SY0-701 Practice Test 16 — 15 Questions

Question 1

A data center has repeated tailgating incidents at the entry to the server room. Management wants a control that forces one person to pass after badge authentication and prevents two people from entering together. What should be installed?

Accepted Answer

A mantrap between the outer door and the server room entrance. A mantrap is a physical security control with two interlocking doors that enforces one-person entry. After badge authentication at the outer door, the inner door will not unlock until the outer door closes and locks, preventing two people from entering together. This directly addresses tailgating by creating a small vestibule that can only hold one authenticated person at a time.

Answer

A CCTV camera focused on the doorway

Answer

A motion sensor inside the server room

Answer

A standard badge reader with no additional controls

Question 2

A company launches a new HTTPS portal. Users should be able to confirm the site is really the company's portal and not a fake copy. Which control provides that trust?

Accepted Answer

A TLS certificate issued by a trusted certificate authority. A TLS certificate issued by a trusted certificate authority (CA) provides the trust needed because browsers and operating systems maintain a root store of trusted CAs. When a user visits the HTTPS portal, the server presents a certificate signed by that CA, and the browser cryptographically verifies the signature chain back to a trusted root. This ensures the public key belongs to the claimed domain, authenticating the server and preventing impersonation by a fake copy.

Answer

A self-signed certificate installed only on user laptops

Answer

A SHA-256 checksum posted on the login page

Answer

A shared password embedded in the page source

Question 3

A company wants to stop employees from running unauthorized tools downloaded from the internet on managed Windows laptops, but still allow approved internal apps and vendor-updated software. Which control is best?

Accepted Answer

Application control using an allowlist for approved executables and publishers.. Application control with an allowlist (also known as whitelisting) is the correct choice because it explicitly defines which executables, scripts, and publishers are permitted to run on managed Windows laptops. This prevents unauthorized tools downloaded from the internet from executing, while allowing approved internal apps and vendor-updated software that match the allowlist criteria. Technologies like Windows Defender Application Control (WDAC) or AppLocker enforce this by checking file hashes, publisher signatures, or path rules at runtime.

Answer

Full-disk encryption on every laptop before deployment.

Answer

A stronger screen-lock timeout and automatic logoff policy.

Answer

A firmware password for the BIOS without any other endpoint restrictions.

Question 4

A legacy application server has a critical vulnerability, but the vendor will not release a fix for 30 days. Which two compensating controls are the best short-term risk reduction steps? Select two.

Accepted Answer

Restrict access to the server to known admin IPs or a jump host.. Option A is correct because restricting access to the server to known admin IPs or a jump host reduces the attack surface by limiting who can reach the vulnerable service. This network-layer control (e.g., using ACLs or firewall rules) prevents exploitation from untrusted sources while the vendor patch is pending. It is a classic compensating control that buys time without modifying the application itself.

Answer

Document the issue and wait for the vendor patch without making any changes.

Answer

Open the service to more networks so monitoring tools can see it better.

Answer

Disable logging to reduce the performance overhead caused by the vulnerability.

Question 5

A file server suddenly shows many encrypted files with a new extension, and endpoint tools report that Volume Shadow Copy Service was disabled minutes earlier. A note on the desktop demands payment in cryptocurrency. What should the security team do first?

Accepted Answer

Isolate the affected systems from the network and preserve evidence.. Isolating the affected systems from the network and preserving evidence is the correct first step because it prevents the ransomware from spreading to other systems via SMB or other network protocols, and it preserves the forensic artifacts (e.g., the ransom note, encrypted files, and Volume Shadow Copy Service logs) needed for incident response and potential decryption. Disabling VSS is a common ransomware tactic to prevent file recovery, so immediate containment is critical before any remediation.

Answer

Pay the ransom immediately to restore access quickly.

Answer

Reimage the server immediately without documenting the event.

Answer

Disable antivirus alerts so staff can work without distractions.

Question 6

A hospital has clinical workstations, badge readers, and building cameras all connected to the same switching infrastructure. After a workstation infection, the security team wants to prevent those endpoints from laterally reaching the badge readers while still allowing the cameras to report to a recording server. What should be implemented first?

