SY0-701 Practice Exam 3 — 20 Questions

Question 1

Based on the exhibit, which security principle is the proposed workflow most directly enforcing?

Accepted Answer

Separation of duties, because no single person can create, approve, and implement the same production change.. The proposed workflow enforces separation of duties by requiring three distinct roles—requester, approver, and implementer—to complete a single firewall change. No single person can both create and approve the change, nor can they implement it without prior approval. This directly prevents any one individual from having end-to-end control over a production change, which is the core of separation of duties.

Answer

Least privilege, because each person gets only the minimum access needed for the task.

Answer

Defense in depth, because multiple layers of security are added around firewall changes.

Answer

Need-to-know, because the ticket is visible only to assigned people.

Question 2

Based on the exhibit, which cloud deployment choice best satisfies the workload requirements?

Exhibit:
Workload requirements:
- Processes regulated customer records
- Should not share underlying compute with other tenants if avoidable
- Team wants provider-managed hardware maintenance
- Application will run in a public cloud

Which deployment choice is the best fit?

Accepted Answer

Public cloud with a dedicated host or equivalent single-tenant compute placement.. Option C is correct because a dedicated host or single-tenant compute placement in a public cloud ensures the workload does not share underlying physical hardware with other tenants, meeting the 'should not share underlying compute' requirement. It also provides provider-managed hardware maintenance and runs in a public cloud, aligning with all stated workload requirements for processing regulated customer records.

Answer

Shared public tenancy on standard virtual machines.

Answer

Community cloud shared with other regulated organizations.

Answer

On-premises private cloud with company-owned servers and full hardware management.

Question 3

Based on the exhibit, which change best improves recovery resilience against a repeat ransomware incident?

Accepted Answer

Use an immutable or offline backup copy that production credentials cannot modify.. Option C is correct because ransomware often encrypts or deletes accessible backups. An immutable or offline backup copy (e.g., using S3 Object Lock, Write Once Read Many (WORM) storage, or air-gapped tape) ensures that even if production credentials are compromised, the backup data cannot be modified or deleted by the attacker. This directly preserves a clean recovery point after a ransomware incident.

Answer

Keep the current design and add more NAS storage capacity.

Answer

Move the NAS to the same subnet as the file server for faster backups.

Answer

Shorten the backup retention period to reduce storage use.

Question 4

Based on the exhibit, which identity architecture change best addresses the repeated password resets and delayed offboarding across the company's SaaS applications?

Exhibit:
- SaaS A uses local user accounts
- SaaS B uses local user accounts
- SaaS C supports SAML and automated provisioning
- Help desk reports 120 password reset tickets per month
- Former employees can remain active in two apps for up to 24 hours after termination

Management wants one sign-in and faster deprovisioning.

Accepted Answer

Implement federated SSO with the enterprise identity provider and automated provisioning for SaaS users.. Option A is correct because implementing federated SSO with the enterprise identity provider (IdP) centralizes authentication, allowing users to sign in once. Combined with automated provisioning (SCIM), it enables near-instant deprovisioning when an employee is terminated, eliminating the 24-hour delay and reducing password reset tickets by removing the need for local account management.

Answer

Create one shared account for each application and store the passwords in a vault.

Answer

Keep local accounts in every SaaS app and reset passwords whenever staff change roles.

Answer

Put the SaaS apps behind a network firewall and use source IP filtering instead of identity.

Question 5

Based on the exhibit, which issue should be remediated first by the operations team?

A small company has limited maintenance windows and can address only one of several findings this week.

Accepted Answer

vpn-gw01, because it is internet-facing, exploitable now, and a fix is available.. Option C is correct because vpn-gw01 is internet-facing, has an active exploit (CVSS score indicating current exploitation), and a vendor patch is available. In risk management, the highest priority is given to assets that are exposed to the internet, currently exploitable, and have a known fix, as this combination presents the most urgent threat to the organization's security posture.

Answer

db-lab02, because high-severity findings always outrank medium and critical findings.

Answer

printsrv03, because it is internet-facing and has no vendor patch available.

