SY0-701 Practice Test 15 — 15 Questions

Question 1

A security manager wants to require that all company laptops use at least a 14-character password and lock after 10 minutes of inactivity. Which document should define these mandatory settings?

Accepted Answer

Standard, because it defines specific required technical values the company must follow.. A standard is the document type that defines mandatory, specific technical requirements, such as a minimum 14-character password length and a 10-minute inactivity lock. Policies are high-level statements of intent, while standards provide the enforceable, measurable parameters that implement that intent. In this scenario, the security manager needs a binding baseline, which is precisely the role of a standard.

Answer

Policy, because it is the broad statement of security intent only.

Answer

Guideline, because it gives optional recommendations for device security.

Answer

Memo, because it is the normal formal document for security baselines.

Question 2

The web team is placing a public customer portal behind a control that can inspect HTTP requests, block malicious payloads such as SQL injection and cross-site scripting, and still allow legitimate application traffic without rewriting the app. Which control should they deploy?

Accepted Answer

A WAF in front of the application.. A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at the application layer (Layer 7), filtering out malicious payloads like SQL injection and cross-site scripting (XSS) while allowing legitimate requests to pass through. Unlike an IDS, a WAF operates inline and can actively block threats without requiring modifications to the application code, making it the ideal choice for protecting a public-facing web portal.

Answer

An IDS placed on the same network segment as the web server.

Answer

A DLP appliance between users and the portal.

Answer

A NAC solution on the switch ports feeding the portal.

Question 3

Based on the exhibit, what should the team do next to confirm the backups can actually be used during an outage?

Accepted Answer

Perform a test restore to a nonproduction location and verify the recovered files.. The only way to confirm that backups are usable during an outage is to perform a test restore to a nonproduction location and verify the recovered files. This validates the integrity of the backup data, the restore process, and that the files are complete and functional, which is a core principle of backup validation (often called a 'restore test' or 'disaster recovery drill'). Simply reviewing backup status reports or increasing retention does not prove that the data can be successfully restored.

Answer

Increase the retention period before making any restore attempts.

Answer

Delete older backup sets so the backup window is shorter.

Answer

Convert the backups to full backups only so the status report is simpler.

Question 4

A team manages virtual machines in a public cloud and wants an audit trail of who created instances, changed security groups, and modified IAM settings. What should be enabled first?

Accepted Answer

Cloud control plane or audit logging.. Cloud control plane or audit logging (e.g., AWS CloudTrail, Azure Monitor, or Google Cloud Audit Logs) captures all API calls that create instances, modify security groups, or change IAM settings. This provides the required audit trail of who performed each action, when, and from what source, which is essential for security incident response and compliance.

Answer

Host-based antivirus on each virtual machine.

Answer

A guest operating system screen saver policy.

Answer

A static public IP address for every virtual machine.

Question 5

After a ransomware event, the team restores a file server from backup, but management wants proof that the restore process will work before the backups are declared trusted. What should be done next?

Accepted Answer

Perform a test restore in an isolated environment and verify the recovered data. The only way to prove that backups are trustworthy is to perform a test restore in an isolated environment, verifying the integrity and completeness of the recovered data. This validates that the backup process, media, and software are functioning correctly without risking the production environment. Without a successful test restore, the team cannot confirm that the backups are free from corruption, encryption, or other issues that would prevent a real recovery.

Answer

Delete the old backup copies to prevent future confusion

Answer

Switch to incremental backups only so the next restore is faster

Answer

Store the backups on the same file server so they are easier to access

Question 6

A SOC analyst investigates a host after an employee opens an invoice attachment. The endpoint shows PowerShell running in a hidden window, no new executable files are created on disk, and the same suspicious activity returns after a reboot. What is the most likely attack type?

Accepted Answer

Fileless attack, because the malicious activity is operating primarily in memory and using native tools.. The attack is fileless: it runs PowerShell in a hidden window without writing new executables to disk, and persistence after reboot indicates the malicious code is stored in the registry or a script that loads into memory at startup. Fileless attacks leverage native tools like PowerShell, WMI, or .NET to execute payloads entirely in memory, bypassing traditional file-based detection.

Answer

Ransomware, because the user opened an email attachment.

Answer

Worm, because PowerShell is a common scripting tool.

Answer

Rootkit, because the attacker is hiding the process from normal tools.

Question 7

A security analyst notices that several employees have received an email with the subject line 'Urgent: Password Reset Required'. The email contains a link to a website that mimics the company's internal login portal. The email was sent from an external domain and addresses recipients by 'Dear Employee' rather than their actual names. Which type of social engineering attack is being described?

Accepted Answer

Phishing. The email is sent to multiple employees, uses a generic greeting ('Dear Employee'), and originates from an external domain, which are hallmarks of a broad, untargeted phishing campaign. Spear phishing would involve personalized details (e.g., the recipient's actual name) and targeting specific individuals. Vishing is voice-based, not email. Therefore, this is a standard phishing attack.

Answer

Spear phishing

Answer

Vishing

Answer

Tailgating

Question 8

A SIEM correlates VPN logs and sees the same public IP make one failed login attempt against 56 different user accounts over 25 minutes. The usernames vary, but the password value appears to be the same in each attempt. Ten minutes later, one of those accounts authenticates successfully from the same IP, and no password-reset events are recorded. Which attack pattern is most likely?