Accepted Answer

Create separate VLANs and apply ACLs between device groups based on business need.. Creating separate VLANs segments the network into distinct broadcast domains, preventing workstations from directly reaching badge readers at Layer 2. Applying ACLs between VLANs then enforces granular access control, allowing only the cameras to communicate with the recording server while blocking lateral movement from infected endpoints. This aligns with the principle of least privilege and is the foundational step for network segmentation.

Answer

Increase the DHCP lease time so devices keep the same IP addresses longer.

Answer

Replace the switches with unmanaged models to simplify configuration.

Answer

Disable the cameras' encryption so the recording server can process traffic faster.

Question 7

A resolver log shows multiple clients querying the correct internal host name, but the DNS server starts returning an unexpected public IP address after a burst of unsolicited DNS responses from outside the network. Users are sent to a lookalike login page. What type of attack is most likely occurring?

Accepted Answer

DNS poisoning. The scenario describes a DNS poisoning (also known as DNS cache poisoning) attack. The burst of unsolicited DNS responses from outside the network is the attacker injecting forged DNS records into the resolver's cache, causing it to map the correct internal host name to an unexpected public IP address. This redirects users to a lookalike login page, which is the classic outcome of DNS poisoning.

Answer

Brute-force authentication

Answer

Port scanning

Answer

Packet sniffing

Question 8

A DevOps team builds container images in a CI/CD pipeline. Security wants to reduce the chance of deploying vulnerable libraries and also wants the cluster to reject images that have not been approved. Which approach best meets both requirements?

Accepted Answer

Scan images in the pipeline and enforce signature verification or admission control before deployment.. Option D is correct because it combines two essential security controls: scanning container images for known vulnerabilities (e.g., using Trivy or Clair) during the CI/CD pipeline, and enforcing signature verification (e.g., using Notary or Cosign) or admission control (e.g., using OPA/Gatekeeper or Kyverno) to ensure only signed or approved images are deployed. This directly reduces the risk of deploying vulnerable libraries and prevents unapproved images from running in the cluster.

Answer

Increase CPU and memory limits for the containers so they run more safely.

Answer

Allow developers to pull images from any registry as long as the tags look familiar.

Answer

Disable pipeline scanning to speed releases and rely on runtime monitoring after deployment.

Question 9

A contractor is brought in to investigate a single alert on an ERP system. The contractor gets read-only access to one log source through a jump host, cannot see user payroll records, and the account expires automatically at shift end. Which two principles are being applied? Select two.

Accepted Answer

Least privilege, because the contractor receives only the access needed for one investigation.. Least privilege is applied because the contractor's access is strictly limited to what is necessary for the single investigation: read-only access to one log source via a jump host, with the account expiring automatically at shift end. This ensures the contractor cannot perform any actions beyond the scope of the task, minimizing the attack surface and potential for accidental or malicious changes.

Answer

Separation of duties, because one person cannot both request and approve the access.

Answer

Defense in depth, because multiple layers of security tools are deployed around the server.

Answer

Zero trust, because every request is automatically denied until proven safe.

Question 10

A digital forensics analyst is investigating a suspected insider threat. The analyst has acquired a laptop used by the suspect. The analyst needs to obtain a forensic image of the hard drive without altering any data. The laptop is running and logged into the suspect's user account. Which of the following is the most appropriate first step for the analyst to take?

Accepted Answer

Pull the power cord from the laptop to immediately shut down the system and prevent any further system writes.. Option A is correct because immediately removing power (hard shutdown) stops all system writes and preserves the current state of the hard drive without any further changes. This is critical in forensic acquisition to maintain data integrity and avoid altering evidence, especially when the system is logged in and actively writing to the disk.

Answer

Boot the laptop from a forensic boot CD that loads a write-blocker driver and then create a forensic image.

Answer

Perform a live acquisition of the hard drive using a network forensic tool while the system is still running.

Answer

Ask the suspect to log off and shut down the laptop normally, then remove the hard drive and image it using a write-blocker.

Question 11

A Linux server is being prepared for production as a database host. The build team notices that a graphical desktop environment, an unused FTP service, and an open mail submission port are present on the image, even though none of them are required. The organization wants future builds to be consistent and easy to verify. What is the best approach?

