SY0-701 Practice Test 16 — 15 Questions

Question 1

A security team downloads a software update package signed by the vendor. The team verifies the signature using the vendor's public key before approving deployment. What does this verification primarily confirm?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The package was likely created by the vendor and was not altered after signing. Digital signature verification using the vendor's public key confirms that the package was signed with the vendor's private key, which only the vendor possesses. This provides authentication of the signer's identity and integrity of the data, ensuring the package has not been modified since signing. It does not provide confidentiality, as the package itself is not encrypted.

Answer

The package can only be decrypted by the vendor's private key

Answer

The package is encrypted with the vendor's public key

Answer

The vendor's certificate has not expired

Question 2

During morning SIEM review, an analyst sees 37 failed SSH logins followed by a successful login to a Linux server from a jump host. The account belongs to a configuration-management service account, and the activity occurred inside the normal maintenance window. What should the analyst do next to determine whether the alert is a true positive or a false positive?

Accepted Answer

Correlate the event with the approved maintenance ticket and automation job logs.. The analyst should correlate the failed SSH logins with the approved maintenance ticket and automation job logs to verify if the activity is expected. The failed logins followed by a successful login from a jump host during a maintenance window are consistent with a configuration-management tool (e.g., Ansible, Puppet) retrying authentication. This correlation confirms whether the alert is a true positive (unauthorized access) or a false positive (routine automation).

Answer

Immediately isolate the Linux server from the network and begin recovery.

Answer

Reset the service account password before reviewing any additional evidence.

Answer

Disable SSH on the server until the next patch cycle is complete.

Question 3

During testing, entering ' OR '1'='1 into a login field returns all user records instead of rejecting the input. What is the best fix to address this flaw?

Accepted Answer

Use parameterized queries or prepared statements for database access. The flaw is a classic SQL injection vulnerability, where unsanitized user input is concatenated directly into a SQL query. Parameterized queries (prepared statements) separate SQL logic from data, ensuring that input like ' OR '1'='1 is treated as a literal string value, not executable code. This is the industry-standard mitigation per OWASP and effectively prevents injection attacks.

Answer

Add client-side JavaScript validation to block quote characters

Answer

Store passwords in a stronger hash format

Answer

Change the login page to HTTPS

Question 4

A company wants employees to sign in once with corporate credentials and access multiple SaaS apps without creating separate passwords for each service. Which two features best support this goal? Select two.

Accepted Answer

Federation trust between the corporate identity provider and the SaaS provider.. Federation trust, typically implemented via standards like SAML 2.0 or OpenID Connect, establishes a trust relationship between the corporate identity provider (IdP) and each SaaS provider. This allows the SaaS app to accept authentication assertions from the corporate IdP, enabling users to sign in with their corporate credentials without needing separate passwords for each service.

Answer

Shared generic accounts for each department.

Answer

Storing the same password inside every SaaS application.

Answer

Disabling MFA so the sign-in process is faster.

Question 5

After a new search feature goes live, logs show requests containing `UNION SELECT` and the application returns database error messages. Security testing confirms attackers can retrieve rows from other tables by modifying the query string. Which fix is best?

Accepted Answer

Rewrite the database access layer to use parameterized queries or prepared statements.. The attack described is SQL injection, where the attacker uses `UNION SELECT` to extract data from other tables. The most effective and industry-standard fix is to use parameterized queries or prepared statements, which separate SQL logic from user input, preventing the database from interpreting malicious input as executable code. This directly addresses the root cause by ensuring user-supplied data is treated as data, not as part of the SQL command.

Answer

Encode special characters in the browser before submitting the search form.

Answer

Disable detailed error messages so attackers cannot see the database name.

Answer

Increase password complexity requirements for all application users.

Question 6

A nightly patch script restarts services on 40 Linux servers. Security does not want an administrator to log in interactively, and the script should only have the permissions needed to install approved patches and restart those services. What is the best design?

Accepted Answer

Run the script with a dedicated automation account that has only the required sudo permissions. It follows the principle of least privilege by using a dedicated automation account with only the specific sudo permissions needed to install approved patches and restart services. This prevents interactive login (as the account is configured for non-interactive use) and ensures the script cannot perform unauthorized actions, aligning with security best practices for automated tasks.

Answer

Use the root account for every scheduled execution to avoid permission errors

Answer

Hard-code the administrator password in the script so it never prompts

Answer

Ask each server owner to manually patch their system during the maintenance window

Question 7

After a phishing simulation, many users still nearly entered credentials on the fake page. Security wants the fastest improvement without scheduling long training sessions. What is the best response?

Accepted Answer

Send a short targeted awareness message with examples, warning signs, and reporting steps.. A short targeted awareness message directly addresses the observed risky behavior with minimal time investment, providing immediate reinforcement of warning signs and reporting procedures. This approach leverages just-in-time training, which is proven to improve retention and behavior change more effectively than lengthy sessions, aligning with the goal of fastest improvement without disrupting operations.

Answer

Require a full-day classroom course for every employee immediately.

Answer

Ignore the results because no actual breach occurred.

Answer

Reset every employee password as the main way to prevent future clicks.

Question 8

A department identifies a low-likelihood software risk that would be expensive to fix right now. Leadership decides the business can live with the exposure for now, but wants it documented and reviewed later. What risk treatment is this?

