SY0-701 Practice Test 18 — 15 Questions

Question 1

A SaaS vendor supports both browser access and a mobile app. The company wants employees to sign in with corporate credentials, avoid separate passwords for each app, and use token-based authentication that works well with modern APIs. Which integration should the architect choose?

Accepted Answer

OpenID Connect federation with the corporate identity provider.. OpenID Connect (OIDC) is the correct choice because it is an identity layer built on top of OAuth 2.0, designed for token-based authentication that works seamlessly with modern REST APIs and mobile apps. It allows employees to sign in with corporate credentials via the corporate identity provider (IdP), eliminates separate app passwords, and issues ID tokens (JWT) and access tokens that the SaaS vendor can validate without browser redirects.

Answer

SAML federation to the SaaS vendor using browser assertions only.

Answer

LDAP bind authentication directly against each SaaS application.

Answer

Kerberos tickets issued directly by the SaaS vendor.

Question 2

A help desk technician receives a phone call from someone who claims to be the CFO. The caller knows the executive team structure, says they are traveling, and insists the technician reset MFA to 'avoid delaying a wire transfer.' Which social engineering technique is the caller primarily using?

Accepted Answer

Pretexting, because the caller builds a believable story to manipulate the employee. The caller is using pretexting because they have fabricated a scenario (the CFO traveling and needing an urgent wire transfer) and assumed a false identity to manipulate the help desk technician into resetting MFA. Pretexting relies on a crafted story or pretext to gain trust and bypass security controls, which is exactly what the caller is doing here.

Answer

Baiting, because the caller is offering something valuable in exchange for action

Answer

Vishing, because the attack happens by voice call

Answer

Smishing, because the attacker is using a mobile device

Question 3

A monthly scan finds a critical remote-code-execution issue on an internet-facing VPN appliance. The vendor has released a fix, but the appliance can only be rebooted during the weekend maintenance window in five days. What is the BEST immediate action to lower risk until patching can occur?

Accepted Answer

Apply a compensating control such as restricting access to trusted source IPs and disabling nonessential remote access features. Option A is correct because applying a compensating control—such as restricting access to trusted source IPs via an ACL and disabling nonessential remote access features like unused VPN protocols or administrative interfaces—immediately reduces the attack surface. This mitigates the risk of exploitation of the remote-code-execution vulnerability on the internet-facing VPN appliance until the vendor patch can be applied during the scheduled maintenance window. The key is to implement network-layer controls that block untrusted sources from reaching the vulnerable service, buying time without requiring a reboot.

Answer

Wait for the weekend because the exploit is not confirmed

Answer

Remove logging from the appliance to improve performance during the wait

Answer

Run another scan every hour and do nothing else

Question 4

A regulated workload must run in the cloud with the strongest possible isolation from other tenants, and the company wants to avoid managing its own physical hardware. Which placement is the best fit?

Accepted Answer

Use a dedicated host so the underlying hardware is allocated to one customer only.. A dedicated host provides the strongest possible isolation by ensuring that the physical server is not shared with any other tenant. This meets the requirement for a regulated workload without the company managing its own hardware, as the cloud provider still handles maintenance and patching.

Answer

Use a shared tenancy instance with tighter security groups and a private subnet.

Answer

Move the workload into a public subnet so the provider can inspect traffic more easily.

Answer

Use a container within a shared platform because containers always isolate tenants completely.

Question 5

A new SIEM rule generates many alerts from a scheduled backup job that is known to be legitimate. What should the analyst do to improve alert quality?

Accepted Answer

Tune the rule to exclude the known backup activity pattern.. Option B is correct because tuning the SIEM rule to exclude the known backup activity pattern reduces false positives while preserving detection of actual threats. By creating an exception for the specific backup server's IP, schedule, or process hash, the analyst maintains visibility into anomalous behavior without being overwhelmed by noise.

Answer

Disable all logging for the backup server.

Answer

Ignore the alerts permanently because the job is approved.

Answer

Reimage the backup server to stop the alerts.

Question 6

A security analyst is reviewing network flow logs and notices a series of outbound connections from a single internal workstation to an external IP address on TCP port 443. The connections occur every 5 minutes, each lasting about 2 seconds, and the amount of data transferred per connection is consistently around 1 KB. The workstation's user reports no unusual activity. The analyst checks the host's EDR logs and sees no malicious processes or known indicators. Which type of activity is this pattern most consistent with?