Answer

None of these, because the team should wait for the next quarterly review before changing anything.

Question 6

During malware response on a finance workstation, the system is still powered on and connected. The manager asks whether you can just reboot it to stop the issue. What is the best next step?

Accepted Answer

Capture volatile evidence and document the system state before containment actions.. Option B is correct because in incident response, the first priority when a system is still powered on is to capture volatile evidence (e.g., memory contents, running processes, network connections) before any containment actions like rebooting. Rebooting would destroy this critical data, which may be essential for forensic analysis and understanding the malware's behavior. The order of volatility (RFC 3227) dictates that volatile data must be collected first to preserve evidence integrity.

Answer

Reboot immediately to prevent any further damage from the suspected malware.

Answer

Copy suspicious files to a shared drive and continue normal operations.

Answer

Run a full disk cleanup to remove temporary files and reduce risk.

Question 7

Based on the exhibit, which key management improvement best preserves recoverability if the primary backup server is lost?

Accepted Answer

Keep the private key in an HSM or secure escrow with tested recovery procedures.. Option C is correct because storing the private key in a Hardware Security Module (HSM) or secure escrow ensures it remains available even if the primary backup server is lost. HSMs provide tamper-resistant key storage and support tested recovery procedures, which is critical for decrypting backups and maintaining recoverability. This approach separates the key from the backup data, preventing a single point of failure.

Answer

Store the private key on the same backup server so recovery is faster.

Answer

Replace AES with hashing so the archive no longer needs a key.

Answer

Send the private key to backup operators by email so they can restore data quickly.

Question 8

Based on the exhibit, which network change best isolates finance workstations from general user PCs while still allowing printing and application access?

VLAN table:
- VLAN 20 Users: 10.20.20.0/24
- VLAN 30 Finance: 10.20.30.0/24
- VLAN 40 Printers: 10.20.40.0/24
- VLAN 50 Accounting App: 10.20.50.0/24

Current SVI routing policy:
permit ip any any

Management goal:
Finance devices must not initiate traffic to User VLAN 20, but they must be able to print and access the accounting application.

Accepted Answer

Add inter-VLAN ACLs that deny Finance VLAN access to User VLAN 20 while permitting Finance VLAN traffic to VLAN 40 and VLAN 50.. Option B is correct because it uses inter-VLAN ACLs to enforce the principle of least privilege: denying traffic from the Finance VLAN (10.20.30.0/24) to the User VLAN (10.20.20.0/24) while explicitly permitting traffic to the Printer VLAN (10.20.40.0/24) and the Accounting App VLAN (10.20.50.0/24). This preserves the required segmentation and still allows the necessary services (printing and application access) without altering the existing VLAN structure or routing policy.

Answer

Put finance workstations on the same VLAN as the printers to simplify access.

Answer

Remove routing between all VLANs and let users print through email attachments.

Answer

Place the accounting application in the User VLAN so finance devices no longer need segmentation.

Question 9

Based on the exhibit, which issue should be remediated FIRST?

The team can only fully fix one issue today. Management wants the choice that best reduces real-world risk, not just the highest severity score.

Accepted Answer

Internet-facing VPN appliance. The Internet-facing VPN appliance is the highest priority because it is directly exposed to untrusted networks (the Internet), making it the most likely entry point for attackers. A compromise here could lead to full network access, bypassing all other security controls, which represents the greatest real-world risk regardless of its severity score.

Answer

Internal HR file server

Answer

Lab workstation

Answer

DMZ reporting server

Question 10

EDR flags a workstation after a word processor launches encoded PowerShell and the host begins contacting a rare domain over HTTPS. The user is still active. What is the best containment action from the EDR console?

Accepted Answer

Isolate the endpoint from the network while keeping it powered on.. Isolating the endpoint from the network while keeping it powered on is the best containment action because it immediately cuts off the command-and-control (C2) communication over HTTPS to the rare domain, preventing further data exfiltration or lateral movement, while preserving volatile memory and running processes for forensic analysis. This aligns with incident response best practices where containment must prioritize stopping the threat without destroying evidence.

Answer

Delete the suspicious PowerShell process from the console and close the alert.

