SY0-701 Practice Test 17 — 15 Questions

Question 1

Based on the exhibit, which document type should the organization update if it wants the listed endpoint settings to be mandatory baseline requirements?

Accepted Answer

Standard, because it defines mandatory minimum settings that all systems must meet.. A standard is the correct document type because it defines mandatory, minimum-security configuration requirements that all systems must meet, such as specific endpoint settings. Unlike a policy, which states broad intent, a standard provides the enforceable baseline that ensures consistent security posture across the organization.

Answer

Policy, because it defines the organization's broad security intent and direction.

Answer

Procedure, because it provides the exact steps administrators follow to configure the setting.

Answer

Guideline, because it is the least restrictive document for endpoint protection.

Question 2

Paper onboarding forms have reached the end of their retention period, and no legal hold applies. What should happen next?

Accepted Answer

Destroy them using an approved secure disposal method.. Once paper onboarding forms have reached the end of their retention period and no legal hold applies, the organization must destroy them using an approved secure disposal method (e.g., cross-cut shredding, pulping, or incineration) to prevent unauthorized access to personally identifiable information (PII) and comply with data protection regulations such as GDPR or HIPAA. Retaining data beyond its required lifecycle violates the data minimization principle and increases breach risk.

Answer

Store them indefinitely in case the company needs them later.

Answer

Scan them to a personal cloud account so they are not lost.

Answer

Mail copies to every manager for review before disposal.

Question 3

A developer finds a production bug on Friday afternoon. The fix has already passed staging, but the business wants the release to be reversible if the hotfix causes trouble. Which change-management practice best satisfies both speed and control?

Accepted Answer

Use an emergency change with a documented rollback plan and approval. An emergency change with a documented rollback plan and approval provides the fastest path to production while maintaining control. This practice aligns with ITIL's emergency change advisory board (ECAB) process, which allows expedited approval for critical fixes while requiring a tested rollback procedure to ensure reversibility. The business's requirement for speed is met by bypassing the normal change window, and control is preserved through mandatory documentation and approval.

Answer

Bypass change control so the patch reaches production immediately

Answer

Wait for the next normal change window next week

Answer

Freeze all production changes until the next monthly review meeting

Question 4

EDR alerts show a finance laptop spawning an unsigned executable from %AppData%, attempting to read LSASS memory, and making outbound HTTPS connections to a rare domain. The user says they only opened a spreadsheet attachment. What is the best immediate action?

Accepted Answer

Isolate the laptop from the network using the EDR platform.. The EDR alerts indicate a likely credential theft attempt (LSASS read) and C2 communication (rare domain). Isolating the laptop immediately stops data exfiltration and lateral movement, which is the priority before any remediation. Reboot, scan, or password reset would not prevent the attacker from already having access to credentials or the network.

Answer

Reboot the laptop to clear any malicious process from memory.

Answer

Run a full antivirus scan and wait for the results before taking further action.

Answer

Reset the user's password and keep the laptop online for monitoring.

Question 5

After seizing a suspected insider's laptop, a responder makes a bit-for-bit image of the drive. The legal team asks what step most directly proves the image was not altered after acquisition. What should be done?

Accepted Answer

Compute and document cryptographic hashes of the source media and the forensic image.. Computing and documenting cryptographic hashes (e.g., SHA-256 or MD5) of both the source media and the forensic image immediately after acquisition creates a verifiable digital fingerprint. If the hash values match, it proves that the image is an exact, unaltered copy of the original drive. This step is foundational to maintaining the chain of custody and ensuring data integrity in forensic investigations.

Answer

Record the laptop's hostname and the user who last logged in.

Answer

Copy the most recent files to a USB drive for quick review.

Answer

Return the laptop to the user once the image is saved.

Question 6

A SOC analyst confirms that an employee entered credentials into a phishing site and that the mailbox now shows a new forwarding rule sending messages to an external address. The account is still signed in on a laptop and a mobile phone. What is the best next action?

