SY0-701 Practice Test 15 — 15 Questions

Question 1

A company portal lets employees save a short profile bio. One employee enters a string containing script code, and later other users who view that profile are redirected to a fake sign-in page. What vulnerability best explains this behavior?

Accepted Answer

Stored cross-site scripting, because the malicious script is saved and served to other users later.. The employee's profile bio is saved to the server and later served to other users who view the profile. This is the defining characteristic of stored (persistent) cross-site scripting (XSS): the malicious script is permanently stored on the target server and executed in the browsers of other users when they retrieve the stored data.

Answer

Reflected cross-site scripting, because the payload only appears in the current request response.

Answer

Command injection, because the script runs inside the web server process.

Answer

Session fixation, because the attacker wants the victim to use an old session ID.

Question 2

A company wants all corporate laptops to authenticate to Wi-Fi using device certificates instead of shared passwords. It also wants to deny network access to systems that do not meet the baseline requirement for disk encryption and current endpoint protection. Which approach best satisfies both goals?

Accepted Answer

Deploy 802.1X with certificate-based authentication and network access control posture checks.. 802.1X with certificate-based authentication ensures that only devices with valid certificates can authenticate to the Wi-Fi network, eliminating reliance on shared passwords. Network access control (NAC) posture checks then evaluate each device against baseline requirements (e.g., disk encryption, current endpoint protection) and deny access to non-compliant systems. This combination directly satisfies both goals of certificate-only authentication and conditional access based on security posture.

Answer

Use a single WPA2-Personal passphrase and email it to all employees.

Answer

Allow any device to join and rely on antivirus scans after users log in.

Answer

Use MAC address filtering and a captive portal for all internal Wi-Fi users.

Question 3

A business unit is worried about the financial impact of a rare but severe data center outage. After reviewing the risk register, leadership decides to purchase cyber insurance and document the remaining exposure rather than redesign the entire platform. Which risk treatment is this?

Accepted Answer

Risk transfer. The correct answer is A (Risk transfer) because purchasing cyber insurance transfers the financial risk of a data center outage to an insurance provider. The business unit is not avoiding the risk by redesigning the platform, nor are they mitigating it through technical controls; they are simply documenting the residual exposure after transferring the monetary impact. This aligns with the risk treatment strategy of shifting the burden of loss to a third party.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk acceptance

Question 4

A contractor is assigned to a single merger project. The manager approves access to only the project share and the project chat space, even though the contractor technically could use other collaboration tools. Which principle is most directly reflected?

Accepted Answer

Need-to-know. The correct answer is A, need-to-know, because the manager restricts the contractor's access to only the project share and project chat space, even though the contractor could technically use other collaboration tools. Need-to-know is a principle that limits access to information or resources strictly required for an individual's job duties, regardless of their clearance or technical capability. In this scenario, the contractor is given access only to the specific resources necessary for the merger project, directly reflecting the need-to-know principle.

Answer

Least privilege

Answer

Integrity

Answer

Zero trust

Question 5

A branch office uses a NAS for nightly backups, but the NAS is joined to the same domain as the production servers. After ransomware encrypted both production data and backups, management wants the most effective change to reduce the chance of backup tampering without a major redesign. Which control should be implemented?

Accepted Answer

Keep one backup copy offline or immutable and outside the production domain.. Option C is correct because keeping one backup copy offline or immutable and outside the production domain ensures that even if ransomware compromises the domain, it cannot encrypt or tamper with that isolated copy. This breaks the chain of trust between the production environment and the backup storage, directly addressing the root cause of the incident.

Answer

Increase the retention period so deleted files can be recovered for longer.

Answer

Move backups to a larger NAS with more available storage capacity.

Answer

Run backups more frequently to the same NAS so newer files are captured sooner.

Question 6

A legacy application cannot be patched for two weeks, but the security team still wants to reduce risk in the meantime. What is the best temporary measure?

Accepted Answer

Add a compensating control such as restricting access to the system.. Option B is correct because implementing a compensating control, such as restricting network access via firewall rules or disabling unnecessary services, reduces the attack surface while the legacy application remains unpatched. This aligns with the principle of defense-in-depth, where temporary mitigations like access control lists (ACLs) or host-based firewalls can block exploit vectors until the patch is applied.

Answer

Do nothing until the patch window opens.

Answer

Disable all logging so the system runs faster.

Answer

Rename the application so attackers cannot find it.

Question 7

A data analyst needs a copy of a customer file for product testing. The file includes names, email addresses, purchase history, and government ID numbers, but the test team only needs the names and purchase history. What is the BEST handling action?

Accepted Answer

Remove or mask the government ID numbers before sharing the minimum necessary fields.. Option B is correct because it applies the principle of least privilege and data minimization. The test team only needs names and purchase history, so removing or masking the government ID numbers before sharing the minimum necessary fields protects sensitive personally identifiable information (PII) and complies with data protection regulations like GDPR or CCPA. This action reduces the risk of unauthorized exposure of high-risk data while still enabling the test team to perform their work.

Answer

Provide the full file because the test team is internal and already trusted.

Answer

Encrypt the file and send it by email to the entire test group.

Answer

Keep the file unchanged and rely on the team not to open the sensitive columns.

Question 8

A branch office has users, finance workstations, and printers on the same LAN. Management wants finance devices isolated from general users while still allowing approved printing and internet access. Which two changes best meet this goal? Select two.

