SY0-701 Practice Test 20 — 15 Questions

Question 1

After a file server is restored from backup, users can open the share, but the business wants to be sure the recovery was successful. What should the administrator verify next?

Accepted Answer

That representative files open correctly and the restored data matches the required recovery point.. Verifying that representative files open correctly and match the required recovery point (RPO) confirms data integrity and completeness, not just that the restore process ran without errors. This aligns with the backup validation principle of performing a data integrity check, such as comparing file hashes or checking timestamps, to ensure the restored data is usable and meets the business's recovery objectives.

Answer

Only that the restore completed without any error message.

Answer

That the server has enough free disk space for future growth.

Answer

That the backup software icon appears green on the console.

Question 2

A company wants to reduce the chance that a stolen password can be used to access employee email. Which control is the best fit?

Accepted Answer

Multi-factor authentication. Multi-factor authentication (MFA) requires at least two different authentication factors (e.g., something you know like a password and something you have like a time-based one-time password from an authenticator app). Even if an attacker steals the password, they cannot access the email without the second factor, directly reducing the risk of credential theft leading to account compromise.

Answer

Password complexity requirements only

Answer

Daily backup verification

Answer

Security awareness posters

Question 3

A records manager finds a folder of payroll reports on a shared drive. The business says the reports are no longer active, but legal retention rules require keeping them for another two years. What is the best action?

Accepted Answer

Move the reports to an approved archive and retain them for the required period. The reports are subject to a legal retention policy requiring two more years of storage. Moving them to an approved archive ensures they remain accessible for compliance purposes while removing them from the active shared drive, which reduces the risk of accidental modification or deletion. This aligns with data lifecycle management and legal hold procedures.

Answer

Delete the reports immediately because the business no longer uses them

Answer

Email the reports to each manager so they can keep their own copy

Answer

Rename the folder so users do not notice it on the shared drive

Question 4

Based on the exhibit, which improvement best addresses the biggest cryptographic risk?

TLS inventory:
- edge-vpn01 and edge-vpn02 present the same certificate and private key
- private key file stored in a shared SMB folder
- admins copy the key manually during maintenance
- compromise of either gateway would expose the file path to the same share

Accepted Answer

Place the private key in an HSM or cloud key vault and issue unique keys or certificates per gateway.. The biggest cryptographic risk is the shared private key stored in an SMB share, which violates the principle of least privilege and creates a single point of compromise. Using a Hardware Security Module (HSM) or cloud key vault ensures the private key is never exposed in plaintext, and issuing unique keys per gateway eliminates the risk that compromising one gateway exposes the key for all others. This directly addresses the core issue of key confidentiality and isolation.

Answer

Increase the certificate expiration to five years to reduce renewal work.

Answer

Keep copying the same key everywhere so failover is easier to manage.

Answer

Disable certificate validation to avoid user-facing outages.

Question 5

A software supplier used by your company is adding a new library to its product and says the change is "internal only." Your security team wants better visibility into future component risks before the next renewal. What requirement would BEST support supply chain due diligence?

Accepted Answer

Require an updated software bill of materials and a notification process for material component changes.. A Software Bill of Materials (SBOM) provides a detailed inventory of all components in a product, enabling the security team to assess risks from new libraries. Requiring an SBOM plus a notification process for material changes gives proactive visibility into component risks, directly supporting supply chain due diligence as recommended by frameworks like NIST SP 800-161.

Answer

Require the supplier to provide a marketing summary of its development process.

Answer

Ask the supplier to promise that future vulnerabilities will never affect the product.

Answer

Approve the change if the new library is open source and widely used.

Question 6

A SOC analyst receives an EDR alert showing a finance laptop creating encrypted archives and then attempting SMB connections to several internal file shares. The user is still logged in, and the business wants to stop possible spread without destroying volatile evidence. What should the analyst do first?

Accepted Answer

Isolate the endpoint from the network using the EDR containment feature.. The EDR containment feature isolates the endpoint from the network while preserving all running processes, memory, and disk state. This stops the encrypted archives from being exfiltrated via SMB and prevents lateral movement, but keeps volatile evidence (e.g., active malware processes, network connections) intact for forensic analysis.

Answer

Power off the laptop immediately to stop all activity.

Answer

Reimage the laptop from a gold image as soon as possible.

Answer

Disable the user account in Active Directory and wait for the malware to stop.

Question 7

Based on the exhibit, which change best improves accountability while still allowing emergency access?

A finance team uses the following shared account on a jump host:

07:55:12  Account=FIN-ADMIN  Action=ApproveInvoice   Host=JUMP-02  IP=10.30.8.21
07:56:03  Account=FIN-ADMIN  Action=ChangeVendorBank Host=JUMP-02  IP=10.30.8.21
07:57:44  Account=FIN-ADMIN  Action=ExportReport     Host=JUMP-02  IP=10.30.8.21

Note: FIN-ADMIN is used by three finance managers during after-hours support.

Accepted Answer

Replace the shared account with named user accounts, role-based access, and a separate break-glass account for rare emergencies.. Replacing the shared account with named user accounts ensures individual accountability through unique credentials and audit trails, while a separate break-glass account provides emergency access without compromising security. This aligns with the principle of least privilege and non-repudiation, as each finance manager's actions are logged under their own identity, and the break-glass account can be tightly controlled and monitored for rare use.

Answer

Require the shared account password to be changed every 24 hours.

Answer

Enable automatic account lockout after five failed logons.

Answer

Restrict the jump host by MAC address and subnet only.

Question 8

Which action is the best example of accounting in AAA?