Accepted Answer

Revoke active sessions and force a password reset for the account.. The immediate priority is to contain the compromised account by terminating all active sessions (revoking OAuth tokens, clearing SAML sessions) and forcing a password reset to prevent further unauthorized access. The mailbox forwarding rule indicates the attacker has established persistence, and the active sessions on the laptop and mobile phone mean the attacker could still be using the account. Revoking sessions ensures the attacker cannot continue exfiltration or lateral movement, while the password reset invalidates the stolen credentials.

Answer

Wait for the user to log out naturally before taking action.

Answer

Archive the mailbox and close the ticket after notifying the user.

Answer

Delete the forwarding rule only and consider the incident closed.

Question 7

During a conference, several employees connect to a wireless network named the same as the hotel's guest Wi-Fi. Shortly after connecting, they receive certificate warnings when accessing the company portal, and packet capture shows a nearby laptop advertising the same SSID and relaying traffic. What type of attack is most likely?

Accepted Answer

Rogue access point or evil twin attack, because a fake wireless network impersonates a legitimate one.. The attack described is an evil twin (a type of rogue access point) because the attacker sets up a laptop broadcasting the same SSID as the hotel's legitimate guest Wi-Fi. When employees connect to this fake network, the attacker can intercept traffic and present a fraudulent certificate for the company portal, triggering certificate warnings. The packet capture confirming the laptop is relaying traffic proves it is acting as a man-in-the-middle, not merely a passive listener.

Answer

Replay attack, because previously captured wireless frames are being resent to the network.

Answer

DNS poisoning, because users are being sent to the wrong website through altered name resolution.

Answer

Denial of service, because users are simply unable to connect reliably.

Question 8

Based on the exhibit, which control should be enabled so corporate data stays separated from personal data on company-owned tablets?

Accepted Answer

Enable a work profile or container with selective wipe for corporate data.. A work profile or container (e.g., Android Work Profile or iOS Managed Open In) creates a separate, encrypted partition for corporate data on the device. This allows IT to perform a selective wipe of only the corporate data without affecting the user's personal apps, photos, or settings, ensuring data separation while preserving user privacy.

Answer

Perform a full-device wipe any time a tablet is lost or reassigned.

Answer

Deploy mobile threat defense scanning on every tablet.

Answer

Disable Bluetooth and the camera on all tablets to stop data leakage.

Question 9

After a facilities outage, multiple employees report that their phones automatically joined a network named "CorpWiFi" in the lobby even though the legitimate access point was offline. A nearby attacker device then captured the captive portal login traffic. What attack is most likely?

Accepted Answer

Evil twin. Evil twin. In this scenario, the attacker set up a rogue access point with the same SSID ("CorpWiFi") as the legitimate network, which was offline. When employees' phones automatically attempted to reconnect to a known SSID, they associated with the attacker's device, which then presented a fake captive portal to capture login credentials. This is the classic definition of an evil twin attack: a fraudulent AP that mimics a legitimate one to intercept traffic.

Answer

Rogue access point

Answer

Bluetooth bluejacking

Answer

NFC relay attack

Question 10

A manufacturer needs to grant a partner company access to a procurement portal. Partner users should authenticate with their own identity provider, and the manufacturer does not want to create local passwords for each partner employee. Which design best supports this?

Accepted Answer

Establish federation with SAML or OIDC and support just-in-time provisioning for partner users.. Federation with SAML or OIDC allows the partner company to use its own identity provider for authentication, eliminating the need for local passwords. Just-in-time provisioning automatically creates user accounts in the manufacturer's procurement portal upon first successful authentication, ensuring access is granted without manual account management. This design supports secure cross-organization trust without sharing credentials or maintaining duplicate user stores.

Answer

Create local accounts for every partner user and reset passwords manually when staff changes occur.

