SY0-701 Practice Test 20 — 15 Questions

Question 1

At 10:15, a file server begins renaming documents and creating payment notes. The SOC confirms the server is also making SMB connections to other internal hosts, but users can still access shared folders. What should the incident handler do FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disconnect the server from the network or isolate it through EDR containment while preserving power. The correct first step is to contain the incident by disconnecting the server from the network or using EDR containment while preserving power. This stops the spread of malicious SMB connections and prevents further damage, while keeping the system powered on to preserve volatile evidence (e.g., memory, running processes) for forensic analysis. Immediate containment aligns with the NIST incident response framework's containment phase, prioritizing isolation over eradication or recovery.

Answer

Shut down the server immediately to stop all malicious activity

Answer

Restore the server from backup before taking any other action

Answer

Wait for users to report more symptoms before responding

Question 2

After a phishing simulation, many users still almost submitted credentials to a fake Microsoft login page. Security wants to reduce repeat mistakes quickly without interrupting daily work. Which approach is best?

Accepted Answer

Use short, targeted awareness messages with screenshots of the actual lure and an easy reporting path.. It uses just-in-time, context-specific training that directly addresses the observed behavior without disrupting workflow. By showing users the exact lure they encountered and providing a simple reporting path, the organization reinforces recognition of the specific phishing technique and encourages immediate reporting, which is more effective than generic warnings or lengthy retraining for reducing repeat mistakes quickly.

Answer

Send one enterprise-wide warning email listing every phishing indicator the users should memorize.

Answer

Require all employees to retake the full annual security course immediately.

Answer

Remove email access for any user who clicked the simulation link.

Question 3

Several employees receive a text message that says their payroll deposit failed and they must tap a link to verify account details. The link opens a fake login page. What type of attack is this?

Accepted Answer

Smishing. Smishing is a form of phishing that uses SMS (Short Message Service) text messages as the attack vector. In this scenario, the attacker sends a fraudulent text message claiming a payroll deposit failure and includes a link to a fake login page, which is the classic mechanism of smishing. The attack relies on social engineering via SMS to trick the recipient into revealing sensitive credentials.

Answer

Phishing

Answer

Pretexting

Answer

Baiting

Question 4

A scan keeps reporting the same medium-severity TLS configuration issue on a public web server. The application owner says the vendor software cannot be changed until next quarter, but they can place the service behind a reverse proxy that enforces stronger cipher settings. How should the issue be handled in the vulnerability management process?

Accepted Answer

Record an exception, document the compensating control, and set a review or remediation date. The vulnerability management process requires that when a vulnerability cannot be immediately remediated, compensating controls must be formally documented as an exception with a scheduled remediation date. In this scenario, the reverse proxy enforces stronger cipher settings, effectively mitigating the TLS misconfiguration at the network edge, which is a valid compensating control. Recording the exception ensures auditability and prevents the finding from being prematurely closed while the vendor software remains vulnerable.

Answer

Close the finding as fixed because the reverse proxy reduces the risk

Answer

Mark the finding as a false positive and remove it from future scans

Answer

Ignore the finding until the vendor releases a new version

Question 5

A worker receives a text message from someone claiming to be the company's HR partner. The message says a benefits portal issue will be fixed only if the worker clicks a link and logs in right away. What type of attack is this most likely?

Accepted Answer

Smishing, because the attack is delivered by text message.. This is smishing because the attack vector is a text message (SMS) that attempts to trick the recipient into clicking a malicious link and providing credentials. Smishing is a form of social engineering that exploits the trust in SMS communications, often impersonating a legitimate entity like HR to create urgency. The goal is credential theft, not technical exploitation of the phone's services.

Answer

Watering hole, because the attacker compromised the HR partner's website.

Answer

Spoofing only, because the attacker copied the HR logo in the message.

Answer

Port scanning, because the attacker wants to find open services on the phone.

Question 6

A desktop engineering team needs the document that sets the mandatory minimum password length and screen-lock timeout for all company laptops. Which document type should they use?

Accepted Answer

Standard. A standard specifies mandatory technical requirements, such as minimum password length and screen-lock timeout, that must be implemented on all company laptops. Unlike a policy, which is high-level and states management intent, a standard provides the specific, enforceable configuration settings. This aligns with the desktop engineering team's need for a document that dictates exact technical parameters.

Answer

Policy

Answer

Guideline

Answer

Procedure

Question 7

An online ticketing system must survive a single server failure and continue operating after a primary site outage. The business wants the lowest-cost design that still improves availability. Which architecture is best?

Accepted Answer

Use an active-passive design with replicated data and automatic failover to a secondary site.. An active-passive design with replicated data and automatic failover (Option B) meets the requirement of surviving a single server failure and a primary site outage while minimizing cost. Unlike active-active, it uses standby resources that only activate during failover, reducing operational expense. This architecture improves availability without the complexity and cost of multi-region active-active deployment.

Answer

Deploy active-active servers across multiple regions with load balancing.

Answer

Schedule nightly backups and restore only after the outage is confirmed.

Answer

Add RAID to the server to protect against all availability failures.

Question 8

A sales manager's laptop is often taken home and may contain customer pricing spreadsheets and contract drafts. Which control best protects the files if the laptop is stolen?

