SY0-701 Practice Test 21 — 15 Questions

Question 1

Based on the exhibit, which change best improves accountability while still allowing emergency access?

A finance team uses the following shared account on a jump host:

07:55:12  Account=FIN-ADMIN  Action=ApproveInvoice   Host=JUMP-02  IP=10.30.8.21
07:56:03  Account=FIN-ADMIN  Action=ChangeVendorBank Host=JUMP-02  IP=10.30.8.21
07:57:44  Account=FIN-ADMIN  Action=ExportReport     Host=JUMP-02  IP=10.30.8.21

Note: FIN-ADMIN is used by three finance managers during after-hours support.

Accepted Answer

Replace the shared account with named user accounts, role-based access, and a separate break-glass account for rare emergencies.. Replacing the shared account with named user accounts ensures individual accountability through unique credentials and audit trails, while a separate break-glass account provides emergency access without compromising security. This aligns with the principle of least privilege and non-repudiation, as each finance manager's actions are logged under their own identity, and the break-glass account can be tightly controlled and monitored for rare use.

Answer

Require the shared account password to be changed every 24 hours.

Answer

Enable automatic account lockout after five failed logons.

Answer

Restrict the jump host by MAC address and subnet only.

Question 2

Which action is the best example of accounting in AAA?

Accepted Answer

The system records the username, timestamp, and files opened during the session.. Accounting in AAA (Authentication, Authorization, and Accounting) focuses on tracking user activities and resource usage. Option B correctly describes this by specifying the recording of username, timestamp, and files accessed, which are typical audit log entries used for monitoring and compliance.

Answer

The system checks a password and a one-time code before allowing access.

Answer

The system grants access to the finance folder after the user is approved.

Answer

The system forces the user to change their password after 90 days.

Question 3

Based on the exhibit, which item is the strongest evidence that quarterly privileged access reviews occurred?

Accepted Answer

Signed access review spreadsheet with reviewer, date, and exceptions.. A signed access review spreadsheet with reviewer, date, and exceptions provides direct, non-repudiable evidence that a formal review of privileged access was completed. Unlike logs or policies, it explicitly documents the reviewer's identity, the date of review, and any exceptions, satisfying audit requirements for quarterly privileged access reviews.

Answer

SIEM export of administrator logins.

Answer

Help desk ticket for a password reset.

Answer

Screenshot of the access review policy.

Question 4

NetFlow shows one user workstation making authenticated SMB and WinRM connections to more than 40 internal hosts within 15 minutes, starting shortly after the user opened a spreadsheet attachment. No approved admin tool was running on the device. What is the best initial response?

Accepted Answer

Isolate the workstation and begin investigating for credential compromise or lateral movement. The sudden burst of authenticated SMB and WinRM connections from a single workstation to over 40 internal hosts immediately after opening a spreadsheet attachment is a classic indicator of lateral movement using stolen credentials. Since no approved admin tool was running, this behavior strongly suggests the user's credentials have been compromised, likely via a macro or exploit in the attachment, and an attacker is using those protocols to move laterally. Isolating the workstation stops the attack in progress and preserves evidence for forensic investigation.

Answer

Treat the traffic as normal because the workstation used valid credentials

Answer

Increase the DHCP lease time to reduce network noise

Answer

Block all SMB and WinRM traffic across the entire enterprise

Question 5

A web team is moving a customer portal behind a new inspection device. They need something that can examine HTTP requests, block malicious patterns like injection attempts, and still allow normal browsing. Which control is most appropriate?

Accepted Answer

WAF, because it understands web requests and can block malicious application-layer traffic.. A WAF (Web Application Firewall) is the correct choice because it operates at Layer 7 (application layer) and is specifically designed to inspect HTTP/HTTPS traffic. It can parse web requests, identify malicious patterns such as SQL injection or XSS payloads, and block them while allowing legitimate traffic to pass through to the customer portal.

Answer

IDS, because it alerts on suspicious traffic without affecting application delivery.

