SY0-701 Practice Test 17 — 15 Questions

Question 1

A Java web service accepts a Base64-encoded `profile` object from the browser. During testing, changing a serialized field from `role=user` to `role=admin` causes a deserialization error unless the original signed blob is reused. When a captured valid blob is modified only slightly, the application reconstructs a different class and then exposes an internal admin page. Which attack pattern is most likely?

Accepted Answer

Insecure deserialization, because untrusted serialized data is being reconstructed into server-side objects.. The correct answer is A because the scenario describes a classic insecure deserialization attack. The Java web service accepts a Base64-encoded serialized object from the browser and reconstructs it into server-side objects without integrity verification. When the attacker modifies a serialized field (role=user to role=admin), the application deserializes the tampered data, which causes a deserialization error unless the original signed blob is reused, but a slight modification reconstructs a different class and exposes an internal admin page. This directly matches the OWASP Top 10 insecure deserialization pattern where untrusted data is deserialized, leading to object injection and privilege escalation.

Answer

SQL injection, because the attacker is changing a field to access a different page.

Answer

Cross-site request forgery, because the browser is sending a forged request to the application.

Answer

Cross-site scripting, because the modified object exposes an internal admin page.

Question 2

A hospital's claims portal has two open risks. Risk A is an internet-facing login page with a low-severity software flaw, but monitoring shows a steady increase in automated login attempts. Risk B is an internal file share with a medium-severity patch gap, but only a small admin group can access it and no exploitation is observed. Leadership can fund only one remediation this month. Which risk should be prioritized first?

Accepted Answer

Prioritize Risk A because it is exposed to the internet and already shows active attack interest.. Risk A should be prioritized because the internet-facing login page is exposed to the public attack surface, and the steady increase in automated login attempts indicates active reconnaissance or credential-stuffing attacks. Even though the software flaw is low severity, the combination of internet exposure and active attacker interest significantly elevates the likelihood of exploitation, making it a higher priority than an internal file share with no observed exploitation.

Answer

Prioritize Risk B because a medium-severity flaw is always more important than a low-severity flaw.

Answer

Accept Risk A because no confirmed compromise has occurred yet.

Answer

Transfer Risk A to an insurer because public-facing exposure cannot be reduced.

Question 3

A legacy finance application cannot yet support multifactor authentication. The security team still wants administrators to use separate privileged accounts, receive elevated access only when a ticket is approved, and have those privileges removed automatically after the maintenance window ends. Which solution best fits?

Accepted Answer

Use privileged access management with separate admin accounts and time-bound elevation approvals.. Option C is correct because Privileged Access Management (PAM) solutions are specifically designed to enforce just-in-time (JIT) privileged access. They allow administrators to request time-bound elevation of rights for a specific maintenance window, with automatic revocation after the window expires. This directly meets the requirements of separate privileged accounts, ticket-based approval, and automatic removal of privileges, even when the legacy application itself cannot support MFA.

Answer

Create one shared administrator account and rotate its password every week.

Answer

Assign permanent administrator rights through role-based access control and rely on audit logs afterward.

Answer

Move the application behind a federation service so all users can sign in with a single password.

Question 4

A help desk technician receives a ticket asking for a password reset on a manager's account. The requester says the manager is traveling and cannot be reached. What is the best action before making any change?

Accepted Answer

Verify the request through an approved identity-check process before taking action.. Option B is correct because the principle of least privilege and proper identity verification are critical before performing any privileged action like a password reset. Without verifying the requester's identity through an approved process (e.g., out-of-band verification, knowledge-based authentication, or manager callback), the technician risks unauthorized access, which could lead to a security breach. This aligns with the CompTIA SY0-701 objective on implementing identity and access management controls.

Answer

Reset the password immediately to avoid delaying the manager's work.

Answer

Tell the requester to ask a coworker to share the manager's existing password.

Answer

Ignore the ticket until the manager returns from travel.

Question 5

A public web server becomes unreachable during an outage. Netflow shows a large number of DNS responses arriving from many open resolvers, while the server itself only sent tiny spoofed DNS queries with the victim's address as the source. What type of attack is this?

