SY0-701 Practice Exam 1 — 20 Questions

Question 1

An HR analyst must send a salary file to an external auditor. The auditor only needs names, departments, and salary totals, not Social Security numbers or bank account details. Which two actions should the analyst take first? Select two.

Accepted Answer

Remove unnecessary sensitive fields before sharing. Option A is correct because removing unnecessary sensitive fields (like Social Security numbers and bank account details) before sharing the file reduces the risk of exposing personally identifiable information (PII) and aligns with the principle of data minimization. This step ensures that only the required data (names, departments, salary totals) is transmitted, which is a foundational security control before any data transfer occurs.

Answer

Upload the file to a public link and send the URL by email

Answer

Rename the file to a less obvious name and send it normally

Answer

Save the file locally on a USB drive and hand-deliver it

Question 2

An investigator receives a suspect laptop drive that may be used in court. Which approach best supports a forensically sound image while protecting the original media?

Accepted Answer

Use a hardware write blocker and create a bit-by-bit forensic image with hashes.. Option B is correct because forensic best practice requires preserving the original media in an unaltered state. A hardware write blocker physically prevents any write commands from reaching the drive, ensuring the original evidence is not modified. Creating a bit-by-bit forensic image (e.g., with `dd` or FTK Imager) captures the entire drive, including slack space and unallocated sectors, and generating cryptographic hashes (SHA-256 or MD5) before and after imaging verifies the image's integrity for court admissibility.

Answer

Mount the drive read-write so the investigator can browse it quickly.

Answer

Copy only the user profile folders with a file manager to save time.

Answer

Boot the laptop normally and use backup software to duplicate the disk.

Question 3

An investigator must collect data from a suspected insider-threat laptop so the evidence could be used in an HR and legal review. Which action best preserves admissibility?

Accepted Answer

Create a forensic image through a write blocker and record hashes before and after acquisition. Option B is correct because creating a forensic image through a write blocker ensures the original evidence is not altered, preserving its integrity for admissibility in HR and legal proceedings. Recording hashes before and after acquisition allows verification that the image is an exact, unmodified copy, which is critical for chain of custody and meeting legal standards such as Daubert or Federal Rules of Evidence.

Answer

Boot the laptop normally and browse the user's files for clues

Answer

Copy the user's documents to a USB drive and continue the investigation later

Answer

Take screenshots of the desktop and delete the original drive contents afterward

Question 4

An NDR tool shows a production web server sending small, periodic DNS queries to random-looking subdomains under a domain the company does not use. The pattern repeats every 60 seconds, even when normal web traffic is idle. What is the best interpretation and next step?

Accepted Answer

Suspect DNS-based command-and-control, then isolate the server and collect logs and packet data for analysis.. The small, periodic DNS queries to random-looking subdomains under an unused domain are a classic indicator of DNS-based command-and-control (C2) communication. Attackers often use DNS tunneling to exfiltrate data or send commands, as DNS traffic is typically allowed through firewalls. The fact that the pattern persists even during idle web traffic confirms it is not related to normal server operations, making isolation and forensic collection the appropriate next step.

Answer

This is normal DNS behavior, so no action is needed unless users report an outage.

Answer

Rotate the DNS server’s administrator password and leave the web server online.

Answer

Assume the web server is performing routine certificate renewal checks and ignore the alert.

Question 5

An investigator needs to make a forensic image of a suspect laptop without changing the original drive contents. Which two practices should be used? Select two.

Accepted Answer

Use a hardware or software write blocker during acquisition. A hardware or software write blocker is essential because it intercepts and blocks any write commands from the operating system to the suspect drive, ensuring that no data is altered during acquisition. This preserves the original drive's contents in a forensically sound state, which is a fundamental requirement for evidence admissibility.

Answer

Mount the drive read/write so hidden files are easier to access

Answer

Defragment the drive first to improve imaging speed

Answer

Install triage tools directly on the suspect laptop

Question 6

An operations team manages Linux servers over SSH. The security team wants to stop direct management access from employee laptops, reduce lateral movement if one admin endpoint is compromised, and keep a log of every administrative session. Which two design choices best fit? Select two.

Accepted Answer

Require administrators to connect to a bastion host or jump server before reaching the Linux servers.. Option A is correct because a bastion host (jump server) acts as a single, hardened entry point that administrators must connect to before reaching internal Linux servers. This eliminates direct SSH access from employee laptops, reducing the attack surface and preventing lateral movement if an admin endpoint is compromised. The bastion host can also enforce centralized logging of all administrative sessions, meeting the security team's requirement for session recording.

Answer

Let all corporate laptops connect directly to SSH on the servers if MFA is enabled.

Answer

Expose SSH to the internet because key-based authentication is already strong.

Answer

Use split tunneling for admin traffic so management packets can bypass the VPN.

Question 7

An investigator needs a copy of a suspect laptop drive for analysis without changing the original media. What should be used?

Accepted Answer

A full forensic image taken with a write blocker. A full forensic image taken with a write blocker is the correct method because it creates a bit-for-bit copy of the entire drive, including all partitions, unallocated space, and metadata, without altering the original media. The write blocker hardware or software ensures that no write commands reach the suspect drive, preserving its integrity for legal and evidentiary purposes. This approach is required by forensic standards such as NIST SP 800-86 and ensures the copy is admissible as evidence.