Answer

DLP, because it can stop sensitive data from being posted to the portal.

Answer

NAC, because it verifies whether devices are allowed onto the network.

Question 6

A development team wants to deploy a new internal application without managing operating system patching, runtime updates, or automatic scaling. The security team still wants the company to control the application code and its data access settings. Which cloud service model best fits this need?

Accepted Answer

Platform as a Service, because the provider manages the platform and the company manages the application and data.. Platform as a Service (PaaS) is the correct choice because the provider manages the underlying platform—including OS patching, runtime updates, and automatic scaling—while the company retains control over the application code and data access settings. This aligns with the shared responsibility model where the customer is responsible for the application and data, not the infrastructure.

Answer

Infrastructure as a Service, because the company can ignore guest OS patching entirely.

Answer

Software as a Service, because the team can deploy custom application code inside the vendor portal.

Answer

On-premises hosting, because the company can still use the provider's patching tools.

Question 7

Based on the exhibit, what should the employee do first?

Accepted Answer

Report the message through the company’s phishing-report process and do not share the code.. The message exhibits classic social engineering indicators: an unsolicited request for a sensitive code, urgency, and a spoofed sender address. The employee must report it via the company's phishing-report process to alert the security team and must not share the code, as that would compromise the account. This aligns with security awareness training that emphasizes verifying requests out-of-band and never providing credentials or codes in response to email requests.

Answer

Reply with the code because the request appears to come from payroll support.

Answer

Forward the email to coworkers so they can watch for the same request.

Answer

Open the attached file to see whether it contains the payroll fix details.

Question 8

A SIEM correlates VPN authentication logs and sees 14 different user accounts receive one failed login attempt each from the same source IP during a 5-minute window. A few minutes later, one of those accounts successfully authenticates from that same IP. Which attack is most likely?

Accepted Answer

Password spraying using a common password against many accounts.. The SIEM observed 14 different user accounts each receiving a single failed login attempt from the same source IP within a 5-minute window, followed by one account successfully authenticating. This pattern is characteristic of password spraying, where an attacker tries a common password (e.g., 'Password123') against many accounts to avoid triggering account lockouts, then leverages a successful guess. The single failure per account avoids the threshold for brute-force detection, and the eventual success confirms a guessed credential.

Answer

Brute-force attack against a single account using many passwords.

Answer

Replay attack using previously captured authentication traffic.

Answer

ARP poisoning used to intercept local network traffic.

Question 9

An employee receives an email from someone claiming to be from IT. The message says the employee must read back a one-time verification code so their mailbox can be 'repaired.' What social engineering technique is being used?

Accepted Answer

Pretexting, because the attacker is using a fake identity and story to gain trust.. The attacker is using a fabricated identity (IT support) and a false scenario (mailbox repair requiring a verification code) to manipulate the employee into divulging sensitive information. This is the classic definition of pretexting, where the attacker creates a believable pretext to lower the victim's defenses and extract data or access.

Answer

Tailgating, because the attacker is trying to enter a secure area physically.

Answer

DDoS, because the message is designed to overwhelm the mailbox server.

Answer

Shoulder surfing, because the attacker is watching the screen from nearby.

Question 10

A system administrator must run a weekly patch-and-restart job on 80 Linux servers without logging in interactively. The job should be repeatable, auditable, and limited to only the required maintenance commands. What is the best approach?

Accepted Answer

Use a configuration management tool with a dedicated service account and restricted sudo permissions.. B is correct because configuration management tools (e.g., Ansible, Puppet, or SaltStack) allow you to define a repeatable, auditable patch-and-restart job using a dedicated service account with restricted sudo permissions. This approach enforces the principle of least privilege, logs all actions via the tool's job history, and eliminates the need for interactive login, meeting all requirements for automation, auditability, and command restriction.

Answer

Share a root SSH key with the operations team so anyone can run the job.

Answer

Have each administrator log in manually and run the commands from an interactive shell.

Answer

Create a local root account on every server for maintenance tasks.

