SY0-701 Practice Test 2 — 10 Questions

Question 1

Before contracting with a cloud-based payroll provider, the security team requests a security questionnaire, proof of controls, and an independent audit report. What activity is this?

Accepted Answer

Third-party due diligence, because the team is evaluating vendor risk before onboarding.. The security team's request for a security questionnaire, proof of controls, and an independent audit report before contracting with a cloud-based payroll provider is a classic example of third-party due diligence. This process evaluates the vendor's security posture, compliance, and risk level before onboarding, ensuring that sensitive payroll data is protected. It is a proactive risk management activity, not a reactive test or training exercise.

Answer

Business continuity testing, because the team is checking recovery procedures.

Answer

Security awareness training, because the vendor is being taught safe behavior.

Answer

Data classification, because the team is labeling the payroll data type.

Question 2

A security analyst in the SOC observes a sudden spike in failed authentication attempts from a single external IP address targeting multiple user accounts over the last 30 minutes. After confirming the logs are accurate, which of the following actions should the analyst take FIRST according to standard incident response procedures?

Accepted Answer

Escalate the incident to the incident response team.. According to standard incident response procedures (NIST SP 800-61), the first step after confirming an anomaly is to escalate the incident to the incident response team. This ensures that a coordinated, documented, and legally defensible response is initiated, rather than taking unilateral action that could destroy evidence or disrupt legitimate services. The SOC analyst's role is to detect and validate, not to independently execute containment measures without authorization.

Answer

Block the IP address at the firewall immediately.

Answer

Disable all user accounts that were targeted.

Answer

Capture a memory dump of all affected servers.

Question 3

Based on the exhibit, what is the best-supported conclusion for the SOC analyst?

Accepted Answer

The host is likely using DNS tunneling or DNS-based command and control.. The exhibit shows a high volume of DNS queries to multiple unusual domains with long subdomain strings, which is a classic indicator of DNS tunneling or DNS-based command and control (C2). DNS tunneling encodes data in DNS queries and responses, allowing attackers to exfiltrate data or communicate with a C2 server while bypassing traditional network controls. The SOC analyst should recognize this pattern as anomalous DNS activity rather than normal web browsing.

Answer

The traffic is normal web browsing to a content delivery network.

Answer

The issue is most likely ARP spoofing on the local switch port.

Answer

The evidence most strongly indicates a password spraying campaign.

Question 4

A web form stores a user's comment and later displays it to other users. A tester submits and the script runs in the browser. What vulnerability is this?

Accepted Answer

Cross-site scripting. The tester's input is executed in the browser, which is the classic symptom of a stored (persistent) cross-site scripting (XSS) vulnerability. The web form fails to sanitize or encode user-supplied data before storing it and later rendering it in other users' browsers, allowing arbitrary JavaScript to run in the security context of the application's origin.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Command injection

Question 5

A desktop engineering team asks for the document that specifies the exact minimum encryption setting, screen-lock timer, and password length for company laptops. Which type of document should they follow?

Accepted Answer

Standard, because it defines mandatory uniform requirements for a specific control baseline.. A standard defines mandatory, uniform technical requirements for a specific control baseline, such as exact encryption settings (e.g., AES-256), screen-lock timer (e.g., 15 minutes), and password length (e.g., 14 characters). Unlike a policy, which states high-level intent, a standard provides the precise, enforceable configuration that the desktop engineering team must implement on company laptops.

Answer

Policy, because it states the organization's general intent and high-level direction.

Answer

Procedure, because it gives the organization-wide security purpose statement.

Answer

Guideline, because it provides optional suggestions that every laptop must obey.

Question 6

A security manager is leading a risk assessment for the organization. The team identifies a legacy application that contains a known critical vulnerability. The vendor has discontinued support and no patch is available. The manager calculates that the annualized loss expectancy (ALE) for exploiting this vulnerability is $50,000. Implementing a third-party web application firewall (WAF) as a compensating control would cost $80,000 per year. The organization's leadership decides that accepting the risk is the most cost-effective approach. Which of the following documents should the security manager update to formally record this risk acceptance decision and obtain the necessary sign-off?

Accepted Answer

Risk register. The risk register is the correct document to update because it formally tracks identified risks, their assessed impact, and the chosen risk response (acceptance). Recording the decision to accept the $50,000 ALE risk and obtaining sign-off ensures auditability and accountability, which is a key requirement in risk management frameworks like NIST SP 800-37.

Answer

Business impact analysis (BIA)

Answer

Security baseline configuration document

Answer

Incident response plan

Question 7

A hardening script is pushed to a production web server and, within minutes, the application stops accepting secure connections. The team discovers the script disabled a required TLS setting that the legacy application still needs. What should have been in place to reduce the impact of this change?

Accepted Answer

A documented change window with testing in a staging environment and a rollback plan.. A documented change window with testing in a staging environment and a rollback plan ensures that changes are validated before production deployment. In this scenario, the hardening script disabled a required TLS setting (e.g., TLS 1.0 or a specific cipher suite) that the legacy application depended on. Testing in staging would have caught the incompatibility, and a rollback plan would allow reverting the change quickly, minimizing downtime.

Answer

A longer password policy for administrators so they can log in after the outage.

Answer

Disabling all logging during the change so the application can restart faster.

Answer

Replacing the web server hardware to ensure the TLS settings are applied correctly.

Question 8

Match each control type to the best description.

Accepted Answer

Administrative: Policies, procedures, and rules. Control types are categorized by nature: administrative involves rules, technical involves technology, physical involves tangible barriers, logical involves software-based access, operational involves processes, and legal/regulatory involves compliance.

Answer

Technical: Physical locks and fences

Answer

Logical: Hardware security modules

Answer

Operational: Software-based authentication

Question 9

A SOC analyst reviews an EDR alert on a Windows workstation. PowerShell was launched by a scheduled task, downloaded an encoded command from an external server, and then spawned rundll32.exe. No suspicious executable was written to disk. Which type of threat best fits this activity?

Accepted Answer

Fileless attack. The attack is fileless because it executes entirely in memory without writing a malicious executable to disk. PowerShell downloads an encoded command from an external server and spawns rundll32.exe to run code via DLL execution, leveraging living-off-the-land binaries (LOLBins) to evade traditional antivirus and disk-based detection.

Answer

Trojan

Answer

Rootkit

Answer

Worm

Question 10

Match each design requirement to the best security architecture control. Use each control once.

Accepted Answer

Layered security: Defense in depth. Defense in depth uses layered controls, least privilege minimizes risk, separation of duties prevents fraud, fail secure avoids insecure states, secure defaults reduce misconfiguration, and complete mediation ensures consistent enforcement.

Answer

Avoid insecure state: Defense in depth

Answer

Reduce misconfiguration: Least privilege

Answer

Enforce consistently: Separation of duties