SY0-701 Practice Test 17 — 15 Questions

Question 1

After a new search feature goes live, logs show requests containing `UNION SELECT` and the application returns database error messages. Security testing confirms attackers can retrieve rows from other tables by modifying the query string. Which fix is best?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rewrite the database access layer to use parameterized queries or prepared statements.. The attack described is SQL injection, where the attacker uses `UNION SELECT` to extract data from other tables. The most effective and industry-standard fix is to use parameterized queries or prepared statements, which separate SQL logic from user input, preventing the database from interpreting malicious input as executable code. This directly addresses the root cause by ensuring user-supplied data is treated as data, not as part of the SQL command.

Answer

Encode special characters in the browser before submitting the search form.

Answer

Disable detailed error messages so attackers cannot see the database name.

Answer

Increase password complexity requirements for all application users.

Question 2

A nightly patch script restarts services on 40 Linux servers. Security does not want an administrator to log in interactively, and the script should only have the permissions needed to install approved patches and restart those services. What is the best design?

Accepted Answer

Run the script with a dedicated automation account that has only the required sudo permissions. It follows the principle of least privilege by using a dedicated automation account with only the specific sudo permissions needed to install approved patches and restart services. This prevents interactive login (as the account is configured for non-interactive use) and ensures the script cannot perform unauthorized actions, aligning with security best practices for automated tasks.

Answer

Use the root account for every scheduled execution to avoid permission errors

Answer

Hard-code the administrator password in the script so it never prompts

Answer

Ask each server owner to manually patch their system during the maintenance window

Question 3

After a phishing simulation, many users still nearly entered credentials on the fake page. Security wants the fastest improvement without scheduling long training sessions. What is the best response?

Accepted Answer

Send a short targeted awareness message with examples, warning signs, and reporting steps.. A short targeted awareness message directly addresses the observed risky behavior with minimal time investment, providing immediate reinforcement of warning signs and reporting procedures. This approach leverages just-in-time training, which is proven to improve retention and behavior change more effectively than lengthy sessions, aligning with the goal of fastest improvement without disrupting operations.

Answer

Require a full-day classroom course for every employee immediately.

Answer

Ignore the results because no actual breach occurred.

Answer

Reset every employee password as the main way to prevent future clicks.

Question 4

A department identifies a low-likelihood software risk that would be expensive to fix right now. Leadership decides the business can live with the exposure for now, but wants it documented and reviewed later. What risk treatment is this?

Accepted Answer

Accept the risk with documented approval and periodic review. The scenario describes a low-likelihood, high-cost software risk that leadership chooses to tolerate rather than fix immediately. This is the definition of risk acceptance, which requires documented approval and periodic review to ensure the risk remains acceptable over time. The correct risk treatment is to formally accept the exposure with a record of the decision and a schedule for reassessment.

Answer

Mitigate the risk by applying a technical control immediately

Answer

Transfer the risk to an insurer or third party

Answer

Avoid the risk by stopping the business activity entirely

Question 5

EDR flags a workstation because a word processor launched an unusual script and then contacted a rare external domain. What is the best immediate action?

Accepted Answer

Isolate the workstation from the network using the EDR tool.. Isolating the workstation with the EDR tool is the best immediate action because it contains the potential compromise by cutting off network communication, preventing lateral movement or data exfiltration while preserving forensic evidence. The combination of an unusual script execution from a word processor and a connection to a rare external domain strongly suggests a possible malware infection or remote access trojan (RAT) that requires immediate containment.

Answer

Wait for another alert before taking any action.

Answer

Delete the word processor immediately.

Answer

Reboot the workstation to see if the behavior happens again.

Question 6

An external auditor asks for proof that quarterly privileged access reviews were completed and that any exceptions were tracked to closure during the last year. Which evidence is MOST appropriate to provide?

Accepted Answer

Signed access review records and remediation tickets from the access management process.. Signed access review records provide verifiable proof that quarterly reviews were conducted, and remediation tickets demonstrate that any exceptions (e.g., excessive privileges) were tracked and resolved. This aligns with the principle of audit evidence: it must be objective, verifiable, and show a complete chain of actions from review to closure. A screenshot or policy alone lacks the audit trail of actual completion and exception handling.

Answer

A screenshot of one administrator's account showing current privileges.

Answer

The security policy that says access reviews must happen every quarter.

Answer

An email from the system administrator stating that reviews were completed on time.

Question 7

During triage, you see a legitimate browser process spawning powershell.exe with an encoded command, followed by an outbound connection to a newly registered domain. No new executable is written to disk. Which malware characteristic best fits this behavior?

Accepted Answer

Fileless malware that relies on scripting and memory-resident execution.. The described behavior—a legitimate browser process spawning PowerShell with an encoded command, executing in memory without writing a new executable to disk, and making an outbound connection to a newly registered domain—is the classic hallmark of fileless malware. Fileless malware leverages built-in scripting engines (like PowerShell) and runs entirely in memory, avoiding traditional disk-based detection by antivirus and forensic tools.

Answer

A macro virus that only runs when a document is opened.

Answer

A boot sector virus that persists by altering startup code.

Answer

A logic bomb that activates only when a specific date or event is reached.

Question 8

A data center has repeated tailgating incidents at the entry to the server room. Management wants a control that forces one person to pass after badge authentication and prevents two people from entering together. What should be installed?

