SY0-701 Practice Exam 3 — 20 Questions

Question 1

A company is building a public web app with three tiers. Internet users should reach only the web tier, and the app tier should never be reachable from the internet. Which two network design choices support this goal? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the web server in a DMZ or public-facing zone.. Placing the web server in a DMZ (demilitarized zone) or public-facing zone allows internet traffic to reach only the web tier while isolating the internal network. This is a standard security architecture where the DMZ acts as a buffer, and firewall rules permit inbound HTTP/HTTPS (ports 80/443) only to the web servers, not to the application or database tiers.

Answer

Allow inbound traffic from the internet directly to the application servers.

Answer

Put the database on the guest Wi-Fi VLAN.

Answer

Use the same flat network for all three tiers.

Question 2

HR stores scanned government IDs collected during onboarding. The retention policy says the files may be kept for 90 days after employment verification, then destroyed. What should security require?

Accepted Answer

Store the files in an encrypted repository and securely dispose of them when retention expires. It aligns with the principle of data minimization and the retention policy: storing scanned government IDs in an encrypted repository ensures confidentiality and integrity, while secure disposal after the 90-day retention period meets compliance requirements (e.g., GDPR, HIPAA) and reduces risk of data breaches. Security must enforce both protection during storage and timely destruction to prevent unauthorized access or legal liability.

Answer

Keep the files indefinitely in case a future audit asks for them

Answer

Move the files to a shared folder so more HR staff can access them

Answer

Print the scanned IDs and place them in a locked cabinet instead of keeping digital copies

Question 3

Based on the exhibit, which key management improvement best preserves recoverability if the primary backup server is lost?

Accepted Answer

Keep the private key in an HSM or secure escrow with tested recovery procedures.. Storing the private key in a Hardware Security Module (HSM) or secure escrow ensures it remains available even if the primary backup server is lost. HSMs provide tamper-resistant key storage and support tested recovery procedures, which is critical for decrypting backups and maintaining recoverability. This approach separates the key from the backup data, preventing a single point of failure.

Answer

Store the private key on the same backup server so recovery is faster.

Answer

Replace AES with hashing so the archive no longer needs a key.

Answer

Send the private key to backup operators by email so they can restore data quickly.

Question 4

A security analyst is reviewing the organization’s security awareness program. Which three of the following are key metrics that demonstrate the effectiveness of the program? (Choose three.)

Accepted Answer

Total count of security incidents reported by employees. The percentage of employees who complete annual security training is a key metric because it measures participation in the foundational awareness activity. The number of phishing simulation clicks before and after training directly quantifies behavioral change, showing whether training reduces susceptibility to social engineering. The total count of security incidents reported by employees indicates whether the program has successfully fostered a culture of reporting, which is critical for early threat detection.

Answer

Percentage of servers with full disk encryption enabled

Answer

Average time to patch critical vulnerabilities in production systems

Answer

Number of firewall rule changes approved per quarter

Question 5

A user receives a phone call from someone who claims to be a member of the company's IT support team. The caller states that the user's account has been compromised and requests the user's username, password, and the current multi-factor authentication (MFA) code to 'verify identity and secure the account.' Which type of social engineering attack is being attempted?

Accepted Answer

Vishing. B is correct because vishing (voice phishing) is a social engineering attack conducted over the phone, where the attacker impersonates a trusted entity (IT support) to trick the victim into revealing sensitive information such as credentials and MFA codes. The request for the current MFA code is a key indicator, as it would allow the attacker to bypass multi-factor authentication in real time.

Answer

Spear phishing

Answer

Pretexting

Answer

Tailgating

Question 6

A security architect is designing a new data center network that will host public-facing web servers and internal application servers handling confidential employee data. The architect places the web servers in a DMZ and the internal application servers on a separate internal network segment. A stateful firewall is configured to allow inbound HTTP/HTTPS traffic from the internet to the web servers only. The firewall also permits only the web servers to initiate outbound connections to the internal application servers on a specific TCP port, and all such traffic is encrypted using TLS. Which security architecture principle is this design primarily intended to enforce?