Accepted Answer

DNS amplification reflection denial-of-service.. This is a classic DNS amplification reflection DDoS attack. The attacker sends small DNS queries with a spoofed source IP (the victim's address) to open resolvers, which then send large DNS responses to the victim, overwhelming its bandwidth. The NetFlow data shows the server receiving many large DNS responses while only sending tiny spoofed queries, confirming the amplification and reflection vectors.

Answer

DNS zone transfer abuse against the organization.

Answer

A replay attack against a web application session token.

Answer

ARP poisoning inside the local network segment.

Question 6

A legacy payroll application cannot support multifactor authentication yet, but the business still needs to reduce risk while the application is being modernized. The security team limits access to a hardened jump host, requires manager approval for access requests, and adds extra logging until the application can be upgraded. What type of control is this?

Accepted Answer

Compensating control. Compensating controls are alternative security measures implemented when primary controls (like MFA) cannot be applied due to technical limitations. In this scenario, the jump host restriction, manager approval, and enhanced logging serve as compensating controls to reduce risk until the legacy payroll application can be modernized to support MFA.

Answer

Corrective control

Answer

Deterrent control

Answer

Preventive control

Question 7

A marketing analyst asks for a spreadsheet containing customer names, email addresses, purchase history, and government ID numbers so the team can build a campaign list. What is the BEST security response?

Accepted Answer

Provide only the minimum fields required and remove the government ID numbers.. The best security response is to apply the principle of least privilege and data minimization. Government ID numbers are sensitive personally identifiable information (PII) that are not necessary for building a marketing campaign list; providing only the minimum required fields (e.g., names and email addresses) reduces the risk of exposure and complies with data protection regulations like GDPR or CCPA.

Answer

Approve the request because the data is needed for any marketing activity.

Answer

Send the full file, but ask the analyst not to store it permanently.

Answer

Classify the file as public so it can be shared more easily with the marketing team.

Question 8

A procurement team is evaluating a payroll SaaS vendor. They want independent evidence that the vendor's controls were designed and operating effectively over the last six months, not just at a single point in time. Which report should they request?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides independent assurance that a vendor's controls related to security, availability, processing integrity, confidentiality, or privacy were designed and operating effectively over a period of time (typically 6–12 months). This matches the procurement team's requirement for evidence of sustained control effectiveness, not just a point-in-time snapshot.

Answer

SOC 1 Type I report

Answer

Non-disclosure agreement

Answer

Network penetration test letter

Question 9

A legal department sends a confidential contract to an outside partner without first exchanging a shared secret. The sender encrypts the document with the partner's public key so that only the partner can decrypt it with the matching private key. Which cryptographic approach is being used?

Accepted Answer

Asymmetric encryption. B is correct because the scenario describes encrypting a document with the recipient's public key, which can only be decrypted by the recipient's private key. This is the defining characteristic of asymmetric encryption (also known as public-key cryptography), where two different but mathematically related keys are used for encryption and decryption.

Answer

Symmetric encryption

Answer

Hashing

Answer

Digital signatures

Question 10

A legacy reporting application cannot be modified this quarter, but users still need access from the corporate network. Security adds a hardened jump server, tighter monitoring, and manual approval for each session because MFA cannot be built into the app yet. What type of control is this?

Accepted Answer

Compensating control. A compensating control is an alternative security measure implemented when the primary control cannot be applied due to technical or operational constraints. In this scenario, the legacy application cannot be modified to support MFA, so the organization deploys a hardened jump server, enhanced monitoring, and manual session approval as compensating controls to reduce risk. These controls do not eliminate the vulnerability but provide an equivalent level of protection until the application can be updated.

Answer

Detective control

Answer

Corrective control

Answer

Deterrent control

Question 11

A security analyst in the SOC observes a sudden spike in failed authentication attempts from a single external IP address targeting multiple user accounts over the last 30 minutes. After confirming the logs are accurate, which of the following actions should the analyst take FIRST according to standard incident response procedures?

