SY0-701 Practice Test 16 — 15 Questions

Question 1

A billing application has an RTO of 2 hours and an RPO of 30 minutes. The current recovery method requires rebuilding the VM from scratch and then restoring last night's backup, which takes over six hours. Which solution best meets the stated recovery objectives?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a warm standby replica with frequent log shipping or near-continuous replication.. A warm standby replica with frequent log shipping or near-continuous replication can achieve an RPO of 30 minutes or less by minimizing data loss, and an RTO of 2 hours by allowing rapid failover to the replica. This directly addresses the current recovery method's failure to meet the RTO (6+ hours vs. 2 hours) and RPO (last night's backup vs. 30 minutes). Technologies like SQL Server log shipping or VMware vSphere replication provide near-continuous data synchronization, enabling recovery within the stated objectives.

Answer

Keep the current backup schedule and shorten the documentation for the restore procedure.

Answer

Switch to weekly full backups and manually verify them after business hours.

Answer

Store backups on the same production host so restores are faster.

Question 2

Company-owned tablets run both business apps and approved personal apps. Which two controls best keep company data separated and support selective wipe? Select two.

Accepted Answer

Mobile device management with a work profile or container for corporate data.. Mobile Device Management (MDM) with a work profile or container creates a separate, encrypted partition on the device for corporate data. This container enforces policies (e.g., app whitelisting, VPN) and isolates business apps from personal apps, ensuring that company data remains protected even if the personal side is compromised.

Answer

Allow users to install any app if they promise not to open work files.

Answer

Store corporate files in the personal photo gallery for easier backup.

Answer

Disable screen locks so users can access business apps faster.

Question 3

After a ransomware incident, management learns the attacker's stolen domain admin credentials were used to delete recent online backups from the same backup network. Which backup strategy would have most reduced the chance of permanent backup loss?

Accepted Answer

Immutable backups stored in a separate repository or offline location.. Immutable backups stored in a separate repository or offline location prevent deletion or modification by an attacker, even with domain admin credentials. This is because immutability enforces a write-once-read-many (WORM) policy, often implemented via object lock (e.g., S3 Object Lock) or a physical air gap, ensuring that backups cannot be altered or deleted before their retention period expires. In this scenario, the attacker's ability to delete online backups from the same network is mitigated because the immutable repository is isolated and resistant to credential-based tampering.

Answer

Nightly incremental backups stored on the same file server as production data.

Answer

Hypervisor snapshots only, because they are always safer than backups.

Answer

Longer retention on the same backup share to keep more versions available.

Question 4

A scan finds two issues: a critical vulnerability on an internet-facing VPN appliance with public exploit code, and a medium-severity issue on an internal test server. Which should be fixed first?

Accepted Answer

The VPN appliance issue, because it is critical and publicly exploitable.. The VPN appliance issue should be fixed first because it is a critical vulnerability on an internet-facing system with publicly available exploit code. This combination means an attacker can directly compromise the appliance from the internet with minimal effort, leading to potential network breach and lateral movement. In contrast, the internal test server is less accessible and poses a lower immediate risk, even though it should still be addressed in due course.

Answer

The internal test server issue, because test systems are always higher risk.

Answer

Both issues at the same time without assigning a priority.

Answer

Neither issue, because scanners can produce false positives.

Question 5

Based on the exhibit, what should the records manager do next?

Accepted Answer

Suspend deletion and preserve all related records until the legal hold is formally lifted.. When a legal hold is in effect, it overrides any standard retention or deletion policies. The records manager must suspend all deletion activities and preserve all related records until the legal hold is formally lifted, as failure to do so could result in spoliation of evidence and legal penalties.

Answer

Delete the records on schedule because the retention period is still the primary rule.

Answer

Move the records to long-term archive and continue the normal deletion schedule.

Answer

Print the records, delete the digital copies, and keep the paper copies instead.

Question 6

Based on the exhibit, which authentication method best meets the stated remote-admin requirement?

Accepted Answer

FIDO2 hardware security key, because it resists phishing and does not depend on SMS or email delivery.. The remote-admin requirement emphasizes phishing resistance and independence from SMS or email delivery, which are vulnerable to interception or social engineering. FIDO2 hardware security keys use public-key cryptography and origin-bound credentials, making them phishing-resistant and eliminating reliance on potentially compromised communication channels. This aligns with the stated requirement better than the other options.

Answer

SMS one-time code, because it is widely supported and easy for users to adopt.

Answer

Email one-time link, because it can be delivered to any mailbox quickly.

Answer

Authenticator app TOTP code, because it adds a second factor without special hardware.

Question 7

A SIEM rule flags a Linux server because it makes outbound HTTPS connections to the same cloud IP every 15 minutes. The server runs an approved patch agent that should check in on a regular schedule. Which two checks best validate whether the alert is a false positive? Select two.

Accepted Answer

Compare the process name, parent process, and digital signature to the approved agent baseline.. Comparing the process name, parent process, and digital signature against the approved agent baseline directly validates that the traffic originates from the legitimate patch agent and not from malware masquerading as the agent. This is a standard host-based validation technique to confirm the source process integrity before investigating network alerts.

Answer

Assume the traffic is benign because it happens on a fixed schedule.

Answer

Suppress all alerts from the host permanently after this one event.

Answer

Stop collecting logs from the server so the same alert does not recur.

Question 8

A web application needs to be internet-facing. The web tier must accept public traffic, the application tier should be reachable only from the web tier, and the database must be reachable only from the application tier. Which design best supports this?

Accepted Answer

Use a three-tier layout with a DMZ, an application zone, and a database zone separated by firewalls.. It implements a classic three-tier architecture with separate security zones (DMZ, application zone, database zone) each protected by firewalls. This ensures that only the web tier in the DMZ accepts public traffic, the application tier is isolated and reachable only from the web tier via firewall rules, and the database tier is further isolated and reachable only from the application tier. This layered defense aligns with the principle of defense in depth and minimizes the attack surface by enforcing strict east-west traffic segmentation.

