SY0-701 Practice Test 2 — 10 Questions

Question 1

A web form stores a user's comment and later displays it to other users. A tester submits and the script runs in the browser. What vulnerability is this?

Accepted Answer

Cross-site scripting. The tester's input is executed in the browser, which is the classic symptom of a stored (persistent) cross-site scripting (XSS) vulnerability. The web form fails to sanitize or encode user-supplied data before storing it and later rendering it in other users' browsers, allowing arbitrary JavaScript to run in the security context of the application's origin.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Command injection

Question 2

A desktop engineering team asks for the document that specifies the exact minimum encryption setting, screen-lock timer, and password length for company laptops. Which type of document should they follow?

Accepted Answer

Standard, because it defines mandatory uniform requirements for a specific control baseline.. A standard defines mandatory, uniform technical requirements for a specific control baseline, such as exact encryption settings (e.g., AES-256), screen-lock timer (e.g., 15 minutes), and password length (e.g., 14 characters). Unlike a policy, which states high-level intent, a standard provides the precise, enforceable configuration that the desktop engineering team must implement on company laptops.

Answer

Policy, because it states the organization's general intent and high-level direction.

Answer

Procedure, because it gives the organization-wide security purpose statement.

Answer

Guideline, because it provides optional suggestions that every laptop must obey.

Question 3

Match each control type to the best description.

Accepted Answer

Administrative: Policies, procedures, and rules. Control types are categorized by nature: administrative involves rules, technical involves technology, physical involves tangible barriers, logical involves software-based access, operational involves processes, and legal/regulatory involves compliance.

Answer

Technical: Physical locks and fences

Answer

Logical: Hardware security modules

Answer

Operational: Software-based authentication

Question 4

A SOC analyst reviews an EDR alert on a Windows workstation. PowerShell was launched by a scheduled task, downloaded an encoded command from an external server, and then spawned rundll32.exe. No suspicious executable was written to disk. Which type of threat best fits this activity?

Accepted Answer

Fileless attack. The attack is fileless because it executes entirely in memory without writing a malicious executable to disk. PowerShell downloads an encoded command from an external server and spawns rundll32.exe to run code via DLL execution, leveraging living-off-the-land binaries (LOLBins) to evade traditional antivirus and disk-based detection.

Answer

Trojan

Answer

Rootkit

Answer

Worm

Question 5

Match each design requirement to the best security architecture control. Use each control once.

Accepted Answer

Layered security: Defense in depth. Defense in depth uses layered controls, least privilege minimizes risk, separation of duties prevents fraud, fail secure avoids insecure states, secure defaults reduce misconfiguration, and complete mediation ensures consistent enforcement.

Answer

Avoid insecure state: Defense in depth

Answer

Reduce misconfiguration: Least privilege

Answer

Enforce consistently: Separation of duties

Question 6

A user receives an SMS from 'IT Service Desk' saying their MFA enrollment expires today and includes a shortened link. Five minutes later, the user gets a phone call from the same number asking them to read back the code shown in the authenticator app so the ticket can be closed. Which two attack channels are used in this campaign? Select two.

Accepted Answer

Smishing is used because the first lure arrives by text message.. The initial attack vector is an SMS message containing a shortened link, which is the definition of smishing (SMS phishing). The attacker uses this to create urgency and lure the victim into engaging with the MFA enrollment scam.

Answer

Email phishing is used because the attacker is requesting a login action.

Answer

Baiting is used because the attacker offers a free reward or device.

Answer

Tailgating is used because the attacker follows someone into a restricted area.

Question 7

Match each incident response action to its primary purpose during a suspected endpoint compromise.

Accepted Answer

Isolation: Preventing the spread of the incident to other systems.. Incident response actions are sequenced to contain, preserve, analyze, remove, and learn from the incident. Isolating prevents spread; volatile data capture is time-sensitive; imaging preserves evidence; log analysis reveals details; eradication cleans the system; lessons learned improve processes.

Answer

Isolation: Removing malicious files from the system.

Answer

Volatile Data Capture: Creating a forensic copy of the hard drive.

Question 8

A SIEM correlates the following: 17 failed logons against the same VPN account from one IP in 9 minutes, a successful login from that IP, creation of a new API token in the SaaS tenant, and a large export job started two minutes later. Which two interpretations are best supported? Select two.

Accepted Answer

The attacker is likely performing a brute-force password attack against a single account.. A is correct because 17 failed logons against a single VPN account from one IP in 9 minutes is a classic brute-force pattern—repeated authentication attempts targeting one username. The subsequent successful login, API token creation, and data export indicate the attacker gained access and then established persistence (via the token) to exfiltrate data, confirming the account was compromised.

Answer

The pattern is most consistent with password spraying across many accounts.

Answer

The events primarily indicate a volumetric denial-of-service attack.

Answer

Token creation proves the account password was never exposed.

Question 9

Based on the exhibit, which access design change best reduces fraud risk without stopping the payroll process?

Exhibit:
Payroll application roles:
- HR-Editor: can update employee records
- Payroll-Approver: can release payment batches
- Audit-Reader: can view reports only

Current assignment:
User Lisa has both HR-Editor and Payroll-Approver because she "handles payroll end to end."
Management wants to reduce the chance of one person creating and approving a fraudulent payment.

Accepted Answer

Split duties so record updates and payment approval require separate roles or separate accounts.. It enforces separation of duties (SoD) by ensuring that no single user can both create and approve a payment. Splitting the HR-Editor and Payroll-Approver roles into separate accounts or requiring separate users for record updates and payment approval directly mitigates the fraud risk of a single insider creating a fake employee record and then approving a fraudulent payment batch. This aligns with the principle of least privilege and the NIST SP 800-53 AC-5 control for separation of duties, without halting the payroll workflow.

Answer

Keep both roles assigned but require a manager to review the batch after payment completes.

Answer

Remove the audit role and let payroll staff self-review their own work to save time.

Answer

Use a single shared payroll account so the workflow never pauses for approvals.

Question 10

Administrators need to manage internal switches from home. Management traffic must be encrypted, MFA must be used, and no switch management interface should be exposed directly to the internet. Which design is best?

Accepted Answer

Use a VPN into the internal network, then administer the switches through a hardened jump host over SSH.. It uses a VPN to create an encrypted tunnel from the home user to the internal network, then requires SSH (which encrypts management traffic) through a hardened jump host. This design ensures MFA can be enforced at the VPN or jump host layer, and no switch management interface is directly exposed to the internet, satisfying all three requirements.

Answer

Open SSH directly to each switch on a public IP address and restrict access by source IP only.

Answer

Allow HTTPS management to each switch over the internet because the channel is encrypted.

Answer

Use Telnet inside the office and route home users through a split-tunnel VPN.