Accepted Answer

The system records the username, timestamp, and files opened during the session.. Accounting in AAA (Authentication, Authorization, and Accounting) focuses on tracking user activities and resource usage. Option B correctly describes this by specifying the recording of username, timestamp, and files accessed, which are typical audit log entries used for monitoring and compliance.

Answer

The system checks a password and a one-time code before allowing access.

Answer

The system grants access to the finance folder after the user is approved.

Answer

The system forces the user to change their password after 90 days.

Question 9

At a conference, employees connect to a Wi-Fi network named "CorpGuest" and then see certificate warnings in their browsers. The network has a stronger signal than the hotel's legitimate guest Wi-Fi. What attack is this?

Accepted Answer

Rogue access point. This scenario describes a rogue access point attack. The attacker sets up a Wi-Fi network named "CorpGuest" with a stronger signal than the legitimate hotel guest Wi-Fi, tricking employees into connecting to it. Once connected, the attacker can intercept traffic and present a fake certificate, causing browser certificate warnings. This is a classic evil twin variant of a rogue access point attack.

Answer

ARP poisoning

Answer

Replay attack

Answer

Denial of service

Question 10

Based on the exhibit, which item is the strongest evidence that quarterly privileged access reviews occurred?

Accepted Answer

Signed access review spreadsheet with reviewer, date, and exceptions.. A signed access review spreadsheet with reviewer, date, and exceptions provides direct, non-repudiable evidence that a formal review of privileged access was completed. Unlike logs or policies, it explicitly documents the reviewer's identity, the date of review, and any exceptions, satisfying audit requirements for quarterly privileged access reviews.

Answer

SIEM export of administrator logins.

Answer

Help desk ticket for a password reset.

Answer

Screenshot of the access review policy.

Question 11

NetFlow shows one user workstation making authenticated SMB and WinRM connections to more than 40 internal hosts within 15 minutes, starting shortly after the user opened a spreadsheet attachment. No approved admin tool was running on the device. What is the best initial response?

Accepted Answer

Isolate the workstation and begin investigating for credential compromise or lateral movement. The sudden burst of authenticated SMB and WinRM connections from a single workstation to over 40 internal hosts immediately after opening a spreadsheet attachment is a classic indicator of lateral movement using stolen credentials. Since no approved admin tool was running, this behavior strongly suggests the user's credentials have been compromised, likely via a macro or exploit in the attachment, and an attacker is using those protocols to move laterally. Isolating the workstation stops the attack in progress and preserves evidence for forensic investigation.

Answer

Treat the traffic as normal because the workstation used valid credentials

Answer

Increase the DHCP lease time to reduce network noise

Answer

Block all SMB and WinRM traffic across the entire enterprise

Question 12

A web team is moving a customer portal behind a new inspection device. They need something that can examine HTTP requests, block malicious patterns like injection attempts, and still allow normal browsing. Which control is most appropriate?

Accepted Answer

WAF, because it understands web requests and can block malicious application-layer traffic.. A WAF (Web Application Firewall) is the correct choice because it operates at Layer 7 (application layer) and is specifically designed to inspect HTTP/HTTPS traffic. It can parse web requests, identify malicious patterns such as SQL injection or XSS payloads, and block them while allowing legitimate traffic to pass through to the customer portal.

Answer

IDS, because it alerts on suspicious traffic without affecting application delivery.

Answer

DLP, because it can stop sensitive data from being posted to the portal.

Answer

NAC, because it verifies whether devices are allowed onto the network.

Question 13

A development team wants to deploy a new internal application without managing operating system patching, runtime updates, or automatic scaling. The security team still wants the company to control the application code and its data access settings. Which cloud service model best fits this need?

Accepted Answer

Platform as a Service, because the provider manages the platform and the company manages the application and data.. Platform as a Service (PaaS) is the correct choice because the provider manages the underlying platform—including OS patching, runtime updates, and automatic scaling—while the company retains control over the application code and data access settings. This aligns with the shared responsibility model where the customer is responsible for the application and data, not the infrastructure.

Answer

Infrastructure as a Service, because the company can ignore guest OS patching entirely.

Answer

Software as a Service, because the team can deploy custom application code inside the vendor portal.

Answer

On-premises hosting, because the company can still use the provider's patching tools.

Question 14

Based on the exhibit, what should the employee do first?

Accepted Answer

Report the message through the company’s phishing-report process and do not share the code.. The message exhibits classic social engineering indicators: an unsolicited request for a sensitive code, urgency, and a spoofed sender address. The employee must report it via the company's phishing-report process to alert the security team and must not share the code, as that would compromise the account. This aligns with security awareness training that emphasizes verifying requests out-of-band and never providing credentials or codes in response to email requests.

Answer

Reply with the code because the request appears to come from payroll support.

Answer

Forward the email to coworkers so they can watch for the same request.

Answer

Open the attached file to see whether it contains the payroll fix details.

Question 15

A SIEM correlates VPN authentication logs and sees 14 different user accounts receive one failed login attempt each from the same source IP during a 5-minute window. A few minutes later, one of those accounts successfully authenticates from that same IP. Which attack is most likely?

Accepted Answer

Password spraying using a common password against many accounts.. The SIEM observed 14 different user accounts each receiving a single failed login attempt from the same source IP within a 5-minute window, followed by one account successfully authenticating. This pattern is characteristic of password spraying, where an attacker tries a common password (e.g., 'Password123') against many accounts to avoid triggering account lockouts, then leverages a successful guess. The single failure per account avoids the threshold for brute-force detection, and the eventual success confirms a guessed credential.

Answer

Brute-force attack against a single account using many passwords.

Answer

Replay attack using previously captured authentication traffic.

Answer

ARP poisoning used to intercept local network traffic.