SY0-701 Practice Test 21 — 15 Questions

Question 1

A SIEM correlates the following: 17 failed logons against the same VPN account from one IP in 9 minutes, a successful login from that IP, creation of a new API token in the SaaS tenant, and a large export job started two minutes later. Which two interpretations are best supported? Select two.

Accepted Answer

The attacker is likely performing a brute-force password attack against a single account.. A is correct because 17 failed logons against a single VPN account from one IP in 9 minutes is a classic brute-force pattern—repeated authentication attempts targeting one username. The subsequent successful login, API token creation, and data export indicate the attacker gained access and then established persistence (via the token) to exfiltrate data, confirming the account was compromised.

Answer

The pattern is most consistent with password spraying across many accounts.

Answer

The events primarily indicate a volumetric denial-of-service attack.

Answer

Token creation proves the account password was never exposed.

Question 2

A SOC analyst sees 38 failed logins for a finance user account from one public IP address over 4 minutes, followed by one successful login. What should the analyst do first?

Accepted Answer

Correlate the authentication logs with user activity and VPN records to verify whether the login pattern is expected.. Option B is correct because the analyst must first verify whether the failed logins followed by a successful login represent a brute-force attack or legitimate behavior, such as a user mistyping their password and then succeeding. Correlating authentication logs with user activity and VPN records helps confirm if the public IP belongs to a known remote user or VPN endpoint, which is a standard first step in incident response to avoid false positives.

Answer

Immediately delete the account to stop any further access attempts.

Answer

Assume the account is compromised and notify all users to change their passwords.

Answer

Close the alert because one successful login means the activity was normal.

Question 3

A security team configures the SIEM to alert when a user account has several failed logins followed by a successful login from a new location. What type of control is this?

Accepted Answer

Detective control, because it identifies suspicious activity after the event has started.. This is a detective control because the SIEM is configured to monitor and analyze log data after events have occurred, specifically identifying a pattern of several failed logins followed by a successful login from a new location. The alert does not prevent or block the login; it only notifies the security team of potentially suspicious activity that has already taken place, allowing them to investigate further.

Answer

Preventive control, because it blocks the login attempt before it occurs.

Answer

Corrective control, because it automatically fixes the account after the login succeeds.

Answer

Deterrent control, because it discourages attackers from trying to sign in.

Question 4

A security tool reports repeated DNS requests for long, random-looking subdomains under the same domain name. What is the most likely explanation?

Accepted Answer

DNS tunneling used to hide command-and-control traffic.. DNS tunneling encodes non-DNS traffic (e.g., C2 commands) into DNS queries and responses, often using long, random-looking subdomains to evade detection. Repeated requests for such subdomains under a single domain are a classic indicator of data exfiltration or covert channel activity, as each query can carry a small payload.

Answer

A normal software update process from the operating system.

Answer

A successful password reset workflow for users.

Answer

A hardware failure on the network adapter.

Question 5

A SIEM analyst reviews the following sequence from a VPN and email platform over 15 minutes: 47 failed logins against different accounts from one public IP, one successful VPN login from that same IP, a new inbox forwarding rule to an external address, and a mailbox sign-in from a device never seen before. Which three findings most strongly support a password-spraying-to-compromise scenario? Select three.

Accepted Answer

Many failed logins across different usernames from the same source IP in a short time window.. Option A is correct because a high volume of failed logins against multiple accounts from a single public IP within a short time window is the hallmark of a password-spraying attack, where the attacker tries a few common passwords across many usernames to avoid account lockout. This pattern is distinct from a brute-force attack, which targets a single account with many passwords.

Answer

A workstation patch installation completed earlier that day.

Answer

The mailbox server reported normal disk utilization during the same hour.

Question 6

A manufacturer wants partner-company users to access a procurement portal using their own company identities. The manufacturer does not want to create local accounts for each partner user, but it still needs to control what those users can do in the portal. Which approach should be used?

Accepted Answer

Use federated identity with role mapping so the portal trusts each partner’s identity provider.. Federated identity with role mapping allows the manufacturer to trust authentication performed by each partner's own identity provider (IdP) using standards like SAML 2.0 or OpenID Connect. This eliminates the need for local accounts while enabling fine-grained access control through roles or attributes passed in the assertion, ensuring partners can only perform authorized actions in the portal.