Accepted Answer

Escalate the incident to the incident response team.. Option C is correct because, according to standard incident response procedures (NIST SP 800-61), the first step after confirming an anomaly is to escalate the incident to the incident response team. This ensures that a coordinated, documented, and legally defensible response is initiated, rather than taking unilateral action that could destroy evidence or disrupt legitimate services. The SOC analyst's role is to detect and validate, not to independently execute containment measures without authorization.

Answer

Block the IP address at the firewall immediately.

Answer

Disable all user accounts that were targeted.

Answer

Capture a memory dump of all affected servers.

Question 12

A legal team must send a confidential contract to a partner so only the intended recipient can read it, and the partner also needs assurance the file really came from your company. Which approach best meets both needs?

Accepted Answer

Encrypt the file with the recipient's public key and sign it with the sender's private key.. Option B is correct because it uses asymmetric encryption to ensure confidentiality (encrypting with the recipient's public key ensures only the intended recipient can decrypt it with their private key) and digital signing (signing with the sender's private key provides non-repudiation and authenticity, proving the file came from the sender). This combination directly addresses both requirements: only the partner can read the contract, and the partner can verify the sender's identity.

Answer

Hash the contract and email the hash value separately.

Answer

Use a shared symmetric key and send the key in the same email message.

Answer

Compress the file and password-protect the archive with a simple passphrase.

Question 13

A payroll application allows the same user to create a vendor and approve a payment. The security team wants to reduce fraud without adding unnecessary complexity. Which principle should they apply?

Accepted Answer

Separation of duties, so no single person can complete the entire high-risk workflow.. Separation of duties (option A) is the correct principle because it prevents a single user from both creating a vendor and approving a payment, which would allow that user to commit fraud by setting up a fake vendor and authorizing a payment to it. By splitting these high-risk tasks between two or more people, the organization enforces a dual-control mechanism that reduces the risk of internal fraud without adding complex technical controls. This aligns with the security team's goal of reducing fraud while avoiding unnecessary complexity.

Answer

Job rotation, so employees periodically switch responsibilities to learn each other’s tasks.

Answer

Defense in depth, so multiple technical tools inspect every payment form.

Answer

Least privilege, so the payroll user can create and approve only this one vendor payment.

Question 14

A SaaS dashboard invalidates passwords after a forced reset, but a stolen bearer token from a browser cookie still works from a VPN exit node for several hours. SIEM logs show the same token value used from two countries within five minutes, and no MFA prompt appears because the token is already accepted. What attack is most likely?

Accepted Answer

Session hijacking, because a valid session token is being replayed from a different location.. Option A is correct because the scenario describes a stolen bearer token (session token) being reused from a different geographic location (VPN exit node) without re-authentication. This is classic session hijacking, where an attacker captures a valid session token (e.g., from a browser cookie) and replays it to impersonate the authenticated user. The fact that the token works even after a password reset and bypasses MFA confirms the attack is session hijacking, not credential theft or request forgery.

Answer

Credential stuffing, because the attacker used many passwords against the portal.

Answer

Cross-site request forgery, because the attacker is making requests on behalf of the user.

Answer

Phishing, because the attacker likely stole the user's password first.

Question 15

A Linux operations team must run a nightly maintenance script on 70 servers to rotate logs and restart one service. Security will not allow interactive SSH logins, and the script should only have the permissions required for those two commands. Which two configuration choices best meet the requirement? Select two.

Accepted Answer

Create a dedicated automation account and restrict it in sudoers to the exact commands needed.. Option A is correct because creating a dedicated automation account and restricting it in sudoers to the exact commands needed (e.g., `/usr/sbin/logrotate` and `/usr/bin/systemctl restart <service>`) enforces the principle of least privilege. This ensures the account can only execute the specific maintenance tasks without granting interactive SSH access or unnecessary permissions.

Answer

Place the automation account in the root group so it can restart services everywhere.

Answer

Copy the administrator's personal password into the script so the job can log in unattended.

Answer

Approve the job through email one time, then allow the script to run with no restrictions forever.