SY0-701 Practice Test 22 — 15 Questions

Question 1

A SOC analyst receives a SIEM alert for a possible brute-force attack against a remote access portal. The alert shows 240 failed logins from the same source IP over 4 minutes, followed by one successful login. Before escalating as an incident, what is the BEST evidence to check to determine whether the alert is a false positive caused by approved activity?

Accepted Answer

Whether there is a change ticket or test plan for the access portal and the activity matches the approved maintenance window. A change ticket or test plan that matches the observed activity (240 failed logins followed by a successful login during an approved maintenance window) would indicate that the alert is a false positive caused by authorized testing or maintenance, not a malicious brute-force attack. This is the best evidence because it directly ties the SIEM alert to approved, scheduled activity, which is a standard operational control for change management.

Answer

Whether the source IP belongs to the company help desk

Answer

Whether the user account has MFA enabled

Answer

Whether the firewall is in inline mode

Question 2

A nightly backup job shows "Completed successfully" in the backup console, but a test restore fails with an authentication error after the backup service account password was rotated last week. What is the best next step?

Accepted Answer

Update the backup application with the current service account credentials and rerun a restore validation test.. The backup job succeeded because the service account had cached credentials or the backup process itself didn't require re-authentication at that point. However, the restore operation failed because the backup application's stored credentials for accessing the backup repository are now stale after the password rotation. Updating the backup application with the current service account credentials (Option B) directly resolves the authentication error and allows a proper restore validation test.

Answer

Increase the retention period so the backup console will keep more copies.

Answer

Disable the backup software firewall rule and try the restore again later.

Answer

Delete and recreate all protected files because the backup repository is probably corrupt.

Question 3

A SOC analyst reviews an EDR alert on a Windows workstation. PowerShell was launched by a scheduled task, downloaded an encoded command from an external server, and then spawned rundll32.exe. No suspicious executable was written to disk. Which type of threat best fits this activity?

Accepted Answer

Fileless attack. The attack is fileless because it executes entirely in memory without writing a malicious executable to disk. PowerShell downloads an encoded command from an external server and spawns rundll32.exe to run code via DLL execution, leveraging living-off-the-land binaries (LOLBins) to evade traditional antivirus and disk-based detection.

Answer

Trojan

Answer

Rootkit

Answer

Worm

Question 4

A payment application must keep running if one application server fails, and the business can tolerate no more than 5 minutes of lost transactions and 30 minutes of downtime during a site outage. Which two controls best match the availability requirements? Select two.

Accepted Answer

Deploy at least two active application nodes behind a load balancer so one server failure does not interrupt service.. Option A is correct because deploying at least two active application nodes behind a load balancer ensures that if one server fails, traffic is automatically redirected to the remaining healthy node(s), achieving zero downtime for the application itself. This directly meets the requirement that the payment application must keep running if one application server fails, without any interruption to service.

Answer

Use a cold site that is powered off until a disaster is declared.

Answer

Take nightly backups to meet the 5-minute recovery point objective.

Answer

Rely on weekly VM snapshots because they are faster than replication.

Question 5

A supplier portal is browser-based and used by external partner companies. Each partner already has its own identity provider. The portal must trust assertions from those IdPs and avoid creating separate local passwords for each partner. Which integration is best?

Accepted Answer

Use SAML 2.0 federation with trust relationships to the partner identity providers.. SAML 2.0 federation is the correct choice because it enables the supplier portal to trust assertions from multiple external identity providers (IdPs) without creating local passwords. SAML uses XML-based tokens signed by the partner's IdP, allowing the portal to accept authentication claims via a trust relationship, which directly meets the requirement of avoiding separate local credentials for each partner.

Answer

Use LDAP directory synchronization for all partner users.

Answer

Use NTLM pass-through authentication to each partner account.

Answer

Use PAP over TLS so the portal can collect partner passwords securely.

Question 6

A team stores sensitive archives on cloud block storage. The provider already encrypts disks at rest, but the company wants copies of the disks to remain unreadable even if a cloud administrator can snapshot and mount the volume. Which control is best?

Accepted Answer

Use client-side encryption before upload and keep the keys in an external HSM or key service.. Client-side encryption ensures data is encrypted before it ever reaches the cloud provider's storage. By keeping the encryption keys in an external HSM or key service, the cloud provider (including its administrators) never has access to the plaintext keys, so even if they snapshot and mount the volume, the data remains unreadable. This addresses the threat model where the provider's own administrators could otherwise access the data at rest.

Answer

Enable provider-managed encryption at rest only and rotate the storage passwords monthly.

Answer

Place the storage account in a private subnet and block all Internet access.

Answer

Rely on immutable snapshots and versioning to prevent unauthorized access.

Question 7

A user's workstation suddenly renames documents with a new extension, displays a ransom note, and blocks access to a shared drive. Which two indicators support ransomware? Select two.

Accepted Answer

Files are renamed or encrypted and no longer open normally. Option A is correct because ransomware typically encrypts files and renames them with a new extension (e.g., .encrypted, .locked), making them unopenable without the decryption key. This behavior directly matches the scenario where documents are renamed and access is blocked, confirming file encryption as a core indicator of ransomware.

Answer

The mouse pointer moves slowly after long idle periods

Answer

The browser homepage changed after a software update

Answer

A new USB keyboard is detected by the operating system

Question 8

A threat intelligence feed says an adversary rotates domains daily, uses cloud VPS hosting, and reuses the same malware sample across several campaigns. Analysts want the indicator that remains useful even when the domain changes. What should they prioritize?

