SY0-701 Practice Test 21 — 15 Questions

Question 1

An employee receives an email from someone claiming to be from IT. The message says the employee must read back a one-time verification code so their mailbox can be 'repaired.' What social engineering technique is being used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pretexting, because the attacker is using a fake identity and story to gain trust.. The attacker is using a fabricated identity (IT support) and a false scenario (mailbox repair requiring a verification code) to manipulate the employee into divulging sensitive information. This is the classic definition of pretexting, where the attacker creates a believable pretext to lower the victim's defenses and extract data or access.

Answer

Tailgating, because the attacker is trying to enter a secure area physically.

Answer

DDoS, because the message is designed to overwhelm the mailbox server.

Answer

Shoulder surfing, because the attacker is watching the screen from nearby.

Question 2

A system administrator must run a weekly patch-and-restart job on 80 Linux servers without logging in interactively. The job should be repeatable, auditable, and limited to only the required maintenance commands. What is the best approach?

Accepted Answer

Use a configuration management tool with a dedicated service account and restricted sudo permissions.. B is correct because configuration management tools (e.g., Ansible, Puppet, or SaltStack) allow you to define a repeatable, auditable patch-and-restart job using a dedicated service account with restricted sudo permissions. This approach enforces the principle of least privilege, logs all actions via the tool's job history, and eliminates the need for interactive login, meeting all requirements for automation, auditability, and command restriction.

Answer

Share a root SSH key with the operations team so anyone can run the job.

Answer

Have each administrator log in manually and run the commands from an interactive shell.

Answer

Create a local root account on every server for maintenance tasks.

Question 3

Drag and drop the steps to implement a backup strategy following the 3-2-1 rule into the correct order.

Accepted Answer

Step 1: Create primary backup on one medium; Step 2: Create second backup on different medium; Step 3: Store one copy offsite; Step 4: Regularly test backup restoration.. The 3-2-1 rule ensures redundancy: three copies, two different media, one offsite. Testing is crucial to verify recoverability.

Answer

Step 1: Create primary backup on one medium; Step 2: Store one copy offsite; Step 3: Create second backup on different medium; Step 4: Regularly test backup restoration.

Answer

Step 1: Create primary backup on one medium; Step 2: Create second backup on same medium; Step 3: Store both copies offsite; Step 4: Regularly test backup restoration.

Answer

Step 1: Store one copy offsite; Step 2: Create second backup on different medium; Step 3: Create primary backup on one medium; Step 4: Regularly test backup restoration.

Question 4

An online retailer is redesigning a network for a public web app. Customers must reach only the web tier from the internet. The web tier must reach the application tier, and the application tier must reach the database tier. Which two design changes best support this zoning model? Select two.

Accepted Answer

Put the internet-facing web tier in a DMZ with tightly filtered inbound rules.. Placing the internet-facing web tier in a DMZ (demilitarized zone) with tightly filtered inbound rules ensures that external users can only reach the web servers, while the DMZ network isolates them from internal tiers. This aligns with the principle of defense in depth, where the DMZ acts as a buffer zone, and inbound rules (e.g., allowing only TCP/443 for HTTPS) minimize the attack surface. The web tier can then initiate outbound connections to the application tier through a firewall with specific allow-lists, maintaining strict segmentation.

Answer

Place all three server tiers on the same flat VLAN and rely on host firewalls.

Answer

Give the database server a public IP address so the web tier can connect faster.

Answer

Use a single NAT device for all servers and disable interserver filtering.

Question 5

A support portal has a search field that accepts customer last names. After a tester enters a single quote, the application returns a database syntax error. Which attack is the tester most likely trying to verify?

Accepted Answer

SQL injection. The tester is most likely trying to verify a SQL injection vulnerability. Entering a single quote into a search field that interacts with a database can break the SQL query syntax if user input is improperly sanitized, causing the database to return a syntax error. This error indicates that the input is being directly concatenated into a SQL statement, confirming the presence of a SQL injection flaw.

Answer

Cross-site scripting (XSS)

Answer

CSRF

Answer

SSRF

Question 6

Employees use a browser-based SaaS portal, a native expense app, and an internal API. The company wants one corporate identity, API access without separate passwords, and automatic account removal when HR disables a user. Which solution best fits?

Accepted Answer

Use OpenID Connect federation with OAuth 2.0 access tokens and SCIM provisioning.. OpenID Connect (OIDC) federation with OAuth 2.0 provides a single corporate identity (federated SSO), allows API access without separate passwords (using access tokens), and SCIM provisioning automates account removal when HR disables a user. This combination meets all three requirements: unified identity, passwordless API access, and lifecycle management.

Answer

Use LDAP binds directly against each application and manage local passwords separately.

Answer

Use shared local accounts in each application and sync passwords nightly from the directory.

Answer

Use Kerberos constrained delegation to each vendor tenant for every application.

Question 7

Drag and drop the steps to configure a VPN tunnel using IPsec in tunnel mode into the correct order.

Accepted Answer

Configure IKE policy, then configure IPsec transform set, then create crypto map, then apply crypto map to the interface.. IPsec VPN setup involves two phases: IKE for key exchange, then IPsec for data encryption; the crypto map ties it to an interface.

Answer

Configure IKE policy, then create crypto map, then configure IPsec transform set, then apply crypto map to the interface.

Answer

Create crypto map, then configure IKE policy, then apply crypto map to the interface, then configure IPsec transform set.

Answer

Configure IPsec transform set, then configure IKE policy, then create crypto map, then apply crypto map to the interface.

Question 8

A security team suspects a rootkit after seeing hidden processes, boot-time persistence, and altered system files on a laptop. What is the best next step after confirming the suspicion?