Answer

A simple file copy of the user folder

Answer

A compressed archive of the desktop contents

Answer

The original drive mounted normally on the investigator machine

Question 8

An organization is redesigning its office network. Guest Wi-Fi must reach the internet only, employee laptops need access to internal apps, and a payment-processing system must be separated from general user traffic but still reach one database server. Which design best meets these requirements?

Accepted Answer

Create separate VLANs or subnets for guest, user, and payment zones, then filter inter-zone traffic with firewalls or ACLs.. Option B is correct because it uses VLANs or subnets to segment guest, employee, and payment-processing traffic into separate broadcast domains, then applies firewall rules or ACLs to control inter-zone traffic. This allows guest Wi-Fi to be restricted to internet-only access, employee laptops to reach internal apps, and the payment system to communicate only with its specific database server while being isolated from general user traffic.

Answer

Place all devices on one flat network and rely on host firewalls for isolation.

Answer

Put the payment system in a DMZ and allow direct internet access for database synchronization.

Answer

Use NAT on every endpoint so internal devices cannot be individually identified on the network.

Question 9

An online retailer is redesigning its public web application so the web server can receive internet traffic, the application server can only be reached by the web tier, and the database server can only be reached by the application tier. Which placement best supports this design?

Accepted Answer

Put the web server in a public zone, the application server in a private zone, and the database server in an isolated internal zone.. Option B is correct because it implements a classic three-tier architecture with network segmentation. The web server in a public zone (DMZ) accepts internet traffic, the application server in a private zone is isolated from direct internet access and only reachable by the web tier, and the database server in an isolated internal zone is only reachable by the application tier. This design enforces the principle of least privilege and minimizes the attack surface by using firewalls or security groups to restrict traffic between tiers.

Answer

Place all three servers on the same private subnet and control access only with strong passwords.

Answer

Put the database in the public zone so the web tier can query it directly from the internet.

Answer

Use a single reverse proxy for all three servers and disable network segmentation to simplify management.

Question 10

An order-entry application must survive a single server failure and continue serving users if the primary site becomes unavailable. Management wants automatic failover, but does not want to pay for fully active production capacity in two regions. Which design is best?

Accepted Answer

Use two servers in one site behind a load balancer and maintain an asynchronously replicated warm standby site.. Option B is correct because it combines a load-balanced active-passive pair at the primary site with an asynchronously replicated warm standby at a secondary site. This design meets the requirement for automatic failover and continued service after a single server failure or primary site outage, while avoiding the cost of fully active multi-region capacity. Asynchronous replication ensures the standby site is ready to take over without requiring synchronous writes that would add latency or require identical production load.

Answer

Run one server and keep nightly backups in cloud object storage.

Answer

Deploy active-active multi-region capacity with identical production load in both regions.

Answer

Add RAID 1 and a spare power supply to the database server.

Question 11

Based on the exhibit, what is the best handling decision for the requested file?

Accepted Answer

Treat it as Restricted, redact unnecessary fields, and provide only the minimum approved dataset through a logged encrypted transfer.. Option D is correct because the file contains personally identifiable information (PII) in the form of a Social Security Number (SSN), which requires handling under a Restricted classification per most data governance frameworks. The correct procedure is to redact unnecessary fields, such as the full SSN, and transmit only the minimum approved dataset via a logged encrypted transfer (e.g., using SFTP or HTTPS with TLS 1.2+) to ensure confidentiality, integrity, and auditability. This aligns with the principle of least privilege and data minimization, which are core to security program management.

Answer

Share the full file by email as Confidential because only the last four digits of the SSN are included.

Answer

Label it Public because the contractor needs the information to troubleshoot effectively.

Answer

Mark it Internal and place it on the shared project drive for easy access.

Question 12

An organization is evaluating a payroll SaaS provider after the procurement team asks for evidence that the vendor's security controls were designed and operating effectively during the past year. Which document should the security team review first?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides an independent auditor's assessment of a service organization's controls over a period of time (typically 6–12 months), confirming that security controls were not only designed but also operating effectively. This directly meets the procurement team's need for evidence of the vendor's security posture over the past year, as required for evaluating a SaaS provider handling sensitive payroll data.

Answer

Memorandum of understanding

Answer

Software license agreement

Answer

Network diagram of the vendor's data center

Question 13

Based on the exhibit, what additional control is the best fit?

Current controls on the finance share:
- SMB signing enabled
- Weekly access review
- Nightly backups to immutable storage
- Antivirus scans at 02:00

Incident: a valid VPN account was used to access 40,000 files in 8 minutes and copy them to a local drive.
Goal: detect unauthorized bulk access quickly before exfiltration completes.

Accepted Answer

Add file access auditing with alert thresholds forwarded to the SIEM.. File access auditing with alert thresholds forwarded to the SIEM directly addresses the goal of detecting unauthorized bulk access quickly. By monitoring for abnormal file access patterns—such as 40,000 files in 8 minutes—the SIEM can trigger an alert before exfiltration completes, enabling rapid response. This control complements the existing weekly access review by providing real-time detection.

