SY0-701 Practice Test 18 — 15 Questions

Question 1

After seizing a suspected insider's laptop, a responder makes a bit-for-bit image of the drive. The legal team asks what step most directly proves the image was not altered after acquisition. What should be done?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Compute and document cryptographic hashes of the source media and the forensic image.. Computing and documenting cryptographic hashes (e.g., SHA-256 or MD5) of both the source media and the forensic image immediately after acquisition creates a verifiable digital fingerprint. If the hash values match, it proves that the image is an exact, unaltered copy of the original drive. This step is foundational to maintaining the chain of custody and ensuring data integrity in forensic investigations.

Answer

Record the laptop's hostname and the user who last logged in.

Answer

Copy the most recent files to a USB drive for quick review.

Answer

Return the laptop to the user once the image is saved.

Question 2

A SOC analyst confirms that an employee entered credentials into a phishing site and that the mailbox now shows a new forwarding rule sending messages to an external address. The account is still signed in on a laptop and a mobile phone. What is the best next action?

Accepted Answer

Revoke active sessions and force a password reset for the account.. The immediate priority is to contain the compromised account by terminating all active sessions (revoking OAuth tokens, clearing SAML sessions) and forcing a password reset to prevent further unauthorized access. The mailbox forwarding rule indicates the attacker has established persistence, and the active sessions on the laptop and mobile phone mean the attacker could still be using the account. Revoking sessions ensures the attacker cannot continue exfiltration or lateral movement, while the password reset invalidates the stolen credentials.

Answer

Wait for the user to log out naturally before taking action.

Answer

Archive the mailbox and close the ticket after notifying the user.

Answer

Delete the forwarding rule only and consider the incident closed.

Question 3

During a conference, several employees connect to a wireless network named the same as the hotel's guest Wi-Fi. Shortly after connecting, they receive certificate warnings when accessing the company portal, and packet capture shows a nearby laptop advertising the same SSID and relaying traffic. What type of attack is most likely?

Accepted Answer

Rogue access point or evil twin attack, because a fake wireless network impersonates a legitimate one.. The attack described is an evil twin (a type of rogue access point) because the attacker sets up a laptop broadcasting the same SSID as the hotel's legitimate guest Wi-Fi. When employees connect to this fake network, the attacker can intercept traffic and present a fraudulent certificate for the company portal, triggering certificate warnings. The packet capture confirming the laptop is relaying traffic proves it is acting as a man-in-the-middle, not merely a passive listener.

Answer

Replay attack, because previously captured wireless frames are being resent to the network.

Answer

DNS poisoning, because users are being sent to the wrong website through altered name resolution.

Answer

Denial of service, because users are simply unable to connect reliably.

Question 4

Based on the exhibit, which control should be enabled so corporate data stays separated from personal data on company-owned tablets?

Accepted Answer

Enable a work profile or container with selective wipe for corporate data.. A work profile or container (e.g., Android Work Profile or iOS Managed Open In) creates a separate, encrypted partition for corporate data on the device. This allows IT to perform a selective wipe of only the corporate data without affecting the user's personal apps, photos, or settings, ensuring data separation while preserving user privacy.

Answer

Perform a full-device wipe any time a tablet is lost or reassigned.

Answer

Deploy mobile threat defense scanning on every tablet.

Answer

Disable Bluetooth and the camera on all tablets to stop data leakage.

Question 5

After a facilities outage, multiple employees report that their phones automatically joined a network named "CorpWiFi" in the lobby even though the legitimate access point was offline. A nearby attacker device then captured the captive portal login traffic. What attack is most likely?

Accepted Answer

Evil twin. Evil twin. In this scenario, the attacker set up a rogue access point with the same SSID ("CorpWiFi") as the legitimate network, which was offline. When employees' phones automatically attempted to reconnect to a known SSID, they associated with the attacker's device, which then presented a fake captive portal to capture login credentials. This is the classic definition of an evil twin attack: a fraudulent AP that mimics a legitimate one to intercept traffic.