Accepted Answer

Defense in depth. The design enforces defense in depth by layering multiple security controls: a DMZ isolates public-facing web servers from internal networks, a stateful firewall restricts inbound traffic to HTTP/HTTPS only, and outbound connections from web servers to internal application servers are limited to a specific TCP port with TLS encryption. This layered approach ensures that even if one control fails (e.g., a web server is compromised), the attacker still faces additional barriers to reach sensitive internal systems.

Answer

Least privilege

Answer

Separation of duties

Answer

Zero trust

Question 7

A security analyst receives an alert from the intrusion detection system indicating that a workstation in the finance department has established an outbound connection to a known malicious IP address using an encrypted protocol. The analyst verifies the alert and checks the user's activity logs, which show no legitimate business reason for the connection. According to the incident response process, what should the analyst do NEXT?

Accepted Answer

Isolate the workstation from the network to contain the threat.. According to the NIST SP 800-61 incident response process, containment is the immediate priority after verification to prevent further damage or data exfiltration. Since the workstation has an active encrypted outbound connection to a known malicious IP with no legitimate business reason, isolating the network interface (e.g., disabling the port, blocking the MAC address, or unplugging the cable) stops the threat from communicating while preserving the system state for later analysis. This aligns with the containment phase, which must precede eradication or full forensic analysis.

Answer

Begin the eradication phase by immediately reimaging the workstation.

Answer

Conduct a full forensic analysis of the workstation's hard drive.

Answer

Update the firewall rule to block all outbound traffic to the malicious IP.

Question 8

A Java web service accepts a Base64-encoded `profile` object from the browser. During testing, changing a serialized field from `role=user` to `role=admin` causes a deserialization error unless the original signed blob is reused. When a captured valid blob is modified only slightly, the application reconstructs a different class and then exposes an internal admin page. Which attack pattern is most likely?

Accepted Answer

Insecure deserialization, because untrusted serialized data is being reconstructed into server-side objects.. The scenario describes a classic insecure deserialization attack. The Java web service accepts a Base64-encoded serialized object from the browser and reconstructs it into server-side objects without integrity verification. When the attacker modifies a serialized field (role=user to role=admin), the application deserializes the tampered data, which causes a deserialization error unless the original signed blob is reused, but a slight modification reconstructs a different class and exposes an internal admin page. This directly matches the OWASP Top 10 insecure deserialization pattern where untrusted data is deserialized, leading to object injection and privilege escalation.

Answer

SQL injection, because the attacker is changing a field to access a different page.

Answer

Cross-site request forgery, because the browser is sending a forged request to the application.

Answer

Cross-site scripting, because the modified object exposes an internal admin page.

Question 9

Based on the exhibit, what is the best conclusion about the signed document?

Accepted Answer

The invoice was not changed after signing and the signer’s certificate chain validated correctly.. A valid digital signature provides both integrity (the document was not altered after signing) and authentication (the signer's certificate chain validates to a trusted root). The exhibit shows a successful signature validation, which cryptographically proves that the invoice has not been modified since signing and that the signing certificate is trusted.

Answer

The invoice is confidential because the signature encrypts the document contents.

Answer

The invoice can be edited if the timestamp is still within business hours.

Answer

The sender’s private key is now public because the certificate verified successfully.

Question 10

A business unit wants to keep using a customer portal even though a low-likelihood, high-impact dependency risk was identified. Leadership does not want to stop the service, but it does want to lower exposure and formally document the remaining risk. Which two actions best fit that approach? Select two.

Accepted Answer

Implement compensating controls to reduce the chance or impact of the event.. Implementing compensating controls is a standard risk mitigation strategy that reduces the likelihood or impact of a dependency risk without stopping the service. For a customer portal, this could include adding web application firewall (WAF) rules, rate limiting, or failover mechanisms to lower exposure while keeping the portal operational.

Answer

Immediately shut down the portal until the dependency risk is completely eliminated.

Answer

Ignore the finding until the next annual audit cycle.