Accepted Answer

Beaconing to a command-and-control server. This pattern is most consistent with beaconing to a command-and-control (C2) server because the connections are periodic (every 5 minutes), short-lived (2 seconds), and consistently transfer a small amount of data (~1 KB) over HTTPS (TCP 443). These characteristics—regular intervals, low data volume, and stealthy use of encrypted channels—are hallmarks of C2 beaconing used by malware to maintain persistence and receive instructions without raising immediate suspicion.

Answer

Normal software update check

Answer

DNS tunneling

Answer

Data exfiltration via HTTPS

Question 7

A scan keeps reporting the same medium-severity TLS configuration issue on a public web server. The application owner says the vendor software cannot be changed until next quarter, but they can place the service behind a reverse proxy that enforces stronger cipher settings. How should the issue be handled in the vulnerability management process?

Accepted Answer

Record an exception, document the compensating control, and set a review or remediation date. Option B is correct because the vulnerability management process requires that when a vulnerability cannot be immediately remediated, compensating controls must be formally documented as an exception with a scheduled remediation date. In this scenario, the reverse proxy enforces stronger cipher settings, effectively mitigating the TLS misconfiguration at the network edge, which is a valid compensating control. Recording the exception ensures auditability and prevents the finding from being prematurely closed while the vendor software remains vulnerable.

Answer

Close the finding as fixed because the reverse proxy reduces the risk

Answer

Mark the finding as a false positive and remove it from future scans

Answer

Ignore the finding until the vendor releases a new version

Question 8

A Linux server is missing expected security-agent processes, but users can still connect to the application. Local command output does not show a suspicious daemon that another monitoring tool says is listening on port 4444. A raw disk scan reveals a kernel module loaded at boot, and several files appear only when viewed outside the normal operating system tools. What malware type is most likely?

Accepted Answer

Rootkit, because kernel-level components are hiding processes and files from normal user-mode visibility.. Option C is correct because the scenario describes a rootkit: a kernel-level rootkit can load a malicious kernel module at boot, intercept system calls (e.g., `open`, `readdir`, `netstat`), and hide processes, files, and network listeners from user-mode tools like `ps`, `ls`, or `netstat`. The raw disk scan reveals files invisible to normal OS tools, and the missing security-agent processes and hidden daemon on port 4444 are classic signs of kernel-mode hooking that bypasses standard visibility.

Answer

Trojan, because it could have introduced the suspicious service after the initial compromise.

Answer

Spyware, because it may collect data while leaving the application functional.

Answer

Logic bomb, because the malware activates after startup and changes what administrators see.

Question 9

A records manager is preparing to delete old HR emails next week under the retention schedule. Legal notifies the team that those messages may be needed for an active investigation. What should the records manager do first?

Accepted Answer

Place the emails on legal hold and suspend normal deletion for those records.. When legal notifies that emails may be needed for an active investigation, the records manager must immediately suspend normal deletion and place a legal hold on those records. This preserves the data in its original state, preventing spoliation and ensuring compliance with e-discovery obligations. Deleting or moving the emails could destroy metadata or chain of custody, violating legal hold requirements.

Answer

Delete the emails on schedule and archive only the subject lines.

Answer

Move the emails to a shared folder so legal can review them later.

Answer

Compress the emails into an encrypted file and continue with deletion.

Question 10

A security analyst is reviewing logs after a successful phishing attack. The attacker used a fake login page that mimicked the company's single sign-on portal to harvest usernames and passwords. The attacker then used the stolen credentials to access the corporate email system. Which type of attack best describes the initial compromise?

Accepted Answer

Credential harvesting via phishing. The initial compromise was achieved by luring the victim to a fake login page that mimicked the company's single sign-on portal, which is a classic phishing technique. The attacker harvested the credentials directly from the user's submission, making this a credential harvesting attack via phishing. This aligns with the definition of phishing as a social engineering attack that uses deception to obtain sensitive information, distinct from brute-force or password spraying which rely on guessing or trying multiple passwords.

Answer

On-path attack

Answer

Brute-force attack

Answer

Password spraying

Question 11

A security analyst is monitoring logs from the cloud access security broker (CASB) and observes that a user account downloaded 500 GB of data from a highly sensitive SharePoint document library within a single hour. The user's historical baseline shows an average daily download of less than 10 MB. Additionally, the log shows the session originated from an IP address in a country where the company has no employees or business operations. Which of the following actions is the most appropriate for the analyst to take?