Answer

Create one shared partner account for each external company and reuse the same password.

Answer

Synchronize every partner user into the manufacturer’s directory and require a separate password change.

Answer

Store partner passwords in the portal database and use password reset emails for access control.

Question 7

A security team receives a suspicious email attachment and wants to inspect its behavior safely before any user opens it. They also want a tool that can isolate the same threat if it reaches an endpoint. Which two tools or capabilities best fit this need? Select two.

Accepted Answer

EDR remote isolation capability on the endpoint.. A is correct because EDR remote isolation capability allows the security team to immediately disconnect an endpoint from the network if the suspicious attachment is executed, preventing lateral movement and data exfiltration. B is correct because sandboxing the attachment before release to users provides a safe, isolated environment to analyze the file's behavior without risking the production network. Together, these tools address both proactive analysis (sandbox) and reactive containment (EDR isolation).

Answer

DLP monitoring to prevent accidental data leakage.

Answer

A WAF filtering web requests to the application.

Answer

Port mirroring on a switch for traffic review.

Question 8

A SIEM alert shows a successful sign-in to a cloud admin portal from an unusual country, followed by mailbox forwarding-rule changes four minutes later. Which two log sources should the analyst review first to confirm whether the account was abused? Select two.

Accepted Answer

Identity provider and MFA authentication logs for the account session. Option A is correct because the identity provider (IdP) logs will show the authentication method used (e.g., SAML, OIDC) and the MFA logs will confirm whether a valid second factor was presented. If the sign-in succeeded without MFA or with a compromised token, it indicates account takeover. These logs are the first place to verify the legitimacy of the session.

Answer

Printer spooler logs from the user’s workstation

Answer

DHCP lease logs for the office network

Answer

USB device connection logs from the user’s laptop

Question 9

A small enterprise is rebuilding its public customer portal. The web front end must be reachable from the internet, the application tier should never be directly exposed, and the database must remain private even if the web server is compromised. Which two design changes best meet those goals? Select two.

Accepted Answer

Place the web front end in a DMZ behind a firewall rule allowing only HTTPS from the internet.. Option A is correct because placing the web front end in a DMZ behind a firewall rule that permits only HTTPS (TCP/443) from the internet ensures the public-facing component is isolated from internal networks. This design prevents direct inbound access to the application or database tiers, reducing the attack surface while still allowing legitimate web traffic.

Answer

Put the database on the same subnet as the web front end so internal calls have lower latency.

Answer

Allow the database to accept connections from the internet if strong passwords are used.

Answer

Disable all inbound filtering on the DMZ so troubleshooting is simpler.

Question 10

A manufacturing floor uses barcode scanners and a kiosk terminal that cannot support full endpoint agents or frequent manual patching. USB storage has previously introduced malware, and the devices only need to run one approved application and reach a backend system. Which two controls best reduce risk while preserving function? Select two.

Accepted Answer

Isolate the scanners and kiosk terminal on a dedicated VLAN that allows only the required backend ports.. Option A is correct because isolating the barcode scanners and kiosk terminal on a dedicated VLAN with strict ACLs that permit only the required backend ports (e.g., TCP 443 for HTTPS or a specific application port) prevents lateral movement from infected devices and blocks unauthorized traffic, including USB-borne malware propagation. This network segmentation does not require endpoint agents or patching, preserving the devices' limited functionality while reducing the attack surface.

Answer

Place the devices on the user VLAN so patching and support tools can reach them easily.

Answer

Allow USB storage so updates can be installed manually whenever needed.

Answer

Use local administrator accounts with shared passwords to reduce support calls.

Question 11

A SIEM correlation rule alerts when a single user account fails to authenticate 20 times in 5 minutes and then succeeds from the same source IP. What is the most likely reason the team should investigate this event?