Answer

Share one VPN credential with the partner organization and let them manage access internally.

Answer

Use NTLM pass-through authentication to avoid setting up trust relationships.

Question 11

A privileged account is used on a jump box at 02:15, and the SIEM shows multiple interactive logons from the same account to different servers within 10 minutes. The administrator says they used a password vault for the session. Which log source best confirms whether the access was authorized?

Accepted Answer

Privileged access management or password vault audit logs. The privileged access management (PAM) or password vault audit logs are the definitive source because they record exactly when a password was checked out, which user performed the checkout, and the specific session ID or ticket associated with the jump box use. Since the administrator claims the password vault was used, these logs will show the checkout event at 02:15 and the subsequent interactive logons, confirming whether the vault authorized the session. No other log source can tie the authentication to the vault's approval process.

Answer

DHCP lease logs from the jump box subnet

Answer

Printer server logs for the operations department

Answer

Web proxy logs for outbound browsing activity

Question 12

An internal file server has an administrative web console exposed on the same network as all user laptops. A scan shows that any authenticated employee can reach the console, and several failed login attempts are coming from a workstation that should never manage servers. What is the best hardening action?

Accepted Answer

Move the console to a separate management network and restrict access to admin hosts only.. The administrative web console should be isolated on a separate management network (out-of-band management) with strict access control lists (ACLs) allowing only designated admin hosts. This prevents lateral movement from compromised user workstations and eliminates the attack surface exposed to all authenticated employees. Network segmentation is a fundamental defense-in-depth control for managing critical infrastructure, as it enforces the principle of least privilege at the network layer.

Answer

Increase the number of shared passwords so administrators can log in faster.

Answer

Leave the console exposed but shorten the password expiration period.

Answer

Disable logging so failed attempts do not generate noise.

Question 13

After a phishing account compromise has been contained and the attacker’s mailbox forwarding rule was removed, what should the team do next?

Accepted Answer

Reset credentials and verify there are no other persistence methods before recovery.. After removing a mailbox forwarding rule, the team must reset the compromised account's credentials and verify that no other persistence mechanisms (e.g., additional forwarding rules, OAuth app grants, or mailbox delegation) remain. This ensures the attacker cannot regain access using cached credentials or alternate backdoors, which is critical before returning the account to production.

Answer

Stop the investigation because the forwarding rule was deleted.

Answer

Close the ticket and tell the user to be more careful next time.

Answer

Wait one week before taking any action so the attacker does not notice.

Question 14

A critical vulnerability is discovered on an internet-facing VPN appliance that cannot be patched for six weeks because the vendor has not released a fix. The VPN service must remain available. What is the best operational response?

Accepted Answer

Apply compensating controls such as restricting source IPs and increasing monitoring.. When a vulnerability cannot be patched immediately, compensating controls such as restricting source IPs via ACLs and increasing monitoring (e.g., enabling detailed logging and alerting on anomalous traffic) reduce the attack surface and improve detection of exploitation attempts. This approach maintains service availability while mitigating risk until the vendor releases a fix.

Answer

Leave the appliance unchanged until the vendor releases a patch.

Answer

Disable all logging so the appliance performs better under load.

Answer

Replace the VPN with a less secure remote access method to avoid the vulnerability.

Question 15

The service desk needs a document that tells analysts exactly how to verify a caller and reset a password for a locked account. Which document type should they use?

Accepted Answer

Procedure, because it provides exact steps staff must follow in order. A procedure is the correct document type because it provides a step-by-step sequence of actions that staff must follow to complete a specific operational task, such as verifying a caller's identity and resetting a password. Unlike policies or standards, procedures are mandatory and detail the exact commands, verification checks, and escalation paths required to ensure consistent and secure execution of the task.

Answer

Policy, because it states the organization's high-level security expectations

Answer

Guideline, because it offers helpful suggestions that staff may choose to follow

Answer

Standard, because it defines a general topic without operational detail