Accepted Answer

A mantrap between the outer door and the server room entrance. A mantrap is a physical security control with two interlocking doors that enforces one-person entry. After badge authentication at the outer door, the inner door will not unlock until the outer door closes and locks, preventing two people from entering together. This directly addresses tailgating by creating a small vestibule that can only hold one authenticated person at a time.

Answer

A CCTV camera focused on the doorway

Answer

A motion sensor inside the server room

Answer

A standard badge reader with no additional controls

Question 9

System administrators need to manage internal switches from home. The solution must encrypt management traffic, strongly authenticate users, and avoid exposing management ports directly to the internet. What should be used?

Accepted Answer

A VPN into the internal network, then SSH or HTTPS for administration.. A VPN creates an encrypted tunnel over the internet, protecting management traffic in transit. Once connected to the internal network, SSH (for CLI) or HTTPS (for web GUI) provides strong authentication and encryption for switch administration. This approach avoids exposing management ports directly to the internet, reducing the attack surface.

Answer

Telnet over port 23 with an allow list on the firewall.

Answer

RDP directly to the switch management interface from the public IP address.

Answer

Open the management port to the internet and rely on a long password.

Question 10

A company uses a SaaS file-sharing platform for employee documents. Which action is the company's responsibility, not the provider's?

Accepted Answer

Setting user sharing permissions and access controls for company data.. In a SaaS model, the provider manages the underlying infrastructure, including application servers, storage, and hypervisors. The customer is responsible for configuring access controls and permissions for their own data within the application. Option B correctly identifies this shared responsibility boundary.

Answer

Patching the vendor's application servers.

Answer

Replacing failed disks in the provider's storage cluster.

Answer

Maintaining the cloud provider's identity center and hypervisor.

Question 11

The security team configures the badge system so employees must present both a badge and a PIN before entering the data center. The access logs are reviewed weekly for failed attempts. Which pair of control types best describes these measures?

Accepted Answer

Preventive and detective, because one measure blocks access and the other identifies suspicious activity.. The badge and PIN requirement is a preventive control that blocks unauthorized access to the data center, while the weekly review of access logs is a detective control that identifies suspicious activity after the fact. Preventive controls stop incidents before they occur, and detective controls discover violations that have already happened, making this pair the best fit for the described measures.

Answer

Corrective and recovery, because the logs can restore access after a badge failure.

Answer

Deterrent and compensating, because the PIN discourages attackers and the logs replace the badge reader.

Answer

Administrative and physical, because the weekly review and the badge reader are both physical measures.

Question 12

Based on the exhibit, which document type should the organization update if it wants the listed endpoint settings to be mandatory baseline requirements?

Accepted Answer

Standard, because it defines mandatory minimum settings that all systems must meet.. A standard is the correct document type because it defines mandatory, minimum-security configuration requirements that all systems must meet, such as specific endpoint settings. Unlike a policy, which states broad intent, a standard provides the enforceable baseline that ensures consistent security posture across the organization.

Answer

Policy, because it defines the organization's broad security intent and direction.

Answer

Procedure, because it provides the exact steps administrators follow to configure the setting.

Answer

Guideline, because it is the least restrictive document for endpoint protection.

Question 13

Paper onboarding forms have reached the end of their retention period, and no legal hold applies. What should happen next?

Accepted Answer

Destroy them using an approved secure disposal method.. Once paper onboarding forms have reached the end of their retention period and no legal hold applies, the organization must destroy them using an approved secure disposal method (e.g., cross-cut shredding, pulping, or incineration) to prevent unauthorized access to personally identifiable information (PII) and comply with data protection regulations such as GDPR or HIPAA. Retaining data beyond its required lifecycle violates the data minimization principle and increases breach risk.

Answer

Store them indefinitely in case the company needs them later.

Answer

Scan them to a personal cloud account so they are not lost.

Answer

Mail copies to every manager for review before disposal.

Question 14

A developer finds a production bug on Friday afternoon. The fix has already passed staging, but the business wants the release to be reversible if the hotfix causes trouble. Which change-management practice best satisfies both speed and control?

Accepted Answer

Use an emergency change with a documented rollback plan and approval. An emergency change with a documented rollback plan and approval provides the fastest path to production while maintaining control. This practice aligns with ITIL's emergency change advisory board (ECAB) process, which allows expedited approval for critical fixes while requiring a tested rollback procedure to ensure reversibility. The business's requirement for speed is met by bypassing the normal change window, and control is preserved through mandatory documentation and approval.

Answer

Bypass change control so the patch reaches production immediately

Answer

Wait for the next normal change window next week

Answer

Freeze all production changes until the next monthly review meeting

Question 15

EDR alerts show a finance laptop spawning an unsigned executable from %AppData%, attempting to read LSASS memory, and making outbound HTTPS connections to a rare domain. The user says they only opened a spreadsheet attachment. What is the best immediate action?

Accepted Answer

Isolate the laptop from the network using the EDR platform.. The EDR alerts indicate a likely credential theft attempt (LSASS read) and C2 communication (rare domain). Isolating the laptop immediately stops data exfiltration and lateral movement, which is the priority before any remediation. Reboot, scan, or password reset would not prevent the attacker from already having access to credentials or the network.

Answer

Reboot the laptop to clear any malicious process from memory.

Answer

Run a full antivirus scan and wait for the results before taking further action.

Answer

Reset the user's password and keep the laptop online for monitoring.