SY0-701 Practice Test 18 — 15 Questions

Question 1

A systems administrator says the backup software reports success every night, but no one has restored a server from backup in over a year. The business wants confidence that a file server can be recovered within the agreed recovery window. What is the best next action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a scheduled restore test in an isolated environment and measure the recovery time.. The only way to validate that backups are both restorable and meet the recovery time objective (RTO) is to perform a scheduled restore test in an isolated environment. Backup success logs only confirm that data was copied, not that the data is intact or that the restoration process completes within the agreed window. This aligns with the 3-2-1 backup rule and the principle of 'trust but verify' in backup validation.

Answer

Trust the success status because completed jobs prove the backups are usable.

Answer

Delete older backups so that only the most recent set remains.

Answer

Extend retention indefinitely to avoid ever losing a recoverable copy.

Question 2

A file-sharing portal uses a download URL like /download?file=12345. A tester changes the value to 12346 and can access another department's document without logging in again. Which control most directly prevents this issue?

Accepted Answer

Implement server-side authorization checks for every object request.. The issue is that the server trusts the file identifier in the URL without verifying that the authenticated user is authorized to access the requested resource. Implementing server-side authorization checks for every object request ensures that before serving any file, the server validates whether the current session or user has explicit permission to access that specific document. This directly prevents the IDOR (Insecure Direct Object Reference) vulnerability demonstrated by the tester.

Answer

Make the identifier longer so users cannot guess nearby values.

Answer

Move the portal to HTTPS so request parameters cannot be intercepted.

Answer

Store the document name in a hidden field and validate it in JavaScript.

Question 3

Based on the exhibit, what additional control is the best fit?

Current controls on the finance share:
- SMB signing enabled
- Weekly access review
- Nightly backups to immutable storage
- Antivirus scans at 02:00

Incident: a valid VPN account was used to access 40,000 files in 8 minutes and copy them to a local drive.
Goal: detect unauthorized bulk access quickly before exfiltration completes.

Accepted Answer

Add file access auditing with alert thresholds forwarded to the SIEM.. File access auditing with alert thresholds forwarded to the SIEM directly addresses the goal of detecting unauthorized bulk access quickly. By monitoring for abnormal file access patterns—such as 40,000 files in 8 minutes—the SIEM can trigger an alert before exfiltration completes, enabling rapid response. This control complements the existing weekly access review by providing real-time detection.

Answer

Increase the backup schedule from nightly to hourly.

Answer

Rename the share to a less obvious name.

Answer

Disable SMB signing so the file transfer runs faster.

Question 4

NetFlow shows one workstation initiating SMB and WinRM sessions to 25 internal servers within 12 minutes, followed by a spike in Kerberos authentication requests and attempts to access admin shares. The user says they only opened an invoice spreadsheet. What is the most likely attacker objective?

Accepted Answer

Lateral movement using compromised credentials to pivot across the environment.. The observed behavior—a single workstation initiating SMB and WinRM sessions to 25 internal servers in rapid succession, followed by a spike in Kerberos authentication requests and attempts to access admin shares—is a classic indicator of lateral movement using compromised credentials. The attacker likely obtained the user's credentials (e.g., via phishing in the invoice spreadsheet) and is using them to authenticate to multiple servers via WinRM for remote command execution and SMB for file access, with the Kerberos spike reflecting TGT/TGS requests as they pivot across the environment to escalate privileges or deploy ransomware.

Answer

Distributed denial-of-service activity against the internal network.

Answer

Port scanning from an external attacker trying to enumerate exposed services.

Answer

DNS tunneling used to bypass content filtering and exfiltrate data.

Question 5

Threat intelligence reports that an adversary changes domains daily and uses disposable cloud hosting, but the malware binary hash and a unique mutex name remain unchanged across incidents. Which indicator is the best candidate for immediate detection rule creation?