Accepted Answer

Put finance systems in a separate VLAN.. Placing finance systems in a separate VLAN (Option A) segments the LAN into isolated broadcast domains, preventing general users from directly accessing finance workstations at Layer 2. This is a foundational step for network segmentation, as VLANs logically separate traffic without requiring physical re-cabling.

Answer

Remove the default gateway from all finance devices.

Answer

Place all systems in one flat subnet.

Answer

Use hubs instead of switches to simplify traffic flow.

Question 9

A company is implementing network segmentation to isolate the guest wireless network from the internal corporate network. Which of the following technologies is most appropriate to enforce this separation at Layer 2?

Accepted Answer

VLANs. VLANs (Virtual Local Area Networks) are the correct technology because they operate at Layer 2 (Data Link layer) of the OSI model, allowing network administrators to logically segment a physical switch into multiple isolated broadcast domains. By assigning the guest wireless network to a separate VLAN (e.g., VLAN 100) and the internal corporate network to another (e.g., VLAN 10), traffic between them is blocked at Layer 2 unless explicitly routed through a Layer 3 device with appropriate firewall rules. This directly enforces separation without requiring additional hardware, making VLANs the most appropriate and efficient choice for isolating guest traffic at Layer 2.

Answer

ACLs

Answer

DMZ

Answer

VPN

Question 10

A developer finds a critical bug in a customer portal on Friday afternoon. The fix must be released quickly, but the team needs a way to reverse the change if testing reveals a problem and wants the release to follow the normal approval process. Which two practices should be used? Select two.

Accepted Answer

Create a documented rollback plan. Option B is correct because a documented rollback plan ensures that if the emergency fix introduces new issues during testing, the team can quickly and safely revert to the previous stable state. This aligns with the principle of change management, which requires a recovery procedure for any emergency change to minimize downtime and risk.

Answer

Deploy the fix directly to production without approval

Answer

Skip testing to meet the deadline

Answer

Rename the release package to reduce risk

Question 11

A company wants guest Wi-Fi to reach only the internet, employee laptops to reach internal apps, and payment servers to remain isolated from both. What is the best design approach?

Accepted Answer

Use separate network segments with firewall rules between guest, employee, and payment zones.. Option B is correct because network segmentation using separate VLANs or subnets with firewall rules enforces isolation between guest Wi-Fi, employee laptops, and payment servers. This design ensures that guest traffic can only reach the internet, employee traffic can access internal apps, and payment servers are completely isolated from both, meeting the principle of least privilege and reducing the attack surface.

Answer

Place all systems on one flat network and rely on antivirus.

Answer

Put all systems behind a single VPN so every device is treated the same.

Answer

Use a larger internet circuit so the payment servers are harder to attack.

Question 12

A development team runs multiple customer workloads in a shared Kubernetes cluster. Security wants to reduce the risk that one compromised container can read another team's data or deploy an altered image. Which three actions best improve the design? Select three.

Accepted Answer

Require signed, scanned images from an approved registry before deployment.. Requiring signed, scanned images from an approved registry ensures that only trusted, vulnerability-free images are deployed. Image signing (e.g., using Docker Content Trust or Notary) verifies the image's integrity and origin, preventing tampered images from being deployed. Scanning catches known vulnerabilities before runtime, reducing the attack surface. This directly addresses the risk of deploying an altered image.

Answer

Run each container as root so file permissions inside the container do not block apps.

Answer

Mount the host filesystem into every pod so support staff can troubleshoot more quickly.

Question 13

A company wants to state that customer data must not be emailed externally unless a manager approves the exception. Which document type should contain this rule?

Accepted Answer

Policy, because it establishes mandatory organizational rules. A policy is the correct document type because it establishes mandatory organizational rules that must be followed. The requirement that customer data must not be emailed externally without manager approval is a binding directive, not a suggestion or a step-by-step guide. Policies define high-level security requirements that all employees must comply with, making them the appropriate vehicle for this rule.

Answer

Guideline, because it gives staff flexible suggestions about email use

Answer

Procedure, because it lists the exact button clicks for sending email

Answer

Standard, because it provides a general recommendation for communication

Question 14

A company manages 300 laptops and wants to reduce risk from missed patches while avoiding a widespread outage if an update has compatibility issues. Which patching approach is the best choice?

Accepted Answer

Use a phased rollout with a pilot group, then expand deployment after validation, while keeping a standard baseline configuration.. Option C is correct because a phased rollout with a pilot group allows the IT team to validate patches on a small subset of laptops before full deployment, reducing the risk of widespread outages from compatibility issues. Maintaining a standard baseline configuration ensures consistency across all 300 laptops, which simplifies patch management and reduces the likelihood of missed patches. This approach balances risk mitigation with operational continuity, aligning with best practices for enterprise patch management.

Answer

Install patches manually on each laptop after users report problems.

Answer

Deploy all patches to every laptop immediately with no testing.

Answer

Wait for annual maintenance windows so all changes happen at once.

Question 15

A customer portal runs from a primary data center. Management wants the secondary site to take over within minutes if the primary site loses power, and the secondary site should already have current systems and data ready to serve users. Which design best fits this requirement?

Accepted Answer

A hot site with synchronized data replication and automated failover. A hot site with synchronized data replication and automated failover is the correct choice because it maintains an exact, real-time copy of systems and data at the secondary site. Synchronous replication ensures zero data loss (RPO=0), and automated failover enables the secondary site to become operational within minutes (RTO measured in minutes), meeting the requirement for immediate takeover after a power loss at the primary site.

Answer

A cold site with nightly backups stored offsite

Answer

RAID 0 across two storage arrays in the primary data center

Answer

A single backup server with larger disks and more memory