SY0-701 Practice Test 15 — 15 Questions

Question 1

Based on the exhibit, what is the best eradication decision for the server compromise?

Accepted Answer

Rebuild the server from a trusted image and restore only known-good data after evidence is preserved.. A server compromise implies that the attacker may have achieved persistence through modified binaries, kernel modules, or rootkits that cannot be reliably removed by simple remediation steps. Rebuilding from a trusted image ensures that all malicious artifacts are eliminated, and restoring only known-good data from backups (after forensic preservation) prevents reintroduction of compromised files. This aligns with the CompTIA incident response process, where eradication must remove all traces of the threat, and rebuilding is the safest approach for a confirmed compromise.

Answer

Restart sshd and monitor the system for another login attempt.

Answer

Manually delete the cron entry and reverse the SSH change on the live server.

Answer

Increase the SIEM retention period and keep the current server online.

Question 2

An employee receives a text message that says, "Your MFA enrollment expired. Tap here now to re-activate access or your account will be locked." What should the employee do first?

Accepted Answer

Verify the request using a known company contact method and report the text. The message is a classic phishing attempt designed to harvest MFA credentials or session tokens. The employee must first verify the request through a trusted company channel (e.g., calling the IT help desk or checking the official security portal) and then report the text to the security team. This prevents falling for social engineering that could bypass MFA protections.

Answer

Tap the link and complete the MFA reset immediately

Answer

Forward the text to coworkers so they can watch for it too

Answer

Reply to the sender and ask for more details

Question 3

A restricted server room opens only with a badge, and an alarm sounds if the door is left open too long. Which control type is the alarm?

Accepted Answer

Detective control. The alarm is a detective control because it detects and alerts when a door is left open too long, indicating a potential security breach. It does not prevent the door from being opened or correct the situation; it simply notifies personnel of an ongoing or past violation.

Answer

Preventive control

Answer

Corrective control

Answer

Deterrent control

Question 4

A billing application has an RTO of 2 hours and an RPO of 30 minutes. The current recovery method requires rebuilding the VM from scratch and then restoring last night's backup, which takes over six hours. Which solution best meets the stated recovery objectives?

Accepted Answer

Use a warm standby replica with frequent log shipping or near-continuous replication.. A warm standby replica with frequent log shipping or near-continuous replication can achieve an RPO of 30 minutes or less by minimizing data loss, and an RTO of 2 hours by allowing rapid failover to the replica. This directly addresses the current recovery method's failure to meet the RTO (6+ hours vs. 2 hours) and RPO (last night's backup vs. 30 minutes). Technologies like SQL Server log shipping or VMware vSphere replication provide near-continuous data synchronization, enabling recovery within the stated objectives.

Answer

Keep the current backup schedule and shorten the documentation for the restore procedure.

Answer

Switch to weekly full backups and manually verify them after business hours.

Answer

Store backups on the same production host so restores are faster.

Question 5

Company-owned tablets run both business apps and approved personal apps. Which two controls best keep company data separated and support selective wipe? Select two.

Accepted Answer

Mobile device management with a work profile or container for corporate data.. Mobile Device Management (MDM) with a work profile or container creates a separate, encrypted partition on the device for corporate data. This container enforces policies (e.g., app whitelisting, VPN) and isolates business apps from personal apps, ensuring that company data remains protected even if the personal side is compromised.

Answer

Allow users to install any app if they promise not to open work files.

Answer

Store corporate files in the personal photo gallery for easier backup.

Answer

Disable screen locks so users can access business apps faster.

Question 6

After a ransomware incident, management learns the attacker's stolen domain admin credentials were used to delete recent online backups from the same backup network. Which backup strategy would have most reduced the chance of permanent backup loss?

Accepted Answer

Immutable backups stored in a separate repository or offline location.. Immutable backups stored in a separate repository or offline location prevent deletion or modification by an attacker, even with domain admin credentials. This is because immutability enforces a write-once-read-many (WORM) policy, often implemented via object lock (e.g., S3 Object Lock) or a physical air gap, ensuring that backups cannot be altered or deleted before their retention period expires. In this scenario, the attacker's ability to delete online backups from the same network is mitigated because the immutable repository is isolated and resistant to credential-based tampering.

Answer

Nightly incremental backups stored on the same file server as production data.

Answer

Hypervisor snapshots only, because they are always safer than backups.

Answer

Longer retention on the same backup share to keep more versions available.

Question 7

A scan finds two issues: a critical vulnerability on an internet-facing VPN appliance with public exploit code, and a medium-severity issue on an internal test server. Which should be fixed first?

Accepted Answer

The VPN appliance issue, because it is critical and publicly exploitable.. The VPN appliance issue should be fixed first because it is a critical vulnerability on an internet-facing system with publicly available exploit code. This combination means an attacker can directly compromise the appliance from the internet with minimal effort, leading to potential network breach and lateral movement. In contrast, the internal test server is less accessible and poses a lower immediate risk, even though it should still be addressed in due course.

Answer

The internal test server issue, because test systems are always higher risk.

Answer

Both issues at the same time without assigning a priority.

Answer

Neither issue, because scanners can produce false positives.

Question 8

Based on the exhibit, what should the records manager do next?

Accepted Answer

Suspend deletion and preserve all related records until the legal hold is formally lifted.. When a legal hold is in effect, it overrides any standard retention or deletion policies. The records manager must suspend all deletion activities and preserve all related records until the legal hold is formally lifted, as failure to do so could result in spoliation of evidence and legal penalties.

Answer

Delete the records on schedule because the retention period is still the primary rule.