Accepted Answer

The malware file hash, because it directly identifies the reused sample.. The malware file hash (e.g., SHA-256) provides a static, deterministic identifier for the exact binary sample. Since the adversary reuses the same malware binary across incidents, the hash remains unchanged and can be used to create a precise detection rule (e.g., a YARA rule or hash-based IOC blocklist) that will reliably match the malicious file regardless of network-level churn like domain or IP changes.

Answer

The daily domain names, because they are the easiest items to collect.

Answer

The cloud provider name, because the attacker uses disposable infrastructure.

Answer

The time of day the campaign was observed, because the attacker is consistent.

Question 6

A team is moving an application to a cloud provider. The cloud provider will secure the physical data center and core infrastructure, while the company must still secure its own application settings and user access. What concept does this describe?

Accepted Answer

Shared responsibility model. The shared responsibility model defines the division of security obligations between a cloud provider and its customer. In this scenario, the provider secures the physical data center and core infrastructure (the 'security of the cloud'), while the company retains responsibility for application settings and user access (the 'security in the cloud'). This model is foundational to all major cloud providers, including AWS, Azure, and Google Cloud.

Answer

Fail-open design

Answer

Air gap

Answer

Data masking

Question 7

During malware response on a finance workstation, the system is still powered on and connected. The manager asks whether you can just reboot it to stop the issue. What is the best next step?

Accepted Answer

Capture volatile evidence and document the system state before containment actions.. In incident response, the first priority when a system is still powered on is to capture volatile evidence (e.g., memory contents, running processes, network connections) before any containment actions like rebooting. Rebooting would destroy this critical data, which may be essential for forensic analysis and understanding the malware's behavior. The order of volatility (RFC 3227) dictates that volatile data must be collected first to preserve evidence integrity.

Answer

Reboot immediately to prevent any further damage from the suspected malware.

Answer

Copy suspicious files to a shared drive and continue normal operations.

Answer

Run a full disk cleanup to remove temporary files and reduce risk.

Question 8

A user enters `` into a public comment field, and other visitors see the script run in their browsers. What attack is this?

Accepted Answer

Cross-site scripting. This is a classic cross-site scripting (XSS) attack because the user-supplied input containing a script tag is echoed back to other visitors' browsers without proper sanitization or encoding. The script executes in the context of the victim's browser, allowing the attacker to steal cookies, redirect users, or deface the page. XSS exploits the trust a user has for a particular website, unlike SQL injection which targets the database.

Answer

SQL injection

Answer

Broken authentication

Answer

Insecure deserialization

Question 9

A web application lets users save a profile "display name." One employee enters a value that contains script code, and later other users who view that profile start seeing pop-ups and redirects to a fake login page. Which attack is most likely occurring?

Accepted Answer

Cross-site scripting, because untrusted content is executed in another user's browser context.. The employee's display name containing script code is stored in the database and later rendered in the browsers of other users without proper sanitization. This is a classic stored cross-site scripting (XSS) attack, where untrusted user input is executed as HTML/JavaScript in the context of another user's session, leading to pop-ups and redirects to a fake login page.

Answer

SQL injection, because the database is being queried with unsafe concatenated input.

Answer

Cross-site request forgery, because the attacker is forcing the victim to submit a form automatically.

Answer

Broken authentication, because the login system is failing to verify usernames correctly.

Question 10

A person wearing a contractor badge asks reception to let them into the office because they forgot their access card and say they are expected for a server maintenance visit. What social engineering technique is most likely?

Accepted Answer

Pretexting. Pretexting is correct because the attacker creates a fabricated scenario (the 'pretext') of being a contractor on a server maintenance visit to gain unauthorized physical access. The use of a contractor badge and the claim of a forgotten access card are designed to exploit the receptionist's trust and willingness to help, bypassing security controls without technical hacking.

Answer

Baiting

Answer

Smishing

Answer

Ransomware

Question 11

A cloud-hosted invoicing app has a critical vulnerability, but the vendor says a patch will not be available for six weeks. The team adds a web application firewall rule, restricts access to the app subnet, and increases monitoring until the patch arrives. What is this best described as?

