted Answer

Capture RAM or a volatile memory image before the system is powered off. Option A is correct because capturing RAM or a volatile memory image preserves data that is lost when the system is powered off, such as running processes, encryption keys, and network connections. This is a fundamental step in forensic incident response to ensure volatile evidence is not destroyed before analysis.

Answer

Shut the workstation down immediately and restart it cleanly

Answer

Run a disk defragmentation utility to prepare for imaging

Answer

Uninstall the suspected malware before collecting any evidence

Question 9

A company distributes update packages through a web portal. Users must verify the portal's identity over the network, and the downloaded packages must be trusted even if the web server is later compromised. Which two controls best satisfy these goals? Select two.

Accepted Answer

Use HTTPS with a certificate from a trusted certificate authority so users can validate the portal.. HTTPS with a certificate from a trusted certificate authority (CA) allows the client to validate the web portal's identity by verifying the certificate's chain of trust and ensuring the domain name matches. This prevents man-in-the-middle attacks and confirms the server is legitimate before any data is exchanged.

Answer

Use FTP over the internet because the credentialed login keeps the transfer secure enough.

Answer

Publish a SHA-256 hash on the same download page and trust that the server will remain honest.

Answer

Use plain HTTP and rely on file permissions to protect the updates in transit.

Question 10

A caller says they are from the help desk and need the employee's MFA code to "complete a password reset". Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting is a social engineering technique where an attacker fabricates a scenario (the pretext) to trick a victim into divulging sensitive information. In this case, the attacker pretends to be from the help desk and invokes a false password reset procedure to obtain the employee's MFA code, which should never be shared. The MFA code is a time-based one-time password (TOTP) or push notification response that authenticates the user, not a tool for password resets.

Answer

Phishing

Answer

DDoS

Answer

SQL injection

Question 11

A branch office stores nightly backups on a NAS that is joined to the same Active Directory domain as the production servers. After a ransomware incident, management wants a backup design that is much harder for attackers to encrypt or delete. Which approach is the best improvement?

Accepted Answer

Maintain an offline or immutable backup copy in a separate administrative boundary.. Option C is correct because maintaining an offline or immutable backup copy in a separate administrative boundary ensures that attackers cannot encrypt or delete the backups, even if they compromise the Active Directory domain. An offline backup (e.g., tape or disconnected disk) is physically isolated, while immutable backups (e.g., using S3 Object Lock or a NAS with WORM capabilities) prevent modification or deletion for a defined retention period. This design breaks the attacker's ability to propagate ransomware to the backup repository, addressing the core requirement of making backups much harder to encrypt or delete.

Answer

Increase the backup frequency to every hour while keeping the same NAS design.

Answer

Store all backups on the same network segment for faster restore access.

Answer

Use only snapshots on the production storage array because they are instant to restore.

Question 12

A company uses a SaaS file-sharing platform for employee documents. Which action is the company's responsibility, not the provider's?

Accepted Answer

Setting user sharing permissions and access controls for company data.. In a SaaS model, the provider manages the underlying infrastructure, including application servers, storage, and hypervisors. The customer is responsible for configuring access controls and permissions for their own data within the application. Option B correctly identifies this shared responsibility boundary.

Answer

Patching the vendor's application servers.

Answer

Replacing failed disks in the provider's storage cluster.

Answer

Maintaining the cloud provider's identity center and hypervisor.

Question 13

A company is evaluating a new cloud-based customer relationship management (CRM) provider. The provider’s documentation includes a SOC 2 Type II report, but the company’s compliance team specifically requires evidence that data in transit is encrypted using TLS 1.2 or higher, and data at rest is encrypted with AES-256. Which of the following actions best demonstrates that the company has performed proper due diligence in vendor risk management?

Accepted Answer

Review the detailed control descriptions and auditor test results within the SOC 2 Type II report that address encryption of data in transit and at rest.. Option C is correct because a SOC 2 Type II report includes detailed control descriptions and independent auditor test results that specifically verify whether encryption controls (TLS 1.2+ for data in transit and AES-256 for data at rest) are designed and operating effectively over a period of time. Reviewing these granular details allows the company to confirm compliance with its specific encryption requirements, which is a core component of due diligence in vendor risk management.

Answer

Request the provider to sign a contractual service-level agreement (SLA) that guarantees encryption compliance.

Answer

Accept the SOC 2 Type II report as sufficient and proceed without further review.

Answer

Conduct an independent penetration test on the provider’s infrastructure before signing the contract.

Question 14

A company moved an internal application to a cloud virtual machine. The security team wants operating system login events, process activity, and network flow metadata to be available in the SIEM for investigations. Which action best supports that goal?

Accepted Answer

Enable guest OS audit logging and cloud-native flow logs, then forward the data to the SIEM.. Option B is correct because it directly addresses the requirement to collect operating system login events, process activity, and network flow metadata. Enabling guest OS audit logging (e.g., via Windows Event Log or syslog) captures login and process events, while cloud-native flow logs (e.g., AWS VPC Flow Logs or Azure NSG flow logs) provide network flow metadata. Forwarding both data streams to the SIEM ensures centralized visibility for investigations.

Answer

Rely only on the cloud provider's service health dashboard and billing alerts.

Answer

Encrypt the virtual machine disks and disable all logging to reduce exposure.

Answer

Install only a web application firewall because that covers server log collection.

Question 15

A company uses a SaaS CRM platform. The provider patches the application and underlying infrastructure. Which two responsibilities remain with the company? Select two.

Accepted Answer

Set up MFA, conditional access, and user-role assignments for tenant accounts.. Option A is correct because in a SaaS model, the customer retains responsibility for securing their tenant accounts, including configuring multi-factor authentication (MFA), conditional access policies, and role-based access control (RBAC) for users. These are identity and access management (IAM) controls that the provider cannot enforce on behalf of the customer, as they depend on the customer's specific user directory and security policies.

Answer

Patch the SaaS application's source code on the provider's servers.

Answer

Replace the provider's hypervisors with company-owned hardware.

Answer

Maintain the provider's network firewalls and datacenter cooling systems.