Answer

Put all three tiers on one private subnet and rely on host firewalls.

Answer

Place the database in the DMZ so the web tier has lower latency.

Answer

Use NAT for the database server and allow inbound access from the internet.

Question 9

A SOC analyst reviews an alert on a workstation where PowerShell launched from a scheduled task, downloaded an encoded command from a remote server, and then spawned rundll32.exe. Traditional antivirus did not flag any files on disk, and the activity stops after rebooting the host. Which type of malware behavior best fits this event?

Accepted Answer

Fileless attack using trusted system tools to run malicious code in memory. The attack uses PowerShell to download and execute an encoded command directly in memory, then spawns rundll32.exe—both are trusted Microsoft binaries. No files are written to disk, and the activity ceases after reboot, which are hallmarks of a fileless malware attack that operates entirely in volatile memory.

Answer

Worm behavior that is spreading through SMB shares

Answer

Rootkit that is hiding itself by modifying kernel drivers

Answer

Trojan that can only run after a user manually opens a malicious attachment

Question 10

An EDR alert shows a user workstation launching an unfamiliar executable from the Downloads folder and then making repeated outbound connections to an IP address in another country. What is the best first response by the security team?

Accepted Answer

Isolate the workstation from the network and begin incident triage. Isolating the workstation from the network immediately stops the potential command-and-control (C2) communication and prevents lateral movement, which is the priority first response in incident triage. The EDR alert indicates a suspicious executable from the Downloads folder making repeated outbound connections to a foreign IP, which strongly suggests malware or a trojan. Isolating the host preserves volatile evidence (e.g., memory, network connections) for forensic analysis while containing the threat.

Answer

Wait for more alerts before taking any action to avoid disrupting the user

Answer

Immediately reinstall the operating system without collecting evidence

Answer

Disable the user's account in the directory service and close the ticket

Question 11

A company wants visibility into who changed settings in its cloud account and what commands ran on a cloud VM. Which two log sources should the team enable first? Select two.

Accepted Answer

Cloud provider audit or API logs. Cloud provider audit or API logs (Option A) capture all changes made to the cloud account via the provider's management plane, including who modified settings and when. Guest operating system event logs (Option B) record commands executed within the VM itself, such as PowerShell or bash commands, providing visibility into runtime activities. Together, these two sources cover both the control plane (account-level changes) and data plane (VM-level commands) for comprehensive monitoring.

Answer

Printer spooler logs

Answer

Browser history from employees' home PCs

Answer

DHCP lease logs from the office router

Question 12

A firewall rule change was implemented directly in production to allow a new vendor IP range. Within minutes, several internal services became unreachable because the rule order changed unexpectedly. Which change-management practice would have most likely prevented this outage?

Accepted Answer

Testing the change in a staging environment and approving it through a peer-reviewed change process before production.. Implementing the change in a staging environment first allows validation of the rule order and its impact on traffic flow without affecting production. A peer-reviewed change process ensures that the rule insertion point (e.g., before a deny-all or after a permit statement) is verified, preventing the accidental reordering that caused the outage. This aligns with the change-management principle of testing in a representative environment before production deployment.

Answer

Applying the rule during business hours so the team can respond faster if something breaks.

Answer

Making the change first in production because that is the only environment that matters.

Answer

Documenting the outage after the vendor confirms their IP range is valid.

Question 13

A security team downloads a software update package signed by the vendor. The team verifies the signature using the vendor's public key before approving deployment. What does this verification primarily confirm?

Accepted Answer

The package was likely created by the vendor and was not altered after signing. Digital signature verification using the vendor's public key confirms that the package was signed with the vendor's private key, which only the vendor possesses. This provides authentication of the signer's identity and integrity of the data, ensuring the package has not been modified since signing. It does not provide confidentiality, as the package itself is not encrypted.

Answer

The package can only be decrypted by the vendor's private key

Answer

The package is encrypted with the vendor's public key

Answer

The vendor's certificate has not expired

Question 14

During morning SIEM review, an analyst sees 37 failed SSH logins followed by a successful login to a Linux server from a jump host. The account belongs to a configuration-management service account, and the activity occurred inside the normal maintenance window. What should the analyst do next to determine whether the alert is a true positive or a false positive?

Accepted Answer

Correlate the event with the approved maintenance ticket and automation job logs.. The analyst should correlate the failed SSH logins with the approved maintenance ticket and automation job logs to verify if the activity is expected. The failed logins followed by a successful login from a jump host during a maintenance window are consistent with a configuration-management tool (e.g., Ansible, Puppet) retrying authentication. This correlation confirms whether the alert is a true positive (unauthorized access) or a false positive (routine automation).

Answer

Immediately isolate the Linux server from the network and begin recovery.

Answer

Reset the service account password before reviewing any additional evidence.

Answer

Disable SSH on the server until the next patch cycle is complete.

Question 15

A company wants employees to sign in once with corporate credentials and access multiple SaaS apps without creating separate passwords for each service. Which two features best support this goal? Select two.

Accepted Answer

Federation trust between the corporate identity provider and the SaaS provider.. Federation trust, typically implemented via standards like SAML 2.0 or OpenID Connect, establishes a trust relationship between the corporate identity provider (IdP) and each SaaS provider. This allows the SaaS app to accept authentication assertions from the corporate IdP, enabling users to sign in with their corporate credentials without needing separate passwords for each service.

Answer

Shared generic accounts for each department.

Answer

Storing the same password inside every SaaS application.

Answer

Disabling MFA so the sign-in process is faster.