Accepted Answer

Password spraying against multiple accounts with a shared password guess.. The SIEM logs show the same public IP attempting to authenticate with 56 different usernames using the same password. This is the hallmark of a password spraying attack, where an attacker tries a single common password against many accounts to avoid account lockout policies. The subsequent successful authentication from the same IP, without a password reset, confirms the guessed password was valid for one account.

Answer

A brute-force attack focused on a single account with repeated rapid guesses.

Answer

A replay attack using captured authentication traffic from a previous session.

Answer

Credential stuffing using known breached username and password pairs.

Question 9

An employee receives an email that appears to be from the CEO and asks for gift cards before a meeting. What should the employee do first?

Accepted Answer

Report the message through the approved security channel and verify the request by a separate method.. The first action in response to a suspected phishing or social engineering attack is to report it through the approved security channel, which ensures the incident is logged and can be investigated. Separately verifying the request—such as by calling the CEO or using a known, trusted contact method—confirms the legitimacy of the request without relying on the potentially compromised email thread. This aligns with security policy best practices for incident response and prevents unauthorized disclosure of funds or credentials.

Answer

Buy the gift cards immediately so the CEO is not delayed.

Answer

Forward the email to coworkers so they can watch for the same request.

Answer

Reply to the sender and ask for more details in the same email thread.

Question 10

After a workstation reboot, users see many files renamed with random extensions. A ransom note demands cryptocurrency, and Volume Shadow Copies were deleted from the machine. What malware type is most likely?

Accepted Answer

Ransomware, because the files were encrypted and payment was demanded.. The scenario describes files renamed with random extensions (indicating encryption), a ransom note demanding cryptocurrency, and deletion of Volume Shadow Copies (VSS) to prevent file recovery. These are hallmark behaviors of ransomware, specifically a crypto-ransomware variant that encrypts user data and removes backup copies to maximize extortion pressure.

Answer

Trojan, because the malware may have been disguised as a legitimate application.

Answer

Worm, because the malware likely spread automatically to other systems.

Answer

Rootkit, because the attacker would want to hide persistence on the system.

Question 11

Based on the exhibit, what is the best data-handling action before sharing the file with the third party?

Accepted Answer

Redact the unnecessary sensitive fields and provide only the minimum necessary extract after approval.. Data minimization and the principle of least privilege require that only the minimum necessary sensitive data be shared with a third party. Redacting unnecessary sensitive fields and obtaining approval ensures compliance with data protection policies and reduces the risk of unauthorized exposure, even if the recipient has signed an NDA.

Answer

Send the full spreadsheet encrypted and let the vendor filter out the extra columns.

Answer

Mark the spreadsheet as internal and share it through the benefits contractor's cloud portal.

Answer

Send the file unchanged because the contractor signed a nondisclosure agreement.

Question 12

Security receives a company laptop used in an insider theft investigation. A manager wants the device moved to another office for review by legal staff. Which action best supports chain of custody?

Accepted Answer

Place it in a labeled evidence bag, record the collector, time, location, and condition, and require signatures for each transfer.. It follows the formal chain of custody process required for evidence handling. Placing the laptop in a labeled evidence bag with documented collector, time, location, and condition, along with requiring signatures for each transfer, ensures the integrity and admissibility of evidence by creating an unbroken audit trail. This aligns with NIST SP 800-86 and forensic best practices for maintaining custody of digital evidence.

Answer

Power on the laptop to confirm the user profile and recent activity before transport.

Answer

Remove the drive and clone it without documenting the collection process.

Answer

Email a photo of the laptop to legal and leave the original on a desk.

Question 13

Based on the exhibit, what is the best eradication decision for the server compromise?

Accepted Answer

Rebuild the server from a trusted image and restore only known-good data after evidence is preserved.. A server compromise implies that the attacker may have achieved persistence through modified binaries, kernel modules, or rootkits that cannot be reliably removed by simple remediation steps. Rebuilding from a trusted image ensures that all malicious artifacts are eliminated, and restoring only known-good data from backups (after forensic preservation) prevents reintroduction of compromised files. This aligns with the CompTIA incident response process, where eradication must remove all traces of the threat, and rebuilding is the safest approach for a confirmed compromise.

Answer

Restart sshd and monitor the system for another login attempt.

Answer

Manually delete the cron entry and reverse the SSH change on the live server.

Answer

Increase the SIEM retention period and keep the current server online.

Question 14

An employee receives a text message that says, "Your MFA enrollment expired. Tap here now to re-activate access or your account will be locked." What should the employee do first?

Accepted Answer

Verify the request using a known company contact method and report the text. The message is a classic phishing attempt designed to harvest MFA credentials or session tokens. The employee must first verify the request through a trusted company channel (e.g., calling the IT help desk or checking the official security portal) and then report the text to the security team. This prevents falling for social engineering that could bypass MFA protections.

Answer

Tap the link and complete the MFA reset immediately

Answer

Forward the text to coworkers so they can watch for it too

Answer

Reply to the sender and ask for more details

Question 15

A restricted server room opens only with a badge, and an alarm sounds if the door is left open too long. Which control type is the alarm?

Accepted Answer

Detective control. The alarm is a detective control because it detects and alerts when a door is left open too long, indicating a potential security breach. It does not prevent the door from being opened or correct the situation; it simply notifies personnel of an ongoing or past violation.

Answer

Preventive control

Answer

Corrective control

Answer

Deterrent control