Answer

Reimage the workstation immediately to return it to a clean state.

Answer

Power the workstation off and disconnect the SSD to preserve data.

Question 11

During a restore test, a technician brings back a file server successfully, but the application team discovers that the database is missing the last 12 hours of transactions. Management says the business can tolerate only one hour of data loss. What should be changed first?

Accepted Answer

Implement application-consistent backups or transaction log backups more frequently.. The core issue is that the database is missing 12 hours of transactions, which exceeds the business's tolerance of one hour of data loss. This indicates that the Recovery Point Objective (RPO) is not being met. Implementing application-consistent backups or more frequent transaction log backups ensures that the database state can be recovered to a point within the acceptable loss window, directly addressing the RPO gap.

Answer

Reduce the restore point objective by storing more copies of the same backup.

Answer

Extend the retention period so the full backup is kept for 90 days.

Answer

Shorten the recovery time objective by using faster storage for the server.

Question 12

Company-owned tablets run both business apps and approved personal apps. Which two controls best keep company data separated and support selective wipe? Select two.

Accepted Answer

Mobile device management with a work profile or container for corporate data.. Option A is correct because Mobile Device Management (MDM) with a work profile or container creates a separate, encrypted partition on the device for corporate data. This container enforces policies (e.g., app whitelisting, VPN) and isolates business apps from personal apps, ensuring that company data remains protected even if the personal side is compromised.

Answer

Allow users to install any app if they promise not to open work files.

Answer

Store corporate files in the personal photo gallery for easier backup.

Answer

Disable screen locks so users can access business apps faster.

Question 13

During testing of a shopping portal, a POST request to /api/address/update succeeds even when the anti-CSRF token is removed. In a separate test, changing customerId=1842 to customerId=1843 in a GET request returns another user's invoice data. Which two vulnerabilities are present? Select two.

Accepted Answer

Cross-site request forgery is present because the state-changing request works without a valid anti-CSRF token.. Option A is correct because the POST request to /api/address/update succeeds without the anti-CSRF token, which means the application does not validate the origin of the request. This allows an attacker to forge a cross-site request that changes the victim's address without their knowledge, a classic CSRF vulnerability.

Answer

SQL injection is present because the customerId value changes in the URL.

Answer

Cross-site scripting is present because the invoice data is returned in the browser.

Answer

Insecure deserialization is present because the request uses JSON-like parameters.

Question 14

HR needs to share a copy of employee records with a benefits contractor for testing. The contractor only needs names and coverage selections, not Social Security numbers or bank details. Which two actions best satisfy data handling requirements? Select two.

Accepted Answer

Redact or mask unnecessary sensitive fields before sharing the file.. Option A is correct because redacting or masking sensitive fields like Social Security numbers and bank details ensures that the contractor receives only the necessary data (names and coverage selections) while protecting personally identifiable information (PII). This aligns with the principle of data minimization and compliance with regulations such as GDPR or HIPAA, which require that only the minimum necessary data be shared for a specific purpose. Masking techniques, such as replacing SSNs with placeholders or applying irreversible hashing, prevent unauthorized exposure even if the file is intercepted.

Answer

Send the full employee record set because the contractor is trusted.

Answer

Upload the file to a public collaboration site so the contractor can retrieve it easily.

Answer

Keep an unrestricted copy on multiple shared drives for convenience.

Question 15

During testing, a login form returns all user records when the tester enters ' OR '1'='1 in a username field. What is the best fix for this issue?

Accepted Answer

Use parameterized queries or prepared statements. The SQL injection attack ' OR '1'='1 bypasses authentication by always evaluating to true, returning all user records. Parameterized queries (prepared statements) separate SQL logic from user input, preventing the injected string from altering the query structure. This is the industry-standard mitigation for SQL injection vulnerabilities.

Answer

Hide database error messages from the login page only

Answer

Require users to change passwords more often

Answer

Move the login page to a different URL

Question 16

Facilities sees occasional water droplets forming above the cable trays in a data room during humid afternoons. The team wants the earliest possible warning before equipment is damaged. Which control should be added?