Accepted Answer

Full-disk encryption. Full-disk encryption (FDE) protects all data on the laptop's storage drive by encrypting the entire volume, including the operating system, applications, and files. If the laptop is stolen, the thief cannot access the customer pricing spreadsheets and contract drafts without the decryption key (e.g., a pre-boot PIN or TPM-based key). This renders the data unreadable even if the drive is removed and attached to another system, directly addressing the risk of physical theft.

Answer

Hashing the files

Answer

Using TLS on the office Wi-Fi

Answer

File compression

Question 9

A business unit is worried about the financial impact of a rare but severe data center outage. After reviewing the risk register, leadership decides to purchase cyber insurance and document the remaining exposure rather than redesign the entire platform. Which risk treatment is this?

Accepted Answer

Risk transfer. (Risk transfer) because purchasing cyber insurance transfers the financial risk of a data center outage to an insurance provider. The business unit is not avoiding the risk by redesigning the platform, nor are they mitigating it through technical controls; they are simply documenting the residual exposure after transferring the monetary impact. This aligns with the risk treatment strategy of shifting the burden of loss to a third party.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk acceptance

Question 10

After hours, EDR alerts show a finance laptop encrypting local files and trying SMB connections to nearby workstations. The user is still logged in, and management wants the fastest step that limits spread while preserving evidence. What should the SOC do first?

Accepted Answer

Use EDR to isolate the laptop from the network.. EDR isolation immediately blocks all network communication (including SMB) while preserving the endpoint's state for forensic analysis. This stops lateral movement and further encryption without losing volatile data like memory or running processes, which a shutdown would destroy.

Answer

Shut down the laptop immediately to stop any further activity.

Answer

Run a full antivirus scan before making any network changes.

Answer

Reimage the laptop right away from a standard corporate image.

Question 11

After a file server is restored from backup, users can open the share, but the business wants to be sure the recovery was successful. What should the administrator verify next?

Accepted Answer

That representative files open correctly and the restored data matches the required recovery point.. Verifying that representative files open correctly and match the required recovery point (RPO) confirms data integrity and completeness, not just that the restore process ran without errors. This aligns with the backup validation principle of performing a data integrity check, such as comparing file hashes or checking timestamps, to ensure the restored data is usable and meets the business's recovery objectives.

Answer

Only that the restore completed without any error message.

Answer

That the server has enough free disk space for future growth.

Answer

That the backup software icon appears green on the console.

Question 12

A company wants to reduce the chance that a stolen password can be used to access employee email. Which control is the best fit?

Accepted Answer

Multi-factor authentication. Multi-factor authentication (MFA) requires at least two different authentication factors (e.g., something you know like a password and something you have like a time-based one-time password from an authenticator app). Even if an attacker steals the password, they cannot access the email without the second factor, directly reducing the risk of credential theft leading to account compromise.

Answer

Password complexity requirements only

Answer

Daily backup verification

Answer

Security awareness posters

Question 13

A records manager finds a folder of payroll reports on a shared drive. The business says the reports are no longer active, but legal retention rules require keeping them for another two years. What is the best action?

Accepted Answer

Move the reports to an approved archive and retain them for the required period. The reports are subject to a legal retention policy requiring two more years of storage. Moving them to an approved archive ensures they remain accessible for compliance purposes while removing them from the active shared drive, which reduces the risk of accidental modification or deletion. This aligns with data lifecycle management and legal hold procedures.

Answer

Delete the reports immediately because the business no longer uses them

Answer

Email the reports to each manager so they can keep their own copy

Answer

Rename the folder so users do not notice it on the shared drive

Question 14

Based on the exhibit, which improvement best addresses the biggest cryptographic risk?

TLS inventory:
- edge-vpn01 and edge-vpn02 present the same certificate and private key
- private key file stored in a shared SMB folder
- admins copy the key manually during maintenance
- compromise of either gateway would expose the file path to the same share

Accepted Answer

Place the private key in an HSM or cloud key vault and issue unique keys or certificates per gateway.. The biggest cryptographic risk is the shared private key stored in an SMB share, which violates the principle of least privilege and creates a single point of compromise. Using a Hardware Security Module (HSM) or cloud key vault ensures the private key is never exposed in plaintext, and issuing unique keys per gateway eliminates the risk that compromising one gateway exposes the key for all others. This directly addresses the core issue of key confidentiality and isolation.

Answer

Increase the certificate expiration to five years to reduce renewal work.

Answer

Keep copying the same key everywhere so failover is easier to manage.

Answer

Disable certificate validation to avoid user-facing outages.

Question 15

A software supplier used by your company is adding a new library to its product and says the change is "internal only." Your security team wants better visibility into future component risks before the next renewal. What requirement would BEST support supply chain due diligence?

Accepted Answer

Require an updated software bill of materials and a notification process for material component changes.. A Software Bill of Materials (SBOM) provides a detailed inventory of all components in a product, enabling the security team to assess risks from new libraries. Requiring an SBOM plus a notification process for material changes gives proactive visibility into component risks, directly supporting supply chain due diligence as recommended by frameworks like NIST SP 800-161.

Answer

Require the supplier to provide a marketing summary of its development process.

Answer

Ask the supplier to promise that future vulnerabilities will never affect the product.

Answer

Approve the change if the new library is open source and widely used.