Answer

Rogue access point

Answer

Bluetooth bluejacking

Answer

NFC relay attack

Question 6

A manufacturer needs to grant a partner company access to a procurement portal. Partner users should authenticate with their own identity provider, and the manufacturer does not want to create local passwords for each partner employee. Which design best supports this?

Accepted Answer

Establish federation with SAML or OIDC and support just-in-time provisioning for partner users.. Federation with SAML or OIDC allows the partner company to use its own identity provider for authentication, eliminating the need for local passwords. Just-in-time provisioning automatically creates user accounts in the manufacturer's procurement portal upon first successful authentication, ensuring access is granted without manual account management. This design supports secure cross-organization trust without sharing credentials or maintaining duplicate user stores.

Answer

Create local accounts for every partner user and reset passwords manually when staff changes occur.

Answer

Share one VPN credential with the partner organization and let them manage access internally.

Answer

Use NTLM pass-through authentication to avoid setting up trust relationships.

Question 7

A privileged account is used on a jump box at 02:15, and the SIEM shows multiple interactive logons from the same account to different servers within 10 minutes. The administrator says they used a password vault for the session. Which log source best confirms whether the access was authorized?

Accepted Answer

Privileged access management or password vault audit logs. The privileged access management (PAM) or password vault audit logs are the definitive source because they record exactly when a password was checked out, which user performed the checkout, and the specific session ID or ticket associated with the jump box use. Since the administrator claims the password vault was used, these logs will show the checkout event at 02:15 and the subsequent interactive logons, confirming whether the vault authorized the session. No other log source can tie the authentication to the vault's approval process.

Answer

DHCP lease logs from the jump box subnet

Answer

Printer server logs for the operations department

Answer

Web proxy logs for outbound browsing activity

Question 8

An internal file server has an administrative web console exposed on the same network as all user laptops. A scan shows that any authenticated employee can reach the console, and several failed login attempts are coming from a workstation that should never manage servers. What is the best hardening action?

Accepted Answer

Move the console to a separate management network and restrict access to admin hosts only.. The administrative web console should be isolated on a separate management network (out-of-band management) with strict access control lists (ACLs) allowing only designated admin hosts. This prevents lateral movement from compromised user workstations and eliminates the attack surface exposed to all authenticated employees. Network segmentation is a fundamental defense-in-depth control for managing critical infrastructure, as it enforces the principle of least privilege at the network layer.

Answer

Increase the number of shared passwords so administrators can log in faster.

Answer

Leave the console exposed but shorten the password expiration period.

Answer

Disable logging so failed attempts do not generate noise.

Question 9

Based on the exhibit, which social engineering attack is most likely?

Accepted Answer

Vishing. The exhibit shows a voicemail message instructing the recipient to call a specific phone number to verify account activity. This is a classic vishing (voice phishing) attack, where the attacker uses a phone call or voicemail to trick the victim into providing sensitive information or calling a fraudulent number. Unlike phishing, which uses email or text, vishing relies on voice communication channels.

Answer

Phishing

Answer

Baiting

Answer

Pretexting

Question 10

After a phishing account compromise has been contained and the attacker’s mailbox forwarding rule was removed, what should the team do next?

Accepted Answer

Reset credentials and verify there are no other persistence methods before recovery.. After removing a mailbox forwarding rule, the team must reset the compromised account's credentials and verify that no other persistence mechanisms (e.g., additional forwarding rules, OAuth app grants, or mailbox delegation) remain. This ensures the attacker cannot regain access using cached credentials or alternate backdoors, which is critical before returning the account to production.

Answer

Stop the investigation because the forwarding rule was deleted.

Answer

Close the ticket and tell the user to be more careful next time.

Answer

Wait one week before taking any action so the attacker does not notice.