Question 11

Drag and drop the steps to implement a backup strategy following the 3-2-1 rule into the correct order.

Accepted Answer

Step 1: Create primary backup on one medium; Step 2: Create second backup on different medium; Step 3: Store one copy offsite; Step 4: Regularly test backup restoration.. The 3-2-1 rule ensures redundancy: three copies, two different media, one offsite. Testing is crucial to verify recoverability.

Answer

Step 1: Create primary backup on one medium; Step 2: Store one copy offsite; Step 3: Create second backup on different medium; Step 4: Regularly test backup restoration.

Answer

Step 1: Create primary backup on one medium; Step 2: Create second backup on same medium; Step 3: Store both copies offsite; Step 4: Regularly test backup restoration.

Answer

Step 1: Store one copy offsite; Step 2: Create second backup on different medium; Step 3: Create primary backup on one medium; Step 4: Regularly test backup restoration.

Question 12

An online retailer is redesigning a network for a public web app. Customers must reach only the web tier from the internet. The web tier must reach the application tier, and the application tier must reach the database tier. Which two design changes best support this zoning model? Select two.

Accepted Answer

Put the internet-facing web tier in a DMZ with tightly filtered inbound rules.. Placing the internet-facing web tier in a DMZ (demilitarized zone) with tightly filtered inbound rules ensures that external users can only reach the web servers, while the DMZ network isolates them from internal tiers. This aligns with the principle of defense in depth, where the DMZ acts as a buffer zone, and inbound rules (e.g., allowing only TCP/443 for HTTPS) minimize the attack surface. The web tier can then initiate outbound connections to the application tier through a firewall with specific allow-lists, maintaining strict segmentation.

Answer

Place all three server tiers on the same flat VLAN and rely on host firewalls.

Answer

Give the database server a public IP address so the web tier can connect faster.

Answer

Use a single NAT device for all servers and disable interserver filtering.

Question 13

A support portal has a search field that accepts customer last names. After a tester enters a single quote, the application returns a database syntax error. Which attack is the tester most likely trying to verify?

Accepted Answer

SQL injection. The tester is most likely trying to verify a SQL injection vulnerability. Entering a single quote into a search field that interacts with a database can break the SQL query syntax if user input is improperly sanitized, causing the database to return a syntax error. This error indicates that the input is being directly concatenated into a SQL statement, confirming the presence of a SQL injection flaw.

Answer

Cross-site scripting (XSS)

Answer

CSRF

Answer

SSRF

Question 14

Employees use a browser-based SaaS portal, a native expense app, and an internal API. The company wants one corporate identity, API access without separate passwords, and automatic account removal when HR disables a user. Which solution best fits?

Accepted Answer

Use OpenID Connect federation with OAuth 2.0 access tokens and SCIM provisioning.. OpenID Connect (OIDC) federation with OAuth 2.0 provides a single corporate identity (federated SSO), allows API access without separate passwords (using access tokens), and SCIM provisioning automates account removal when HR disables a user. This combination meets all three requirements: unified identity, passwordless API access, and lifecycle management.

Answer

Use LDAP binds directly against each application and manage local passwords separately.

Answer

Use shared local accounts in each application and sync passwords nightly from the directory.

Answer

Use Kerberos constrained delegation to each vendor tenant for every application.

Question 15

Drag and drop the steps to configure a VPN tunnel using IPsec in tunnel mode into the correct order.

Accepted Answer

Configure IKE policy, then configure IPsec transform set, then create crypto map, then apply crypto map to the interface.. IPsec VPN setup involves two phases: IKE for key exchange, then IPsec for data encryption; the crypto map ties it to an interface.

Answer

Configure IKE policy, then create crypto map, then configure IPsec transform set, then apply crypto map to the interface.

Answer

Create crypto map, then configure IKE policy, then apply crypto map to the interface, then configure IPsec transform set.

Answer

Configure IPsec transform set, then configure IKE policy, then create crypto map, then apply crypto map to the interface.