SY0-701 Practice Test 20 — 15 Questions

Question 1

A security analyst receives an alert that a user clicked a link in a phishing email and entered their corporate credentials on a fake login page. Which of the following should the analyst do FIRST to minimize further damage?

Accepted Answer

Disable the user's account and block the compromised system from the network. Option C is correct because immediately disabling the user's account and blocking the compromised system from the network stops the attacker from using the stolen credentials to authenticate to corporate resources, such as email, VPN, or file shares. This containment step is the highest priority in incident response to prevent lateral movement and further compromise, as the attacker already has valid credentials and could be actively using them.

Answer

Run a full antivirus scan on the user's workstation

Answer

Reset the user's password and force re-authentication

Answer

Contact law enforcement and report the phishing site

Question 2

A security architect is designing a solution to securely store sensitive customer data in a cloud object storage service. The architect's primary concern is that if the storage bucket is accidentally configured as publicly accessible, the data should still be protected from unauthorized viewing. Which of the following architectural designs provides the strongest defense in depth to meet this concern?

Accepted Answer

Use client-side encryption with a customer-managed key stored in a hardware security module (HSM) and restrict access with IAM roles.. Option B is correct because client-side encryption ensures data is encrypted before it ever leaves the client, so even if the bucket is accidentally made publicly accessible, the ciphertext remains unreadable without the customer-managed key stored in the HSM. This provides defense in depth by combining encryption at the application layer with IAM role restrictions, which control access at the AWS API level. Server-side encryption alone (as in the other options) only protects data at rest on the server side, leaving it vulnerable if the bucket policy or ACLs are misconfigured to allow public read access.

Answer

Use server-side encryption with a cloud-managed key (SSE-S3) and restrict access with bucket policies.

Answer

Use default encryption with a cloud-managed key (SSE-S3) and enable bucket logging.

Answer

Use server-side encryption with a customer-provided key (SSE-C) and require MFA for delete operations on the bucket.

Question 3

A manager asks the security team to let Human Resources inspect the files on a laptop suspected of containing stolen customer data before IT touches it. What is the best response?

Accepted Answer

Create a forensic image of the device, document the handoff, and maintain chain of custody before any analysis.. Option B is correct because the first priority in any investigation involving potential evidence is to preserve the data in its original state. Creating a forensic image (bit-for-bit copy) ensures that the original media is not altered, and documenting the handoff with a chain of custody form provides a verifiable audit trail. This process adheres to forensic best practices and legal requirements, preventing spoliation of evidence before any analysis begins.

Answer

Let HR browse the files first so they can confirm whether the data is sensitive.

Answer

Copy the files to a shared drive so multiple departments can review them quickly.

Answer

Factory reset the laptop immediately to prevent further leakage of customer data.

Question 4

A security analyst observes a pattern where an account exhibits multiple failed login attempts from an IP address in a foreign country, followed by a successful login from the same account but from a different IP address in another foreign country minutes later. The analyst wants to deploy a control that can automatically detect and alert on this type of anomalous user behavior, even if the individual login events are not blocked by existing rules. Which of the following security controls is BEST suited for this task?

Accepted Answer

User Behavior Analytics (UBA). User Behavior Analytics (UBA) is the best control because it uses machine learning to establish a baseline of normal user behavior (e.g., typical login locations, times, and IP ranges) and then detects anomalies such as a rapid sequence of failed logins from one foreign country followed by a successful login from another foreign country. Unlike static rules, UBA can identify this pattern as suspicious even if each individual login event is not blocked by existing rules, triggering an alert for further investigation.

Answer

Geofencing

Answer

Account lockout policy

Answer

SIEM correlation rules

Question 5

A security manager at a financial services company is proposing a new policy that would require annual background checks for all employees with access to sensitive customer payment data. The proposed policy, if implemented, would increase the organization's operational costs by approximately $200,000 per year. The manager needs to obtain formal approval to implement this policy. Which of the following groups is MOST likely to have the authority to approve this policy and allocate the necessary budget?

Accepted Answer

Board of directors. The board of directors holds the ultimate fiduciary responsibility and authority over significant financial commitments and strategic policy changes. A $200,000 annual cost increase requires approval at the highest governance level, as it impacts the organization's budget and risk posture. The board is the only group with the formal power to allocate such a substantial operational expense and approve a new policy affecting all employees with access to sensitive payment data.