Question 11

A critical vulnerability is discovered on an internet-facing VPN appliance that cannot be patched for six weeks because the vendor has not released a fix. The VPN service must remain available. What is the best operational response?

Accepted Answer

Apply compensating controls such as restricting source IPs and increasing monitoring.. When a vulnerability cannot be patched immediately, compensating controls such as restricting source IPs via ACLs and increasing monitoring (e.g., enabling detailed logging and alerting on anomalous traffic) reduce the attack surface and improve detection of exploitation attempts. This approach maintains service availability while mitigating risk until the vendor releases a fix.

Answer

Leave the appliance unchanged until the vendor releases a patch.

Answer

Disable all logging so the appliance performs better under load.

Answer

Replace the VPN with a less secure remote access method to avoid the vulnerability.

Question 12

The service desk needs a document that tells analysts exactly how to verify a caller and reset a password for a locked account. Which document type should they use?

Accepted Answer

Procedure, because it provides exact steps staff must follow in order. A procedure is the correct document type because it provides a step-by-step sequence of actions that staff must follow to complete a specific operational task, such as verifying a caller's identity and resetting a password. Unlike policies or standards, procedures are mandatory and detail the exact commands, verification checks, and escalation paths required to ensure consistent and secure execution of the task.

Answer

Policy, because it states the organization's high-level security expectations

Answer

Guideline, because it offers helpful suggestions that staff may choose to follow

Answer

Standard, because it defines a general topic without operational detail

Question 13

A systems administrator says the backup software reports success every night, but no one has restored a server from backup in over a year. The business wants confidence that a file server can be recovered within the agreed recovery window. What is the best next action?

Accepted Answer

Perform a scheduled restore test in an isolated environment and measure the recovery time.. The only way to validate that backups are both restorable and meet the recovery time objective (RTO) is to perform a scheduled restore test in an isolated environment. Backup success logs only confirm that data was copied, not that the data is intact or that the restoration process completes within the agreed window. This aligns with the 3-2-1 backup rule and the principle of 'trust but verify' in backup validation.

Answer

Trust the success status because completed jobs prove the backups are usable.

Answer

Delete older backups so that only the most recent set remains.

Answer

Extend retention indefinitely to avoid ever losing a recoverable copy.

Question 14

A file-sharing portal uses a download URL like /download?file=12345. A tester changes the value to 12346 and can access another department's document without logging in again. Which control most directly prevents this issue?

Accepted Answer

Implement server-side authorization checks for every object request.. The issue is that the server trusts the file identifier in the URL without verifying that the authenticated user is authorized to access the requested resource. Implementing server-side authorization checks for every object request ensures that before serving any file, the server validates whether the current session or user has explicit permission to access that specific document. This directly prevents the IDOR (Insecure Direct Object Reference) vulnerability demonstrated by the tester.

Answer

Make the identifier longer so users cannot guess nearby values.

Answer

Move the portal to HTTPS so request parameters cannot be intercepted.

Answer

Store the document name in a hidden field and validate it in JavaScript.

Question 15

Based on the exhibit, what additional control is the best fit?

Current controls on the finance share:
- SMB signing enabled
- Weekly access review
- Nightly backups to immutable storage
- Antivirus scans at 02:00

Incident: a valid VPN account was used to access 40,000 files in 8 minutes and copy them to a local drive.
Goal: detect unauthorized bulk access quickly before exfiltration completes.

Accepted Answer

Add file access auditing with alert thresholds forwarded to the SIEM.. File access auditing with alert thresholds forwarded to the SIEM directly addresses the goal of detecting unauthorized bulk access quickly. By monitoring for abnormal file access patterns—such as 40,000 files in 8 minutes—the SIEM can trigger an alert before exfiltration completes, enabling rapid response. This control complements the existing weekly access review by providing real-time detection.

Answer

Increase the backup schedule from nightly to hourly.

Answer

Rename the share to a less obvious name.

Answer

Disable SMB signing so the file transfer runs faster.