SY0-701 Practice Test 14 — 15 Questions

Question 1

An EDR alert shows powershell.exe launching with an encoded command, no new executable written to disk, and a registry run key added for persistence. Outbound HTTPS traffic then begins to a rare external domain. Which type of malware behavior is most likely?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fileless attack, because the malicious activity is using legitimate tools and memory rather than a dropped payload.. The EDR alert describes a classic fileless attack: PowerShell.exe executes an encoded command in memory, no new executable is written to disk, and persistence is achieved via a registry run key. The outbound HTTPS traffic to a rare domain indicates command-and-control (C2) communication. Fileless malware leverages legitimate system tools (like PowerShell) and runs entirely in memory, bypassing traditional file-based detection.

Answer

Worm behavior, because the malware is automatically spreading across the network.

Answer

Rootkit behavior, because the attacker is hiding from the operating system at a low level.

Answer

Spyware, because the malware is using HTTPS traffic to contact an external domain.

Question 2

An engineering firm backs up its file server every night to a NAS that is always mounted to the production domain. After a ransomware event, management asks for the most effective improvement to reduce the chance that backups are encrypted along with production data. What should be recommended?

Accepted Answer

Keep an offline or immutable backup copy that is not continuously reachable from production. An offline or immutable backup copy that is not continuously reachable from the production domain prevents ransomware from encrypting it. Since the NAS is always mounted to the production domain, it is vulnerable to lateral movement and encryption by ransomware. An offline backup (e.g., tape or disconnected disk) or an immutable backup (e.g., using S3 Object Lock or a write-once file system) ensures that even if production data is compromised, the backup remains intact and recoverable.

Answer

Increase the backup frequency but leave the NAS always online

Answer

Store backups in the same server room for faster restore times

Answer

Use only local snapshots on the file server because they are simpler to manage

Question 3

A security manager wants to require that all company laptops use at least a 14-character password and lock after 10 minutes of inactivity. Which document should define these mandatory settings?

Accepted Answer

Standard, because it defines specific required technical values the company must follow.. A standard is the document type that defines mandatory, specific technical requirements, such as a minimum 14-character password length and a 10-minute inactivity lock. Policies are high-level statements of intent, while standards provide the enforceable, measurable parameters that implement that intent. In this scenario, the security manager needs a binding baseline, which is precisely the role of a standard.

Answer

Policy, because it is the broad statement of security intent only.

Answer

Guideline, because it gives optional recommendations for device security.

Answer

Memo, because it is the normal formal document for security baselines.

Question 4

The web team is placing a public customer portal behind a control that can inspect HTTP requests, block malicious payloads such as SQL injection and cross-site scripting, and still allow legitimate application traffic without rewriting the app. Which control should they deploy?

Accepted Answer

A WAF in front of the application.. A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at the application layer (Layer 7), filtering out malicious payloads like SQL injection and cross-site scripting (XSS) while allowing legitimate requests to pass through. Unlike an IDS, a WAF operates inline and can actively block threats without requiring modifications to the application code, making it the ideal choice for protecting a public-facing web portal.

Answer

An IDS placed on the same network segment as the web server.

Answer

A DLP appliance between users and the portal.

Answer

A NAC solution on the switch ports feeding the portal.

Question 5

Based on the exhibit, what should the team do next to confirm the backups can actually be used during an outage?

Accepted Answer

Perform a test restore to a nonproduction location and verify the recovered files.. The only way to confirm that backups are usable during an outage is to perform a test restore to a nonproduction location and verify the recovered files. This validates the integrity of the backup data, the restore process, and that the files are complete and functional, which is a core principle of backup validation (often called a 'restore test' or 'disaster recovery drill'). Simply reviewing backup status reports or increasing retention does not prove that the data can be successfully restored.

Answer

Increase the retention period before making any restore attempts.

Answer

Delete older backup sets so the backup window is shorter.

Answer

Convert the backups to full backups only so the status report is simpler.

Question 6

A team manages virtual machines in a public cloud and wants an audit trail of who created instances, changed security groups, and modified IAM settings. What should be enabled first?

Accepted Answer

Cloud control plane or audit logging.. Cloud control plane or audit logging (e.g., AWS CloudTrail, Azure Monitor, or Google Cloud Audit Logs) captures all API calls that create instances, modify security groups, or change IAM settings. This provides the required audit trail of who performed each action, when, and from what source, which is essential for security incident response and compliance.

Answer

Host-based antivirus on each virtual machine.

Answer

A guest operating system screen saver policy.

Answer

A static public IP address for every virtual machine.

Question 7

After a ransomware event, the team restores a file server from backup, but management wants proof that the restore process will work before the backups are declared trusted. What should be done next?

Accepted Answer

Perform a test restore in an isolated environment and verify the recovered data. The only way to prove that backups are trustworthy is to perform a test restore in an isolated environment, verifying the integrity and completeness of the recovered data. This validates that the backup process, media, and software are functioning correctly without risking the production environment. Without a successful test restore, the team cannot confirm that the backups are free from corruption, encryption, or other issues that would prevent a real recovery.

Answer

Delete the old backup copies to prevent future confusion

Answer

Switch to incremental backups only so the next restore is faster

Answer

Store the backups on the same file server so they are easier to access

Question 8

A SOC analyst investigates a host after an employee opens an invoice attachment. The endpoint shows PowerShell running in a hidden window, no new executable files are created on disk, and the same suspicious activity returns after a reboot. What is the most likely attack type?

Accepted Answer

Fileless attack, because the malicious activity is operating primarily in memory and using native tools.. The attack is fileless: it runs PowerShell in a hidden window without writing new executables to disk, and persistence after reboot indicates the malicious code is stored in the registry or a script that loads into memory at startup. Fileless attacks leverage native tools like PowerShell, WMI, or .NET to execute payloads entirely in memory, bypassing traditional file-based detection.