Answer

Chief Information Security Officer (CISO)

Answer

IT steering committee

Answer

Security operations team

Question 6

A security manager is preparing a quarterly report for the board of directors on the effectiveness of the organization's security program. The manager has access to detailed technical data, including firewall log statistics, patch compliance percentages, and number of phishing simulation clicks. Which of the following would be the most appropriate way to present this information to the board?

Accepted Answer

Show a trend chart of the number of security incidents categorized by severity, along with average time to resolve.. Option B is correct because it presents security program effectiveness in a business-relevant format: trend charts of incidents by severity and resolution times directly address risk reduction and operational efficiency, which board members need for strategic oversight. Unlike raw technical data, this aggregated, visualized information enables non-technical stakeholders to assess whether the security program is improving over time.

Answer

Provide a list of all firewall rule changes made during the quarter.

Answer

Include raw logs of the top 10 most frequent alerts from the SIEM.

Answer

Describe the technical architecture of the intrusion prevention system.

Question 7

A SOC analyst wants to make sure logs from multiple servers can be compared accurately during an incident review. What should be configured on those systems?

Accepted Answer

Time synchronization using the same trusted time source. Time synchronization using a trusted time source (e.g., NTP) ensures that all servers share the same clock. During incident review, accurate log correlation depends on timestamps being consistent across systems; even a few seconds of drift can misalign event sequences. Without synchronized time, comparing logs from multiple servers becomes unreliable, potentially obscuring the true timeline of an attack.

Answer

A local administrator account with the same password on every server

Answer

A larger disk size on the log server

Answer

A separate VLAN for each application server

Question 8

A security manager is evaluating the effectiveness of a new security awareness training program that all employees completed last quarter. The company has been conducting monthly phishing simulation campaigns for the past year. Which of the following metrics would provide the strongest evidence that the training is achieving its intended goal of changing employee behavior?

Accepted Answer

The percentage of employees who clicked on a simulated phishing email decreased from 18% to 6%.. Option C directly measures the reduction in risky behavior (clicking phishing links) after training, which is the core goal of security awareness training. A drop from 18% to 6% demonstrates a measurable behavior change, not just knowledge acquisition. This aligns with the Kirkpatrick Model's 'Behavior' level of evaluation, which is the strongest indicator of training effectiveness.

Answer

95% of employees completed the training within the deadline.

Answer

The number of employees reporting phishing attempts to the SOC increased by 40%.

Answer

The number of helpdesk tickets related to password resets decreased by 10%.

Question 9

A security team is defining the minimum approved configuration for all new Linux web servers. The document must require specific logging settings, approved packages, and disabled services, and administrators must check servers against it during audits. Which governance artifact best fits this need?

Accepted Answer

Baseline, because it defines the minimum approved configuration that systems should meet.. A baseline is the correct governance artifact because it defines the minimum approved configuration that systems must meet, including specific logging settings, approved packages, and disabled services. In the context of Linux web servers, a baseline ensures consistent security posture by providing a measurable standard that administrators can audit against, such as verifying that rsyslog is configured for remote logging, only packages like Apache or Nginx from approved repositories are installed, and services like Telnet or FTP are disabled. This aligns with the requirement for enforcement and auditability, unlike a guideline which is merely advisory.

Answer

Guideline, because it suggests recommended settings without requiring enforcement.

Answer

Policy, because it is the high-level statement of intent for the organization.

Answer

Procedure, because it explains the exact steps to install and configure each server.

Question 10

A SIEM correlates VPN logs and sees the same public IP make one failed login attempt against 56 different user accounts over 25 minutes. The usernames vary, but the password value appears to be the same in each attempt. Ten minutes later, one of those accounts authenticates successfully from the same IP, and no password-reset events are recorded. Which attack pattern is most likely?

Accepted Answer

Password spraying against multiple accounts with a shared password guess.. The SIEM logs show the same public IP attempting to authenticate with 56 different usernames using the same password. This is the hallmark of a password spraying attack, where an attacker tries a single common password against many accounts to avoid account lockout policies. The subsequent successful authentication from the same IP, without a password reset, confirms the guessed password was valid for one account.