Accepted Answer

Compensating control, because temporary safeguards reduce exposure until the patch is available.. The team deployed temporary security measures—a web application firewall (WAF) rule, subnet access restrictions, and enhanced monitoring—to reduce the risk exposure while waiting for the vendor's patch. These are compensating controls, which are alternative safeguards that mitigate a vulnerability when the primary control (the patch) cannot be implemented immediately. The scenario explicitly states the patch is six weeks away, making these interim measures a textbook compensating control.

Answer

Risk avoidance, because the system is being shut down permanently.

Answer

Risk transfer, because the vendor is responsible for the vulnerability.

Answer

Residual risk acceptance, because the vulnerability is being ignored until next quarter.

Question 12

A SOC analyst reviews an EDR alert showing powershell.exe launched with an encoded command, then immediately connected to an unfamiliar IP address and spawned rundll32.exe. The user is still logged in and the machine may still contain evidence needed for investigation. Which two actions should the analyst take first to contain the incident while preserving evidence? Select two.

Accepted Answer

Isolate the endpoint using EDR network containment or a quarantine policy.. Isolating the endpoint via EDR network containment or quarantine policy immediately stops the malicious process from communicating with the command-and-control (C2) server at the unfamiliar IP address, preventing data exfiltration and lateral movement. This action preserves the volatile evidence in memory (e.g., the spawned rundll32.exe process) and on disk, allowing forensic analysis without the risk of the attacker destroying evidence remotely.

Answer

Reboot the workstation immediately to clear any malicious process from memory.

Answer

Run a full vulnerability scan before taking any other action.

Answer

Delete the suspicious email from the mailbox to remove the original payload.

Question 13

A support team wants to export customer tickets into a test analytics environment so developers can search real examples while minimizing privacy exposure. The exported data includes names, email addresses, and account IDs that are not needed for the test. What is the best first step?

Accepted Answer

Remove or tokenize unneeded personal identifiers before export. Data minimization is a core privacy principle: before exporting data to a test environment, any personally identifiable information (PII) not required for the analytics task should be removed or tokenized. This reduces the attack surface and ensures compliance with privacy regulations (e.g., GDPR, CCPA) without sacrificing the utility of the real customer ticket examples.

Answer

Export the full dataset and restrict access with a shared password

Answer

Keep the data unchanged because the test environment is internal

Answer

Store the export indefinitely because development data is exempt from retention rules

Question 14

SIEM alerts show one workstation making SMB connections to 30 internal hosts within 10 minutes, followed by remote service creation and repeated access attempts to admin shares. The workstation also begins authenticating with several privileged accounts. What is the most likely activity?

Accepted Answer

Lateral movement after credential compromise or endpoint takeover.. The sequence of SMB connections to many internal hosts, followed by remote service creation and repeated access attempts to admin shares, combined with authentication using privileged accounts, is the classic pattern of lateral movement. This indicates the attacker has already compromised the workstation (endpoint takeover) or obtained valid credentials and is now using SMB and PsExec-like techniques to move laterally across the network, escalate privileges, and establish persistence.

Answer

A distributed denial-of-service attack launched from a compromised internal host.

Answer

DNS tunneling used to exfiltrate data through allowed name-resolution traffic.

Answer

ARP spoofing to redirect local traffic at the network layer.

Question 15

Based on the exhibit, what is the most likely explanation for the suspicious workstation activity?

Accepted Answer

Fileless attack. The exhibit shows a PowerShell command that downloads and executes a payload directly in memory without writing to disk. This is a classic indicator of a fileless attack, where malicious code runs in volatile memory (e.g., via PowerShell, WMI, or macros) to evade traditional file-based antivirus detection. The use of `Invoke-Expression` (IEX) with a remote URL confirms the attack vector is fileless.

Answer

Ransomware campaign

Answer

Worm propagation

Answer

Rootkit persistence