Answer

Transfer the issue to the help desk by opening a routine support ticket.

Question 11

A security architect is designing a defense strategy for a database containing sensitive customer records. The architect implements a network firewall to restrict inbound traffic to only the application server, enforces file-level encryption for the database files, requires multi-factor authentication for all administrative access, and deploys a database activity monitoring system to alert on unusual queries. Which security principle is the architect primarily applying?

Accepted Answer

Defense in depth. The architect is applying defense in depth by layering multiple independent security controls: a network firewall, file-level encryption, multi-factor authentication, and database activity monitoring. This strategy ensures that if one control fails, others still provide protection, which is the core principle of defense in depth. Each layer addresses a different attack vector, making it significantly harder for an attacker to compromise the database.

Answer

Least privilege

Answer

Separation of duties

Answer

Fail safe

Question 12

A small company is moving its public web app to a new network. The front-end server must be reachable from the internet, the application server should only accept traffic from the front end, and the database must never be reachable from the internet or user VLANs. Which design best meets these requirements with the least exposure?

Accepted Answer

Place the web server in a DMZ, the application server in an internal subnet, and the database in a separate restricted subnet with firewall rules between each tier.. It implements a classic three-tier architecture with network segmentation. The web server in the DMZ is isolated from internal networks but accessible from the internet, the application server in an internal subnet is protected by firewall rules that only allow traffic from the DMZ, and the database in a separate restricted subnet is further isolated with firewall rules that only permit traffic from the application server. This design minimizes exposure by enforcing least privilege and defense in depth, using network-layer segmentation rather than relying solely on host-based controls.

Answer

Place all three servers in the same server VLAN and use host-based firewalls to separate them.

Answer

Place the database in the DMZ so the web and application servers can access it directly without extra firewall rules.

Answer

Place the web server on the user VLAN and use NAT to hide the database server from the internet.

Question 13

A company is redesigning how systems are separated in its office and data center network. Match each network design element to the scenario it best supports. Use each term once.

Accepted Answer

VLAN: Separates broadcast domains logically. VLANs separate broadcast domains, subnets divide IP networks, ACLs filter traffic, DMZs isolate public servers, VPNs provide secure remote access, and NAT translates private to public IPs.

Answer

ACL: Divides IP networks into smaller segments

Answer

NAT: Provides secure remote access over public internet

Question 14

Match each procurement need to the vendor due diligence artifact or control that best fits.
1. Procurement wants independent evidence that a SaaS provider's controls operated effectively during the last year.
2. The team wants to know what files, libraries, and modules were included in a supplier's software build.
3. The business needs a signed agreement that defines how customer data is handled and what the vendor must do if an incident occurs.
4. The procurement team wants answers about MFA, logging, and incident response before onboarding a cloud supplier.

Accepted Answer

SOC 2 Type II: Independent evidence that a SaaS provider's controls operated effectively during the last year.. Each artifact or control directly addresses the procurement need: SOC 2 Type II provides independent audit evidence; SBOM lists software components; DPA is the legal agreement for data handling; security questionnaires gather specific security practices; pen test reports validate controls; BCP ensures continuity.

Answer

Pen test report: Independent evidence that a SaaS provider's controls operated effectively during the last year.

Answer

BCP: A signed agreement that defines how customer data is handled and what the vendor must do if an incident occurs.

Question 15

Based on the exhibit, what security issue is most likely present?

Accepted Answer

Exposed service, because management and streaming ports are listening on all interfaces and allowed from anywhere.. The exhibit shows that both the management interface (TCP 443) and the streaming interface (TCP 554) are bound to 0.0.0.0 (all interfaces) and the firewall rules allow traffic from 0.0.0.0/0 (any source). This exposes the camera's web management and RTSP streaming services to the entire internet, making it vulnerable to unauthorized access, reconnaissance, and potential exploitation. An exposed service of this nature is a common entry point for attackers to compromise IoT devices.

Answer

Weak permissions, because the camera streams video to multiple ports.

Answer

Default credentials, because the admin login is enabled.

Answer

Outdated component, because firmware version 1.0.3 is listed.