Answer

A brute-force attack focused on a single account with repeated rapid guesses.

Answer

A replay attack using captured authentication traffic from a previous session.

Answer

Credential stuffing using known breached username and password pairs.

Question 11

A security team stores employee passwords in a database. Which method best protects the passwords if the database is stolen?

Accepted Answer

Hash the passwords with a unique salt for each account.. Option B is correct because hashing with a unique salt per account ensures that even if two users have the same password, their hashes will differ, and precomputed rainbow table attacks are rendered ineffective. The salt is stored alongside the hash, but the one-way nature of the hash function means an attacker cannot reverse the hash to recover the original password without performing an expensive brute-force search for each salted hash individually.

Answer

Store the passwords in plain text so users can recover them easily.

Answer

Encrypt the passwords and keep the decryption key in the same database.

Answer

Compress the passwords before storing them to make them smaller.

Question 12

A SIEM alert shows five failed logins to a SaaS admin portal from one IP, followed by a successful login from a new city three minutes later. Which two actions are the best next steps for the analyst to validate the event before containment? Select two.

Accepted Answer

Review the identity provider and MFA logs to confirm the successful login came from the same account and device context.. Option A is correct because reviewing the identity provider (IdP) and MFA logs allows the analyst to verify whether the successful login originated from the same user account and device context as the failed attempts. This step is critical to determine if the successful login was an attacker who bypassed MFA or a legitimate user who eventually succeeded, providing evidence of account compromise or a false positive.

Answer

Immediately disable the SaaS platform for every user until the investigation is finished.

Answer

Reimage the user’s laptop immediately to remove any possible malware.

Answer

Delete the failed login records to reduce noise in the SIEM.

Question 13

A SIEM alert shows a workstation connecting to the same unknown internet address every 15 minutes, even after business hours. The device belongs to an employee who is on vacation. What is the best next step for the analyst?

Accepted Answer

Treat the alert as potentially malicious and check endpoint and proxy logs for more context.. Option B is correct because the alert describes a persistent outbound connection to an unknown external IP address at regular intervals, which is a classic indicator of beaconing behavior often associated with malware command-and-control (C2) traffic. The fact that the connection occurs after business hours and the workstation's user is on vacation increases suspicion, as legitimate scheduled tasks or updates would typically not run under those conditions. Checking endpoint and proxy logs provides the necessary context to determine if the traffic is benign (e.g., a misconfigured service) or malicious (e.g., C2 communication).

Answer

Dismiss the alert because periodic connections are always normal for workstations.

Answer

Immediately delete the workstation account from the directory service.

Answer

Shut down the entire office network until the analyst can review the alert.

Question 14

A SIEM correlation rule fires for a Microsoft 365 executive mailbox. At 02:14, the account signs in from a new country. At 02:17, the mailbox gets a forwarding rule that sends all mail to an external address. The user says they did not travel and did not create any rules. Which two log sources should the analyst review first to confirm whether this is account takeover or token abuse? Select two.

Accepted Answer

Identity provider sign-in logs, because they show source IP, MFA status, and session creation details.. Option A is correct because identity provider sign-in logs (e.g., Azure AD sign-in logs) capture the source IP address, MFA status, and session details. In this scenario, reviewing these logs can reveal if the sign-in at 02:14 came from an unusual IP or lacked MFA, indicating a potential account takeover rather than token abuse.

Answer

DHCP lease logs, because they identify the internal workstation that first received the suspicious email.

Answer

Print server logs, because mailbox forwarding often causes documents to be printed unexpectedly.

Answer

Physical badge-access logs, because they prove whether the user was in the office when the login occurred.

Question 15

A security manager wants evidence that annual security awareness training was completed by employees. Which artifact is the best proof?

Accepted Answer

A training completion report exported from the learning system. A training completion report exported from the learning system is the best proof because it provides a verifiable, timestamped record of each employee's completion status, including user IDs, course names, completion dates, and scores. This artifact directly demonstrates that the training was actually completed, not just assigned or attended, and can be audited against the organization's training policy.

Answer

A copy of the company logo used on the training slides

Answer

A list of office supplies purchased last quarter

Answer

A screenshot of the company's public homepage