Accepted Answer

Water leak sensors tied to environmental monitoring.. Water leak sensors tied to environmental monitoring provide the earliest possible warning by detecting moisture directly on or near the cable trays. Unlike motion detectors or badge readers, these sensors are specifically designed to alert before water reaches sensitive equipment, enabling proactive remediation.

Answer

Motion detectors connected to the alarm panel.

Answer

Badge readers on the room entrance only.

Answer

Fire suppression tests scheduled more frequently.

Question 17

Employees use several SaaS applications, and the security team wants one corporate login, MFA for unmanaged devices, and centralized account provisioning. Which architecture should be used?

Accepted Answer

Use federated single sign-on with the corporate identity provider and conditional access policies.. Federated single sign-on (SSO) with a corporate identity provider (IdP) allows users to authenticate once using their corporate credentials and access multiple SaaS applications without separate logins. Conditional access policies can enforce MFA specifically for unmanaged devices, and centralized account provisioning (e.g., via SCIM) ensures accounts are created, updated, and deprovisioned from a single directory. This architecture meets all three requirements: single corporate login, MFA for unmanaged devices, and centralized provisioning.

Answer

Create separate usernames and passwords for each SaaS application.

Answer

Share one generic account for the team so access is easier to audit.

Answer

Put all users on a VPN and let each SaaS application trust the internal network automatically.

Question 18

EDR reports that a workstation launched PowerShell from a word processor, created a scheduled task named WinUpdateSvc, and began making repeated HTTPS connections to a rare external domain. The user is still logged in to several cloud apps. Which two response actions are best to initiate from the EDR console? Select two.

Accepted Answer

Isolate the endpoint from the network to stop further communication and lateral movement.. Option A is correct because isolating the endpoint from the network immediately stops the active HTTPS command-and-control (C2) communication and prevents lateral movement to other systems. Given the suspicious chain (word processor spawning PowerShell, creating a scheduled task, and connecting to a rare external domain), this is a strong indicator of a malware infection or unauthorized remote access. Isolation preserves the forensic state while cutting off the attacker's access.

Answer

Delete the scheduled task immediately so the host returns to normal operation.

Answer

Reimage the workstation from the golden image as the first response.

Answer

Ignore the alert because the PowerShell binary is built into Windows and therefore safe.

Question 19

EDR on a finance workstation shows Outlook launching mshta.exe, followed by a scheduled task named UpdateSvc_91 and repeated HTTPS beacons to a newly registered domain. The user is still working and has not rebooted. Which two telemetry sources would best help the analyst confirm the initial execution path and determine whether the host has communicated with other suspicious infrastructure? Select two.

Accepted Answer

EDR process tree and parent-child execution telemetry, because it reveals the original application that launched the script host.. Option A is correct because EDR process tree and parent-child execution telemetry directly reveal the initial execution path, showing that Outlook launched mshta.exe. This allows the analyst to trace the attack back to the original vector (e.g., a malicious email attachment or link) and understand how the script host was invoked, which is critical for identifying the root cause of the compromise.

Answer

Spooler service logs, because mshta.exe commonly prints documents before starting network activity.

Answer

RAID controller logs, because they show whether the workstation’s storage hardware is failing.

Answer

NTP synchronization logs, because time drift is the most likely cause of the alert.

Question 20

Employees use a browser SaaS portal, a native mobile app, and an internal API. The company wants one corporate identity, reduced password reuse, and automated removal of access when HR terminates users. Which two solutions best meet the requirement? Select two.

Accepted Answer

Use federation so the SaaS apps trust the company's identity provider.. Federation (B) allows the SaaS portal, mobile app, and internal API to trust a single corporate identity provider (IdP) using standards like SAML 2.0 or OIDC. This gives employees one set of credentials, reduces password reuse, and enables centralized control. When HR terminates a user, the IdP can revoke access instantly, affecting all federated applications.

Answer

Create separate local usernames and passwords in each application for every employee.

Answer

Store passwords in a shared vault and let users retrieve them when needed.

Answer

Allow the mobile app to authenticate only from remembered devices, without central identity controls.