Question 16

A security analyst is reviewing the session management implementation of a web application. The application generates session tokens by computing the MD5 hash of the concatenation of the username and the current server timestamp rounded to the nearest hour. An attacker has obtained a valid session token for her own account and discovers that she can forge tokens for other users by simply substituting the username in the hash calculation with a known target username. Which type of attack is the web application most vulnerable to?

Accepted Answer

Session prediction. The session token is generated using MD5(username + timestamp rounded to the nearest hour). Since the attacker knows her own token and can compute the hash for any username with the same timestamp, she can predict tokens for other users. This is a classic session prediction vulnerability, as the token generation lacks sufficient entropy and relies on predictable inputs.

Answer

Session hijacking via cross-site scripting (XSS)

Answer

Session replay attack

Answer

Session fixation

Question 17

In a virtualized environment, several workloads share the same physical host and the same IP subnet. After one payroll VM is compromised, the security team wants to prevent that VM from freely scanning or reaching the other workloads on the host. Which control best addresses this lateral-movement risk?

Accepted Answer

Microsegmentation with policy rules applied per workload or per VM. Microsegmentation allows granular security policies to be applied per workload or per VM, even within the same subnet and on the same hypervisor. By enforcing firewall rules at the virtual switch or hypervisor level, it prevents a compromised payroll VM from scanning or communicating laterally with other VMs on the same host, directly addressing the lateral-movement risk.

Answer

Expanding the subnet mask so all workloads are easier to reach

Answer

Creating a shared administrator account for all virtual machines

Answer

Disabling DHCP and forcing every VM to use a static IP address

Question 18

A security analyst at a hospital is reviewing user permissions in the electronic health record (EHR) system. The analyst discovers that all nursing staff accounts are members of the 'Administrators' group, which grants full read and write access to all patient records, as well as the ability to modify system configuration settings. The nursing staff's job responsibilities only require viewing and updating records for patients currently assigned to them. Which security principle is most directly violated by this configuration?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. In this case, nursing staff only need read and write access to records of currently assigned patients, but membership in the 'Administrators' group grants full read/write access to all patient records and the ability to modify system configuration settings, which far exceeds their job requirements. This directly violates least privilege by providing excessive, unnecessary privileges that increase the risk of unauthorized access or accidental misconfiguration.

Answer

Defense in depth

Answer

Non-repudiation

Answer

Availability

Question 19

A tester enters a crafted search term into an internal web application and sees no error message, but the page response always delays by exactly five seconds when the input includes a single quote followed by a conditional sleep function. The returned results look normal, so the tester repeats the request several times and the timing remains consistent. Which attack is most likely being attempted?

Accepted Answer

Time-based blind SQL injection, because the attacker is inferring database behavior from delayed responses.. The consistent five-second delay triggered by a single quote followed by a conditional sleep function (e.g., ' OR SLEEP(5)) indicates a time-based blind SQL injection. The tester is inferring database behavior from response timing because the application does not display error messages or output differences, but the database executes a sleep command when the injected SQL is syntactically valid. This technique exploits the database's ability to conditionally pause execution, allowing an attacker to extract data bit by bit based on true/false conditions.

Answer

Reflected cross-site scripting, because the tester's input is being echoed back into the response.

Answer

Command injection, because the application is pausing while executing system-level sleep commands.

Answer

Session fixation, because the tester is manipulating how the application handles user input over time.

Question 20

A development team updates a third-party software library used by its web application. After the release, new deployments begin making unexpected outbound connections to an unfamiliar domain. What type of threat is most likely?

Accepted Answer

Dependency compromise. Dependency compromise. This scenario describes a supply chain attack where a third-party library has been maliciously altered or replaced, causing the web application to make unauthorized outbound connections to an attacker-controlled domain. Such compromises often occur when developers unknowingly integrate a tampered version of a library from a compromised repository or via a typosquatting attack, leading to data exfiltration or command-and-control (C2) communication.

Answer

Phishing

Answer

Rootkit infection

Answer

Password spraying