Accepted Answer

Disconnect the laptop, then reimage it from a known-good source. Once a rootkit is confirmed, the system's integrity is compromised at the kernel or boot level, making any software-based cleanup unreliable. Reimaging from a known-good source ensures all malicious code, including bootkits and hidden processes, is completely eradicated. This aligns with the SY0-701 domain of incident response, where containment and eradication require a trusted baseline.

Answer

Run a quick cleanup script and return the laptop to the user

Answer

Disable the user account and leave the device in place

Answer

Delete the suspected hidden files manually from Windows Explorer

Question 9

HR needs to send a benefits contractor a file for testing, but the contractor only needs employee names and plan selections. What is the best action before sharing the file?

Accepted Answer

Remove all fields the contractor does not need for the task. Data minimization is a core security principle: you should only share the minimum necessary data for the task. By removing all fields the contractor does not need (e.g., Social Security numbers, addresses, salary data), you reduce the attack surface and limit exposure of sensitive personally identifiable information (PII) in case of a breach or misuse.

Answer

Send the full file because the contractor is trusted

Answer

Post the file to a public collaboration site with a password

Answer

Rename the file so the contents are harder to identify

Question 10

Employees use several SaaS applications, and the security team wants one corporate login, MFA for unmanaged devices, and centralized account provisioning. Which architecture should be used?

Accepted Answer

Use federated single sign-on with the corporate identity provider and conditional access policies.. Federated single sign-on (SSO) with a corporate identity provider (IdP) allows users to authenticate once using their corporate credentials and access multiple SaaS applications without separate logins. Conditional access policies can enforce MFA specifically for unmanaged devices, and centralized account provisioning (e.g., via SCIM) ensures accounts are created, updated, and deprovisioned from a single directory. This architecture meets all three requirements: single corporate login, MFA for unmanaged devices, and centralized provisioning.

Answer

Create separate usernames and passwords for each SaaS application.

Answer

Share one generic account for the team so access is easier to audit.

Answer

Put all users on a VPN and let each SaaS application trust the internal network automatically.

Question 11

A system administrator must run a weekly maintenance script that stops and restarts two services on 50 Linux servers. Security says the job must not use an interactive login and should have only the permissions needed for that task. What is the best approach?

Accepted Answer

Create a dedicated account with sudo rights limited to the required service commands.. It follows the principle of least privilege by creating a dedicated service account with sudo rights restricted to only the specific service management commands (e.g., systemctl restart serviceA.service && systemctl restart serviceB.service). This avoids using the root account (which has unrestricted access) and eliminates the need for interactive logins or embedded credentials, while still allowing the scheduled job (e.g., via cron) to run non-interactively.

Answer

Use the root account for the scheduled job so it always succeeds.

Answer

Ask an administrator to log in manually each week and run the script.

Answer

Store the administrator password in the script so the task can authenticate automatically.

Question 12

A SIEM alert shows one workstation connecting to many internal systems over SMB in a short period of time, followed by attempts to access administrative shares. What is the best response?

Accepted Answer

Isolate the workstation to stop possible lateral movement. The SIEM alert describes classic indicators of lateral movement using SMB, often associated with ransomware or worm-like malware. Isolating the workstation immediately stops the attacker from spreading to other systems via administrative shares (e.g., ADMIN$, C$), which are commonly abused for remote execution. This containment step is the highest priority before any forensic analysis.

Answer

Ignore the alert because SMB is a normal file-sharing protocol

Answer

Increase the workstation's monitor brightness to help the user notice alerts

Answer

Disable all SMB traffic across the entire company immediately

Question 13

A business wants to keep operating even if a supplier-related loss occurs, so it purchases cyber insurance to offset possible costs. Which risk treatment is being used?

Accepted Answer

Transfer, because some financial impact is shifted to another party. Purchasing cyber insurance transfers the financial risk of a supplier-related loss to the insurance company. This is a classic risk transfer strategy, where the business does not eliminate or reduce the likelihood of the loss but shifts the financial impact to another party via a contractual agreement.

Answer

Avoidance, because the company is eliminating the supplier relationship

Answer

Mitigation, because insurance removes the risk before it happens

Answer

Acceptance, because the company is doing nothing about the exposure

Question 14

A security analyst notices unusual outbound traffic from a server that normally only communicates with internal clients. The traffic is encrypted and goes to an external IP address not on any blocklists. The analyst also finds a new scheduled task on the server that runs a PowerShell script. Which of the following best describes the analyst's immediate next step in the incident response process?

Accepted Answer

Disconnect the server from the network to contain the potential breach.. According to standard incident response frameworks such as NIST SP 800-61, containment is one of the first and most critical steps after detecting a potential compromise. The unusual encrypted outbound traffic and the unauthorized scheduled task are strong indicators of compromise (IOCs). Disconnecting the server from the network immediately helps prevent further data exfiltration, lateral movement, or additional damage. Other actions, such as running a scan, wiping the server, or notifying legal, are performed later in the process after containment and evidence preservation.

Answer

Wipe the server and restore from a known good backup.

Answer

Run a full antivirus scan on the server to identify malware.

Answer

Inform the legal department and law enforcement.

Question 15

After a phishing incident, the security team wants to preserve evidence for later review. Which action is most appropriate?

Accepted Answer

Capture and save the email headers and message content. Preserving the email headers and message content is essential for forensic analysis. Email headers contain routing information, including the originating IP address, authentication results (SPF, DKIM, DMARC), and timestamps, which are critical for tracing the source of the phishing attack and understanding the attack vector. Deleting or forwarding the email would destroy this evidence, compromising the investigation.

Answer

Have the user delete the phishing email to avoid further exposure

Answer

Forward the email to every employee as a warning

Answer

Change the user's office seat assignment immediately