Answer

Increase the backup schedule from nightly to hourly.

Answer

Rename the share to a less obvious name.

Answer

Disable SMB signing so the file transfer runs faster.

Question 14

Based on the exhibit, what is the best next control to prevent noncompliant mobile devices from accessing corporate email while still allowing IT to wipe company data from lost phones?

Accepted Answer

Enforce conditional access so only compliant MDM-enrolled devices can reach email and enable selective wipe for corporate data.. Option A is correct because it combines conditional access policies (e.g., Azure AD Conditional Access or Intune compliance policies) to block noncompliant devices from accessing corporate email, while using MDM selective wipe to remove only corporate data (e.g., email, documents) without affecting personal data on the device. This approach enforces security without requiring a full device wipe, preserving user privacy and IT control.

Answer

Require users to set a longer password on the email app and keep the current access policy.

Answer

Disable email on all mobile devices and force users to use desktop computers only.

Answer

Rely on a remote full factory reset whenever a device is lost or reported stolen.

Question 15

Based on the exhibit, what is the best response to the facilities manager's request?

Accepted Answer

Deny the request and direct the manager to use an approved work-contact list or seek privacy review.. The facilities manager's request to export employee contact information for a separate system likely violates data privacy policies and potentially regulations like GDPR or CCPA. Option B is correct because the proper procedure is to deny the ad-hoc export and direct the manager to use an approved work-contact list or seek a privacy review, ensuring data handling complies with organizational data governance and privacy requirements.

Answer

Provide the export because the requester is a manager with a legitimate business relationship to employees.

Answer

Send the data to the manager if the manager promises not to share it externally.

Answer

Store the export in a shared drive so multiple teams can use it for convenience.

Question 16

Before applying a major patch to a virtual machine, the administrator wants a quick way to return the VM to its exact pre-change state if the patch fails. What should the administrator create?

Accepted Answer

A snapshot of the virtual machine. A snapshot captures the exact state of the virtual machine (disk, memory, and power state) at a point in time, allowing the administrator to revert instantly if the patch fails. This is the fastest and most storage-efficient method for a quick rollback compared to a full backup, which is slower and more resource-intensive.

Answer

A full backup to removable media

Answer

A separate VLAN for the virtual machine

Answer

A digital certificate for the patch server

Question 17

Based on the exhibit, what is the best immediate action for the SOC or IR team?

A finance workstation shows evidence of a macro-launched script, followed by file renaming and lateral SMB traffic to two other hosts. The team has not yet determined the full scope of the incident.

Accepted Answer

Isolate the host from the network and revoke its remote access to stop further spread.. The exhibit shows a macro-launched script, file renaming, and lateral SMB traffic to two other hosts, indicating active lateral movement. Isolating the host (e.g., via network access control or disabling the switch port) immediately stops the spread of the malware to other systems, preserving the ability to investigate without further compromise. This aligns with the first step in incident response: containment before eradication or recovery.

Answer

Restore the workstation from backup immediately before preserving any evidence.

Answer

Run a vulnerability scan against the subnet to see whether the malware exploited an unpatched service.

Answer

Notify users to ignore the issue until the next maintenance window because the incident is likely self-limiting.

Question 18

Based on the exhibit, what type of web attack is most likely taking place?

Accepted Answer

SQL injection, because the attacker is manipulating the database query with crafted input.. Option B is correct because the exhibit shows a URL parameter (e.g., `id=1 OR 1=1`) that is being passed to a database query. The attacker is injecting SQL syntax to manipulate the query logic, which is the hallmark of SQL injection. The 500 error likely results from the database server crashing or returning an invalid result set, confirming that the injection is affecting the database.

Answer

Cross-site scripting, because the input is visible in the URL and causes an error.

Answer

Broken authentication, because the application returns a 500 error.

Answer

Insecure deserialization, because the application is parsing attacker-controlled data.

Question 19

During a disaster recovery test, what is the most important thing to confirm about the backup?

Accepted Answer

That the data can be restored and is usable after recovery.. The most important thing to confirm about a backup during a disaster recovery test is that the data can be restored and is usable after recovery. This validates the integrity and completeness of the backup, ensuring that the recovery point objective (RPO) and recovery time objective (RTO) can be met. Simply verifying that backup files exist does not guarantee they are not corrupted or that the restoration process will succeed, which is why a full restore test is critical.

Answer

That the backup files exist in storage.

Answer

That the backup system uses encryption.

Answer

That the backup is stored on tape instead of disk.

Question 20

Based on the exhibit, what wireless threat is most likely occurring?

Accepted Answer

Evil twin access point. The exhibit shows a legitimate access point (SSID: 'CorpNet') with a second, rogue access point broadcasting the same SSID but with a stronger signal. This is the classic behavior of an evil twin attack, where an attacker sets up a fraudulent AP to intercept client connections and capture credentials or sensitive data. The victim's device automatically associates with the stronger signal, believing it is the legitimate network.

Answer

Bluetooth pairing abuse

Answer

NFC skimming

Answer

DNS poisoning