Accepted Answer

The pattern may indicate password guessing or credential stuffing. The pattern of 20 rapid failed authentication attempts followed by a successful authentication from the same source IP is a classic indicator of a password guessing or credential stuffing attack. The attacker likely used a list of common passwords or previously compromised credentials, and the final success suggests they found a valid password. SIEM correlation rules are designed to detect such brute-force or spraying behaviors, and this event warrants immediate investigation to determine if the account is compromised.

Answer

The account was probably being used normally because the password was changed

Answer

The SIEM is misconfigured because all failed logons are false positives

Answer

The account is definitely malicious and should be deleted immediately

Question 12

A virtual file server was restored from last night’s backup. The service is online, but some finance users report missing spreadsheet changes and a few files show a 'recovered copy' timestamp. Which two checks should be completed before the team accepts the restore as successful? Select two.

Accepted Answer

Compare restored data against backup hashes or a manifest to verify that the copy is complete and uncorrupted.. Option A is correct because comparing restored data against backup hashes or a manifest ensures the data integrity and completeness of the restore process. Even though the file server is online, missing spreadsheet changes and 'recovered copy' timestamps suggest possible corruption or incomplete restoration. Verifying hashes (e.g., SHA-256) against a known-good manifest confirms that every file was restored without bit-rot or truncation, which is a standard post-restore validation step in backup and recovery procedures.

Answer

Assume the restore is acceptable because the file server is online and users can browse shares.

Answer

Delete the previous night’s backup so the team will not accidentally restore it again.

Answer

Expose the restored server directly to the internet so remote users can test it faster.

Question 13

A SOC analyst detects that a user's workstation is sending large volumes of data to an unusual external IP address during non-business hours. The analyst has already isolated the workstation by disconnecting it from the network. What is the NEXT step in the incident response process?

Accepted Answer

Perform a forensic analysis of the workstation to collect evidence. After isolating the workstation, the next step in the incident response process is to perform forensic analysis to collect evidence. This aligns with the NIST SP 800-61 framework, where containment (isolation) is followed by eradication and recovery, but evidence collection must occur before any destructive actions like reimaging. The forensic analysis preserves volatile data (e.g., memory, network connections) and non-volatile data (e.g., disk artifacts) to determine the scope and cause of the data exfiltration.

Answer

Reimage the workstation to remove any malware

Answer

Reset the user's password to prevent further unauthorized access

Answer

Notify law enforcement immediately

Question 14

A SOC analyst confirms that an employee entered credentials into a phishing site and that the mailbox now shows a new forwarding rule sending messages to an external address. The account is still signed in on a laptop and a mobile phone. What is the best next action?

Accepted Answer

Revoke active sessions and force a password reset for the account.. Option B is correct because the immediate priority is to contain the compromised account by terminating all active sessions (revoking OAuth tokens, clearing SAML sessions) and forcing a password reset to prevent further unauthorized access. The mailbox forwarding rule indicates the attacker has established persistence, and the active sessions on the laptop and mobile phone mean the attacker could still be using the account. Revoking sessions ensures the attacker cannot continue exfiltration or lateral movement, while the password reset invalidates the stolen credentials.

Answer

Wait for the user to log out naturally before taking action.

Answer

Archive the mailbox and close the ticket after notifying the user.

Answer

Delete the forwarding rule only and consider the incident closed.

Question 15

A monthly scan finds a critical remote-code-execution vulnerability on an internet-facing VPN appliance. The vendor has not released a patch for six weeks, but the service must stay online. Which short-term action is the best risk treatment?

Accepted Answer

Apply compensating controls such as strict access filtering, MFA, enhanced logging, and alerting.. Option B is correct because when a patch is unavailable for a critical vulnerability, compensating controls reduce risk without taking the service offline. For an internet-facing VPN appliance, strict access filtering (e.g., limiting source IPs via ACLs), enforcing MFA, and enabling enhanced logging/alerting can mitigate exploitation attempts while maintaining availability. This aligns with the risk treatment strategy of risk reduction through controls rather than acceptance, avoidance, or transfer.

Answer

Accept the risk and wait for the next scheduled scan cycle.

Answer

Disable all logging so the appliance performs better under load.

Answer

Ignore the issue until the vendor confirms the vulnerability is being actively exploited.