Accepted Answer

Accept the risk with documented approval and periodic review. The scenario describes a low-likelihood, high-cost software risk that leadership chooses to tolerate rather than fix immediately. This is the definition of risk acceptance, which requires documented approval and periodic review to ensure the risk remains acceptable over time. The correct risk treatment is to formally accept the exposure with a record of the decision and a schedule for reassessment.

Answer

Mitigate the risk by applying a technical control immediately

Answer

Transfer the risk to an insurer or third party

Answer

Avoid the risk by stopping the business activity entirely

Question 9

EDR flags a workstation because a word processor launched an unusual script and then contacted a rare external domain. What is the best immediate action?

Accepted Answer

Isolate the workstation from the network using the EDR tool.. Isolating the workstation with the EDR tool is the best immediate action because it contains the potential compromise by cutting off network communication, preventing lateral movement or data exfiltration while preserving forensic evidence. The combination of an unusual script execution from a word processor and a connection to a rare external domain strongly suggests a possible malware infection or remote access trojan (RAT) that requires immediate containment.

Answer

Wait for another alert before taking any action.

Answer

Delete the word processor immediately.

Answer

Reboot the workstation to see if the behavior happens again.

Question 10

An external auditor asks for proof that quarterly privileged access reviews were completed and that any exceptions were tracked to closure during the last year. Which evidence is MOST appropriate to provide?

Accepted Answer

Signed access review records and remediation tickets from the access management process.. Signed access review records provide verifiable proof that quarterly reviews were conducted, and remediation tickets demonstrate that any exceptions (e.g., excessive privileges) were tracked and resolved. This aligns with the principle of audit evidence: it must be objective, verifiable, and show a complete chain of actions from review to closure. A screenshot or policy alone lacks the audit trail of actual completion and exception handling.

Answer

A screenshot of one administrator's account showing current privileges.

Answer

The security policy that says access reviews must happen every quarter.

Answer

An email from the system administrator stating that reviews were completed on time.

Question 11

During triage, you see a legitimate browser process spawning powershell.exe with an encoded command, followed by an outbound connection to a newly registered domain. No new executable is written to disk. Which malware characteristic best fits this behavior?

Accepted Answer

Fileless malware that relies on scripting and memory-resident execution.. The described behavior—a legitimate browser process spawning PowerShell with an encoded command, executing in memory without writing a new executable to disk, and making an outbound connection to a newly registered domain—is the classic hallmark of fileless malware. Fileless malware leverages built-in scripting engines (like PowerShell) and runs entirely in memory, avoiding traditional disk-based detection by antivirus and forensic tools.

Answer

A macro virus that only runs when a document is opened.

Answer

A boot sector virus that persists by altering startup code.

Answer

A logic bomb that activates only when a specific date or event is reached.

Question 12

A data center has repeated tailgating incidents at the entry to the server room. Management wants a control that forces one person to pass after badge authentication and prevents two people from entering together. What should be installed?

Accepted Answer

A mantrap between the outer door and the server room entrance. A mantrap is a physical security control with two interlocking doors that enforces one-person entry. After badge authentication at the outer door, the inner door will not unlock until the outer door closes and locks, preventing two people from entering together. This directly addresses tailgating by creating a small vestibule that can only hold one authenticated person at a time.

Answer

A CCTV camera focused on the doorway

Answer

A motion sensor inside the server room

Answer

A standard badge reader with no additional controls

Question 13

System administrators need to manage internal switches from home. The solution must encrypt management traffic, strongly authenticate users, and avoid exposing management ports directly to the internet. What should be used?

Accepted Answer

A VPN into the internal network, then SSH or HTTPS for administration.. A VPN creates an encrypted tunnel over the internet, protecting management traffic in transit. Once connected to the internal network, SSH (for CLI) or HTTPS (for web GUI) provides strong authentication and encryption for switch administration. This approach avoids exposing management ports directly to the internet, reducing the attack surface.

Answer

Telnet over port 23 with an allow list on the firewall.

Answer

RDP directly to the switch management interface from the public IP address.

Answer

Open the management port to the internet and rely on a long password.

Question 14

A company uses a SaaS file-sharing platform for employee documents. Which action is the company's responsibility, not the provider's?

Accepted Answer

Setting user sharing permissions and access controls for company data.. In a SaaS model, the provider manages the underlying infrastructure, including application servers, storage, and hypervisors. The customer is responsible for configuring access controls and permissions for their own data within the application. Option B correctly identifies this shared responsibility boundary.

Answer

Patching the vendor's application servers.

Answer

Replacing failed disks in the provider's storage cluster.

Answer

Maintaining the cloud provider's identity center and hypervisor.

Question 15

The security team configures the badge system so employees must present both a badge and a PIN before entering the data center. The access logs are reviewed weekly for failed attempts. Which pair of control types best describes these measures?

Accepted Answer

Preventive and detective, because one measure blocks access and the other identifies suspicious activity.. The badge and PIN requirement is a preventive control that blocks unauthorized access to the data center, while the weekly review of access logs is a detective control that identifies suspicious activity after the fact. Preventive controls stop incidents before they occur, and detective controls discover violations that have already happened, making this pair the best fit for the described measures.

Answer

Corrective and recovery, because the logs can restore access after a badge failure.

Answer

Deterrent and compensating, because the PIN discourages attackers and the logs replace the badge reader.

Answer

Administrative and physical, because the weekly review and the badge reader are both physical measures.