Accepted Answer

Initiate the organization's incident response process for a potential data exfiltration event.. Option C is correct because the combination of a massive data download (500 GB vs. a 10 MB baseline) and a session originating from a country with no business presence strongly indicates a potential data exfiltration event. Initiating the incident response process ensures that the organization follows a structured, documented procedure to contain, analyze, and remediate the threat, preserving forensic evidence and coordinating response actions. The CASB log provides the initial indicators, but the incident response plan is the appropriate framework for handling such high-risk anomalies.

Answer

Immediately block the user account and the source IP address at the CASB.

Answer

Contact the user directly by phone to verify whether they initiated the download.

Answer

Disable the SharePoint document library and remove all user permissions to prevent further data loss.

Question 12

A security analyst discovers that an attacker maintained persistent access to a corporate network for six months, moving laterally between systems and exfiltrating sensitive data. The attacker used custom malware that evaded antivirus and established multiple backdoors. Which of the following best describes this type of threat actor and their campaign?

Accepted Answer

Advanced persistent threat (APT). The scenario describes a threat actor that maintained stealthy, long-term access to a network, moved laterally, and exfiltrated data over six months using custom malware that evaded antivirus. This aligns with the definition of an Advanced Persistent Threat (APT), which is a sophisticated, well-resourced adversary that conducts prolonged, targeted campaigns to achieve specific objectives, often espionage or data theft.

Answer

Insider threat

Answer

Zero‑day exploit

Answer

Denial of service (DoS) attack

Question 13

A security analyst in the SOC is reviewing an alert from the corporate VPN server. The alert indicates that user 'jsmith' authenticated successfully from an IP address in Brazil at 14:30 UTC. The analyst contacts jsmith, who confirms he is physically in the company's headquarters in Chicago and has not remotely accessed the VPN today. The VPN authentication logs show that jsmith's session used a valid smart card certificate for authentication. The analyst checks the certificate revocation list and finds that jsmith's certificate has not been revoked. Which of the following is the most likely explanation for this event?

Accepted Answer

The user's smart card and PIN were stolen, allowing an attacker to authenticate from Brazil.. Option A is correct because the scenario describes a successful VPN authentication using a valid smart card certificate from a location (Brazil) that the legitimate user (jsmith) denies accessing. Since the certificate was not revoked and the smart card requires both the card and PIN for use, the most plausible explanation is that both were stolen, enabling an attacker to authenticate as jsmith. The certificate revocation list (CRL) check confirms the certificate is still valid, ruling out revocation-based defenses, and the user's physical presence in Chicago eliminates the possibility of a legitimate remote session.

Answer

An attacker performed a pass-the-hash attack using cached credentials from jsmith's workstation.

Answer

The VPN server's certificate was forged, allowing the attacker to intercept jsmith's credentials.

Answer

The user's account password was guessed through a brute-force attack and then used to create a new certificate.

Question 14

A payment processor stores full card numbers in its transaction database, but developers and analysts should never see the real numbers in nonproduction reports or troubleshooting tools. The business still needs to correlate the same card across multiple records. Which technique is the best fit?

Accepted Answer

Tokenization, because it replaces the real value with a surrogate token for business use.. Tokenization is the best fit because it replaces the full card number with a unique, non-reversible surrogate token that retains the ability to correlate records (the same card always produces the same token). This allows the business to perform analytics and troubleshooting without exposing the actual sensitive data, as the token has no mathematical relationship to the original PAN and cannot be reversed.

Answer

Hashing, because the output can always be reversed by the application later.

Answer

Data masking, because it permanently deletes the sensitive record from the database.

Answer

Compression, because reducing file size also hides the payment information from users.

Question 15

A security analyst notices repeated attempts to copy large amounts of data to USB drives from a user's workstation. The analyst suspects the user may be exfiltrating company proprietary data. The company wants to implement a technical control that can both detect and block such data exfiltration without completely disabling all USB ports, as some users require USB for authorized work. Which of the following would best meet this requirement?

Accepted Answer

Deploy a data loss prevention (DLP) agent configured with rules to monitor and block unauthorized data transfers to removable media.. Option B is correct because a Data Loss Prevention (DLP) agent can be configured with granular rules to monitor and block unauthorized data transfers to removable media (e.g., USB drives) based on content inspection, file type, or volume thresholds. This allows authorized USB usage while preventing exfiltration of proprietary data, meeting the requirement for both detection and blocking without disabling all USB ports.

Answer

Implement a host-based intrusion detection system (HIDS) that alerts on USB insertion events.

Answer

Enable BitLocker encryption on all USB drives to prevent unauthorized data access.

Answer

Configure the local group policy to disable all USB ports on all workstations.