Answer

Ransomware, because the user opened an email attachment.

Answer

Worm, because PowerShell is a common scripting tool.

Answer

Rootkit, because the attacker is hiding the process from normal tools.

Question 9

A security analyst notices that several employees have received an email with the subject line 'Urgent: Password Reset Required'. The email contains a link to a website that mimics the company's internal login portal. The email was sent from an external domain and addresses recipients by 'Dear Employee' rather than their actual names. Which type of social engineering attack is being described?

Accepted Answer

Phishing. The email is sent to multiple employees, uses a generic greeting ('Dear Employee'), and originates from an external domain, which are hallmarks of a broad, untargeted phishing campaign. Spear phishing would involve personalized details (e.g., the recipient's actual name) and targeting specific individuals. Vishing is voice-based, not email. Therefore, this is a standard phishing attack.

Answer

Spear phishing

Answer

Vishing

Answer

Tailgating

Question 10

A SIEM correlates VPN logs and sees the same public IP make one failed login attempt against 56 different user accounts over 25 minutes. The usernames vary, but the password value appears to be the same in each attempt. Ten minutes later, one of those accounts authenticates successfully from the same IP, and no password-reset events are recorded. Which attack pattern is most likely?

Accepted Answer

Password spraying against multiple accounts with a shared password guess.. The SIEM logs show the same public IP attempting to authenticate with 56 different usernames using the same password. This is the hallmark of a password spraying attack, where an attacker tries a single common password against many accounts to avoid account lockout policies. The subsequent successful authentication from the same IP, without a password reset, confirms the guessed password was valid for one account.

Answer

A brute-force attack focused on a single account with repeated rapid guesses.

Answer

A replay attack using captured authentication traffic from a previous session.

Answer

Credential stuffing using known breached username and password pairs.

Question 11

During malware containment, an analyst needs to preserve transient information from a compromised Windows workstation that is still running. Which action is MOST appropriate before shutdown or imaging?

Accepted Answer

Capture memory and live process information with approved response tools. Transient information such as running processes, network connections, and memory-resident malware is lost when the system is powered off. Capturing memory and live process data with approved forensic tools (e.g., FTK Imager, DumpIt, or WinPmem) preserves volatile evidence critical for incident analysis and attribution, in accordance with the order of volatility (RFC 3227).

Answer

Immediately unplug the workstation and carry it to the evidence room

Answer

Run a full antivirus scan to clean the machine before analysis

Answer

Clear the event logs so the malicious activity is easier to isolate

Question 12

An employee receives an email that appears to be from the CEO and asks for gift cards before a meeting. What should the employee do first?

Accepted Answer

Report the message through the approved security channel and verify the request by a separate method.. The first action in response to a suspected phishing or social engineering attack is to report it through the approved security channel, which ensures the incident is logged and can be investigated. Separately verifying the request—such as by calling the CEO or using a known, trusted contact method—confirms the legitimacy of the request without relying on the potentially compromised email thread. This aligns with security policy best practices for incident response and prevents unauthorized disclosure of funds or credentials.

Answer

Buy the gift cards immediately so the CEO is not delayed.

Answer

Forward the email to coworkers so they can watch for the same request.

Answer

Reply to the sender and ask for more details in the same email thread.

Question 13

After a workstation reboot, users see many files renamed with random extensions. A ransom note demands cryptocurrency, and Volume Shadow Copies were deleted from the machine. What malware type is most likely?

Accepted Answer

Ransomware, because the files were encrypted and payment was demanded.. The scenario describes files renamed with random extensions (indicating encryption), a ransom note demanding cryptocurrency, and deletion of Volume Shadow Copies (VSS) to prevent file recovery. These are hallmark behaviors of ransomware, specifically a crypto-ransomware variant that encrypts user data and removes backup copies to maximize extortion pressure.

Answer

Trojan, because the malware may have been disguised as a legitimate application.

Answer

Worm, because the malware likely spread automatically to other systems.

Answer

Rootkit, because the attacker would want to hide persistence on the system.

Question 14

Based on the exhibit, what is the best data-handling action before sharing the file with the third party?

Accepted Answer

Redact the unnecessary sensitive fields and provide only the minimum necessary extract after approval.. Data minimization and the principle of least privilege require that only the minimum necessary sensitive data be shared with a third party. Redacting unnecessary sensitive fields and obtaining approval ensures compliance with data protection policies and reduces the risk of unauthorized exposure, even if the recipient has signed an NDA.

Answer

Send the full spreadsheet encrypted and let the vendor filter out the extra columns.

Answer

Mark the spreadsheet as internal and share it through the benefits contractor's cloud portal.

Answer

Send the file unchanged because the contractor signed a nondisclosure agreement.

Question 15

Security receives a company laptop used in an insider theft investigation. A manager wants the device moved to another office for review by legal staff. Which action best supports chain of custody?

Accepted Answer

Place it in a labeled evidence bag, record the collector, time, location, and condition, and require signatures for each transfer.. It follows the formal chain of custody process required for evidence handling. Placing the laptop in a labeled evidence bag with documented collector, time, location, and condition, along with requiring signatures for each transfer, ensures the integrity and admissibility of evidence by creating an unbroken audit trail. This aligns with NIST SP 800-86 and forensic best practices for maintaining custody of digital evidence.

Answer

Power on the laptop to confirm the user profile and recent activity before transport.

Answer

Remove the drive and clone it without documenting the collection process.

Answer

Email a photo of the laptop to legal and leave the original on a desk.