Accepted Answer

The malware's SHA-256 file hash because it uniquely identifies the sample.. The malware's SHA-256 file hash is the most persistent indicator because it is a cryptographic hash that uniquely identifies the specific binary sample, regardless of the domain or IP address used for delivery. Unlike domains or IPs, which the adversary can rotate daily, the hash remains constant as long as the same malware sample is reused across campaigns. This makes it a reliable indicator of compromise (IOC) for detection via file reputation or hash-based blocklists.

Answer

The current domain name because it is the easiest item to block immediately.

Answer

The cloud provider's entire ASN because all traffic from that provider is automatically malicious.

Answer

The malware's file name because attackers usually keep the same name for convenience.

Question 9

A vulnerability scan finds a critical flaw on an internet-facing SFTP gateway with public exploit code, and a high-severity flaw on an internal lab server that is only reachable from a restricted subnet. Which should be remediated first?

Accepted Answer

The internet-facing SFTP gateway, because it has higher immediate risk.. The internet-facing SFTP gateway has a critical vulnerability with public exploit code, meaning it is exposed to the entire internet and can be directly attacked without any network restrictions. This creates an immediate and high-likelihood risk of remote code execution or data breach, whereas the internal lab server is isolated to a restricted subnet, significantly reducing its attack surface and exploitability. Remediation priority should be based on risk severity (likelihood × impact), not just CVSS score, making the SFTP gateway the correct first choice.

Answer

The internal lab server, because every high-severity finding should be fixed first.

Answer

Both systems can wait until the next scheduled maintenance window.

Answer

Neither system needs urgent action because the lab server is isolated.

Question 10

A vulnerability scan produces these results:
- Finding 1: High severity, internet-facing VPN appliance, known exploit available, no compensating controls
- Finding 2: Critical severity, internal development workstation, requires authenticated local access
- Finding 3: Medium severity, test server, no public exploit and not reachable from outside
Which finding should be remediated first?

Accepted Answer

Finding 1. Finding 1 should be remediated first because it combines high severity with an internet-facing attack surface and a known exploit, meaning an attacker can remotely compromise the VPN appliance without authentication or compensating controls. This creates an immediate and direct risk of network breach, unlike the other findings which require local access or are isolated from external threats.

Answer

Finding 2

Answer

Finding 3

Answer

All findings are equal because the severity rating alone determines priority

Question 11

A systems administrator downloads a patch and a SHA-256 checksum file from the vendor. The administrator hashes the patch locally and the values match. What does the matching hash primarily confirm?

Accepted Answer

The file has not been altered since the vendor published the checksum.. A SHA-256 checksum is a cryptographic hash that acts as a fingerprint for the file. When the locally computed hash matches the vendor-published checksum, it confirms the file's integrity — that the patch has not been modified or corrupted since the vendor generated the checksum. This does not verify confidentiality, authenticity of the signer, or installation success.

Answer

The file remains confidential during transmission.

Answer

The vendor's private key was used to encrypt the patch.

Answer

The patch will definitely install successfully on every system.

Question 12

A system administrator is creating a secure baseline for a new Linux application server. Which two actions are appropriate hardening steps? Select two.

Accepted Answer

Disable services that the server does not need to perform its job.. Disabling unnecessary services reduces the attack surface by removing potential entry points for exploitation. In a Linux server baseline, services like Telnet, FTP, or unused web servers should be disabled using systemctl or by removing the associated packages. This aligns with the principle of least functionality, ensuring only required processes run.

Answer

Install extra administrative tools on the server for convenience.

Answer

Enable passwordless remote shell access for faster troubleshooting.

Answer

Leave sample accounts and default demo content in place for testing.

Question 13

A VPN concentrator shows that an authentication request from a user was accepted twice, even though the user insists they approved only one login. Packet analysis reveals that the second successful attempt reused the same authentication blob and arrived shortly after the first. Which attack is the best fit?

Accepted Answer

Replay attack, because a captured valid authentication message was resent to gain access again.. The scenario describes a captured authentication blob being reused to gain a second successful authentication. This is the hallmark of a replay attack, where an attacker intercepts a valid authentication message (e.g., a Kerberos TGT, RADIUS Access-Accept, or a VPN pre-shared key hash) and retransmits it to the VPN concentrator to impersonate the user. The VPN concentrator accepted the duplicate because it lacked proper replay protection mechanisms such as timestamps, sequence numbers, or one-time-use nonces.

Answer

ARP poisoning, because the attacker redirected traffic by altering local address resolution.

Answer

Phishing, because the user was tricked into entering credentials on a fake page.

Answer

Denial of service, because the attacker is overwhelming the VPN gateway with requests.

Question 14

A user says their files suddenly have a new extension and a note appears demanding payment to restore access. Which type of malware is most likely involved?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts files and appends a new extension, then displays a ransom note demanding payment for decryption. This matches the user's description of files becoming inaccessible with a new extension and a payment demand.

Answer

Adware

Answer

Spam filter

Answer

Screen saver

Question 15

A virtualization host connects to an access switch through one Ethernet link. It must carry only VLAN 30 for production VMs and VLAN 40 for management VMs. A review finds the link currently accepts every VLAN, uses VLAN 1 as the native VLAN, and a guest VLAN can accidentally be added later. Which two changes best harden the design? Select two.

Accepted Answer

Prune the trunk so it carries only VLAN 30 and VLAN 40, not every possible VLAN.. Option A is correct because pruning the trunk to carry only VLANs 30 and 40 reduces the attack surface by preventing unauthorized VLANs (like a guest VLAN) from being accidentally added later. This aligns with the principle of least privilege for network segmentation, ensuring only necessary traffic traverses the link.

Answer

Leave the trunk open to all VLANs so future changes require no switch updates.

Answer

Keep VLAN 1 as the native VLAN because it is the vendor default and easiest to support.

Answer

Enable dynamic trunk negotiation on the host link so the virtualization server can discover VLANs automatically.