Answer

Move the records to long-term archive and continue the normal deletion schedule.

Answer

Print the records, delete the digital copies, and keep the paper copies instead.

Question 9

Based on the exhibit, which authentication method best meets the stated remote-admin requirement?

Accepted Answer

FIDO2 hardware security key, because it resists phishing and does not depend on SMS or email delivery.. The remote-admin requirement emphasizes phishing resistance and independence from SMS or email delivery, which are vulnerable to interception or social engineering. FIDO2 hardware security keys use public-key cryptography and origin-bound credentials, making them phishing-resistant and eliminating reliance on potentially compromised communication channels. This aligns with the stated requirement better than the other options.

Answer

SMS one-time code, because it is widely supported and easy for users to adopt.

Answer

Email one-time link, because it can be delivered to any mailbox quickly.

Answer

Authenticator app TOTP code, because it adds a second factor without special hardware.

Question 10

A SIEM rule flags a Linux server because it makes outbound HTTPS connections to the same cloud IP every 15 minutes. The server runs an approved patch agent that should check in on a regular schedule. Which two checks best validate whether the alert is a false positive? Select two.

Accepted Answer

Compare the process name, parent process, and digital signature to the approved agent baseline.. Comparing the process name, parent process, and digital signature against the approved agent baseline directly validates that the traffic originates from the legitimate patch agent and not from malware masquerading as the agent. This is a standard host-based validation technique to confirm the source process integrity before investigating network alerts.

Answer

Assume the traffic is benign because it happens on a fixed schedule.

Answer

Suppress all alerts from the host permanently after this one event.

Answer

Stop collecting logs from the server so the same alert does not recur.

Question 11

A web application needs to be internet-facing. The web tier must accept public traffic, the application tier should be reachable only from the web tier, and the database must be reachable only from the application tier. Which design best supports this?

Accepted Answer

Use a three-tier layout with a DMZ, an application zone, and a database zone separated by firewalls.. It implements a classic three-tier architecture with separate security zones (DMZ, application zone, database zone) each protected by firewalls. This ensures that only the web tier in the DMZ accepts public traffic, the application tier is isolated and reachable only from the web tier via firewall rules, and the database tier is further isolated and reachable only from the application tier. This layered defense aligns with the principle of defense in depth and minimizes the attack surface by enforcing strict east-west traffic segmentation.

Answer

Put all three tiers on one private subnet and rely on host firewalls.

Answer

Place the database in the DMZ so the web tier has lower latency.

Answer

Use NAT for the database server and allow inbound access from the internet.

Question 12

A SOC analyst reviews an alert on a workstation where PowerShell launched from a scheduled task, downloaded an encoded command from a remote server, and then spawned rundll32.exe. Traditional antivirus did not flag any files on disk, and the activity stops after rebooting the host. Which type of malware behavior best fits this event?

Accepted Answer

Fileless attack using trusted system tools to run malicious code in memory. The attack uses PowerShell to download and execute an encoded command directly in memory, then spawns rundll32.exe—both are trusted Microsoft binaries. No files are written to disk, and the activity ceases after reboot, which are hallmarks of a fileless malware attack that operates entirely in volatile memory.

Answer

Worm behavior that is spreading through SMB shares

Answer

Rootkit that is hiding itself by modifying kernel drivers

Answer

Trojan that can only run after a user manually opens a malicious attachment

Question 13

An EDR alert shows a user workstation launching an unfamiliar executable from the Downloads folder and then making repeated outbound connections to an IP address in another country. What is the best first response by the security team?

Accepted Answer

Isolate the workstation from the network and begin incident triage. Isolating the workstation from the network immediately stops the potential command-and-control (C2) communication and prevents lateral movement, which is the priority first response in incident triage. The EDR alert indicates a suspicious executable from the Downloads folder making repeated outbound connections to a foreign IP, which strongly suggests malware or a trojan. Isolating the host preserves volatile evidence (e.g., memory, network connections) for forensic analysis while containing the threat.

Answer

Wait for more alerts before taking any action to avoid disrupting the user

Answer

Immediately reinstall the operating system without collecting evidence

Answer

Disable the user's account in the directory service and close the ticket

Question 14

A company wants visibility into who changed settings in its cloud account and what commands ran on a cloud VM. Which two log sources should the team enable first? Select two.

Accepted Answer

Cloud provider audit or API logs. Cloud provider audit or API logs (Option A) capture all changes made to the cloud account via the provider's management plane, including who modified settings and when. Guest operating system event logs (Option B) record commands executed within the VM itself, such as PowerShell or bash commands, providing visibility into runtime activities. Together, these two sources cover both the control plane (account-level changes) and data plane (VM-level commands) for comprehensive monitoring.

Answer

Printer spooler logs

Answer

Browser history from employees' home PCs

Answer

DHCP lease logs from the office router

Question 15

A firewall rule change was implemented directly in production to allow a new vendor IP range. Within minutes, several internal services became unreachable because the rule order changed unexpectedly. Which change-management practice would have most likely prevented this outage?

Accepted Answer

Testing the change in a staging environment and approving it through a peer-reviewed change process before production.. Implementing the change in a staging environment first allows validation of the rule order and its impact on traffic flow without affecting production. A peer-reviewed change process ensures that the rule insertion point (e.g., before a deny-all or after a permit statement) is verified, preventing the accidental reordering that caused the outage. This aligns with the change-management principle of testing in a representative environment before production deployment.

Answer

Applying the rule during business hours so the team can respond faster if something breaks.

Answer

Making the change first in production because that is the only environment that matters.

Answer

Documenting the outage after the vendor confirms their IP range is valid.