Accepted Answer

Create and enforce a hardened build standard that removes unnecessary services and ports, then validate future servers against it.. Option C is correct because it establishes a hardened baseline configuration that removes unnecessary services (e.g., FTP on port 21) and closes unused ports (e.g., mail submission port 587), ensuring consistency and simplifying verification. This aligns with the principle of minimizing attack surface by disabling all non-essential components before production deployment. A hardened build standard also enables automated compliance checks (e.g., using CIS benchmarks or OpenSCAP) to validate future servers against the defined secure state.

Answer

Leave the image unchanged so troubleshooting remains easier for administrators.

Answer

Use the image only for development and skip security review for production.

Answer

Add another firewall rule set and keep every installed service in place.

Question 12

A help desk team manages 300 Windows laptops. A legacy accounting app sometimes fails after updates, so the company wants to reduce patch risk while still preventing long-term exposure. Which patching strategy is the best balance?

Accepted Answer

Use a pilot group and phased rollout process before wider deployment.. A phased rollout with a pilot group is the most balanced approach. It allows the team to test new patches on a few systems that reflect the production environment before exposing the entire fleet to possible compatibility issues. That lowers operational risk while still ensuring the organization patches regularly, which is essential for reducing exposure to known vulnerabilities and maintaining a secure baseline.

Why others are wrong: Option A is too labor-intensive and still lacks controlled validation. Option C accepts avoidable risk by deferring all updates indefinitely. Option D is reactive and leaves the fleet exposed until an incident occurs. The correct answer is the only one that preserves security and operational stability at the same time.

Answer

Apply updates manually to each laptop as soon as they are released.

Answer

Postpone all updates until the legacy accounting app is replaced.

Answer

Disable automatic updates permanently and patch only after a security incident.

Question 13

A finance workflow currently lets one employee create a payment batch and approve it in the same session. Audit findings say the design increases fraud risk. Which two access architecture changes best reduce that risk while keeping the process functional? Select two.

Accepted Answer

Split the workflow into separate creator and approver roles.. Option A is correct because implementing separation of duties (SoD) by splitting the payment batch creation and approval into distinct roles ensures that no single user can both create and approve a transaction. This directly mitigates the fraud risk identified in the audit by requiring collusion between two users to execute a fraudulent payment. The process remains functional because the workflow is simply reordered into two sequential steps performed by different users.

Answer

Grant all finance users local administrator rights to speed up exception handling.

Answer

Store the payment password in a shared mailbox so the team can continue when someone is absent.

Answer

Remove approval steps entirely and rely on log reviews after payment runs.

Question 14

A legacy production scanner cannot support MFA, but it must remain available for six months until replacement hardware arrives. What is the best security response?

Accepted Answer

Approve a time-bound exception with compensating controls and a review date.. Option B is correct because it balances security with operational necessity by implementing a time-bound exception with compensating controls (e.g., network segmentation, strict access logging, or IP whitelisting) and a mandatory review date. This ensures the legacy scanner remains available for six months while mitigating the risk of unauthorized access, aligning with the principle of least privilege and security program oversight.

Answer

Permanently waive MFA for the scanner and leave the exception open-ended.

Answer

Shut down the scanner immediately until MFA can be enabled.

Answer

Create a shared administrator account so operators can sign in more easily.

Question 15

A legacy payroll server has a critical patch available, but the business cannot reboot it for 45 days. The team isolates the server to only the payroll application subnet and requires written approval before any temporary firewall exception is made. Which two control types are present? Select two.

Accepted Answer

Compensating control, because the temporary network restriction offsets the delayed patch.. Option A is correct because isolating the server to the payroll subnet is a compensating control that reduces risk by restricting network access, offsetting the inability to apply the critical patch immediately. This temporary measure provides an alternative security layer until the patch can be installed and the server rebooted.

Answer

Detective control, because a rule set later identifies malicious traffic.

Answer

Corrective control, because the control repairs the vulnerable software itself.

Answer

Deterrent control, because a warning banner discourages misuse of the server.