SY0-701 Practice Test 22 — 15 Questions

Question 1

A resolver log shows multiple clients querying the correct internal host name, but the DNS server starts returning an unexpected public IP address after a burst of unsolicited DNS responses from outside the network. Users are sent to a lookalike login page. What type of attack is most likely occurring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS poisoning. The scenario describes a DNS poisoning (also known as DNS cache poisoning) attack. The burst of unsolicited DNS responses from outside the network is the attacker injecting forged DNS records into the resolver's cache, causing it to map the correct internal host name to an unexpected public IP address. This redirects users to a lookalike login page, which is the classic outcome of DNS poisoning.

Answer

Brute-force authentication

Answer

Port scanning

Answer

Packet sniffing

Question 2

Several Windows servers were built from the same image, and all of them use the same local Administrator password. What is the best operational hardening change?

Accepted Answer

Implement a tool that automatically sets unique local admin passwords on each server.. Using a tool like Local Administrator Password Solution (LAPS) automates the rotation of unique, complex passwords for each server's local administrator account. This eliminates the risk of lateral movement if one server's credentials are compromised, as each machine has a distinct password stored securely in Active Directory.

Answer

Keep the shared password but store it in a spreadsheet with restricted access.

Answer

Remove all administrator accounts from the servers.

Answer

Change the password manually once a year on one server only.

Question 3

Based on the exhibit, which capability should be added so the SaaS app automatically creates, updates, and disables user accounts as directory changes occur?

Accepted Answer

Add SCIM provisioning between the directory and the SaaS application.. SCIM (System for Cross-domain Identity Management) is the standard protocol designed to automate user provisioning and deprovisioning between an identity provider (like a directory) and a service provider (like a SaaS app). By adding SCIM provisioning, the SaaS app can automatically create, update, and disable user accounts in response to changes in the directory, eliminating the need for manual account management.

Answer

Require MFA on the SaaS login page and leave account provisioning manual.

Answer

Change the password rotation interval to every 30 days for all users.

Answer

Store credentials in a shared spreadsheet so the help desk can disable access faster.

Question 4

A SIEM report shows this sequence over 25 minutes: the same public IP submitted one failed password attempt against 53 different accounts, then one account successfully authenticated, created an inbox forwarding rule, and downloaded hundreds of messages through the web portal. Which two conclusions are best supported? Select two.

Accepted Answer

The pattern is consistent with a password spraying attack.. The SIEM shows a single public IP attempting one failed password against 53 different accounts over 25 minutes. This pattern—low-and-slow, one attempt per account—is the hallmark of a password spraying attack, which avoids account lockout thresholds by never hitting the same account repeatedly. The subsequent successful authentication and mailbox abuse confirm the attacker found a weak password for one account.

Answer

The attacker is performing a brute-force attack against one account.

Answer

The activity is most likely credential stuffing with multiple known password pairs.

Answer

The events primarily indicate a denial-of-service attack against the mail system.

Question 5

Based on the exhibit, which attack is most likely occurring on the local network?

Accepted Answer

ARP spoofing. ARP spoofing is the most likely attack because the exhibit shows an attacker sending forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. This poisons the ARP cache of the victim, causing all traffic destined for the gateway to be sent to the attacker instead, enabling man-in-the-middle interception.

Answer

DNS cache poisoning

Answer

Replay attack

Answer

Amplification denial-of-service

Question 6

An employee reports a ransomware note on a file server. The server is still powered on, shares are still being accessed, and management wants service restored as quickly as possible. What should the incident response team do first?

Accepted Answer

Isolate the server from the network while keeping it powered on. The correct first step is to isolate the server from the network while keeping it powered on. This preserves volatile evidence (e.g., memory, running processes, network connections) that is critical for forensic analysis and understanding the ransomware's entry vector. Powering off would destroy this data, and restoring from backup prematurely could reintroduce the infection or miss evidence needed to prevent recurrence.

Answer

Power off the server immediately to stop all attacker activity

Answer

Start restoring from backup before collecting any logs or memory data

Answer

Delete the ransomware note and suspicious files to reduce business disruption

Question 7

During testing, a login form returns all user records when the tester enters ' OR '1'='1 in a username field. What is the best fix for this issue?

Accepted Answer

Use parameterized queries or prepared statements. The SQL injection attack ' OR '1'='1 bypasses authentication by always evaluating to true, returning all user records. Parameterized queries (prepared statements) separate SQL logic from user input, preventing the injected string from altering the query structure. This is the industry-standard mitigation for SQL injection vulnerabilities.

Answer

Hide database error messages from the login page only

Answer

Require users to change passwords more often

Answer

Move the login page to a different URL

Question 8

A help desk team needs sample customer tickets in a lower environment for testing. The records contain names, phone numbers, and case details. Which approach best reduces privacy risk while still allowing useful testing?

Accepted Answer

Mask or tokenize the personal data before loading it into test. Data masking or tokenization replaces sensitive personal information (names, phone numbers) with realistic but fictitious values, preserving the dataset's utility for testing while minimizing exposure of real PII. This approach aligns with privacy best practices and regulatory requirements like GDPR or HIPAA, as the test environment never contains actual customer data.

Answer

Copy the production database exactly into the test system

Answer

Email the records to developers so they can import them manually

Answer

Store the records in an unencrypted spreadsheet on a shared drive

Question 9

Based on the exhibit, what is the MOST likely activity taking place on the network?

A user opened a spreadsheet shortly before unusual internal connection patterns began. The same account is now authenticating to many hosts in rapid succession.

Accepted Answer

An attacker is performing lateral movement using stolen credentials and remote administration tools.. The exhibit shows a user opening a spreadsheet (likely a phishing vector) followed by rapid authentication attempts from the same account to many hosts. This pattern matches lateral movement using stolen credentials, where an attacker uses remote administration tools like PsExec, WinRM, or RDP to move across the network after initial compromise.

Answer

A worm is flooding the network with broadcast traffic and exhausting bandwidth.

Answer

A malicious insider is exfiltrating data through a cloud sync application.

Answer

A misconfigured printer is repeatedly scanning the subnet for available services.

Question 10

After a routine dependency update, a development team notices that the customer portal begins making outbound connections to an unfamiliar domain during startup. The domain is not part of the application design, and the behavior started immediately after the third-party library was updated. Which threat is most likely?

Accepted Answer

Supply-chain compromise. The scenario describes a supply-chain compromise, where a trusted third-party library has been maliciously altered to include unauthorized outbound connections. This is a classic software supply-chain attack, as the dependency update introduced code that phones home to an unfamiliar domain, indicating the library's integrity was compromised before or during distribution.

Answer

Evil twin access point

Answer

Bluetooth pairing abuse

Answer

DNS poisoning on the client network

Question 11

An EDR alert shows winword.exe launching powershell.exe with an encoded command after a user opened an invoice attachment. No new executable file was written to disk, and the host is still online. Which two actions should the SOC analyst take first to validate the alert and collect usable evidence? Select two.

Accepted Answer

Review the parent-child process chain and the full PowerShell command line in EDR.. Reviewing the parent-child process chain (winword.exe → powershell.exe) and the full PowerShell command line in the EDR allows the analyst to immediately validate whether the alert is a true positive by confirming the process lineage and decoding the encoded command. This step is critical for understanding the attacker's intent without relying on disk artifacts, as the attack is fileless and memory-resident.

Answer

Compare the endpoint's outbound connections with its normal baseline and approved destinations.

Answer

Reimage the workstation immediately to eliminate any possible persistence.

Answer

Ask the user to delete the suspicious email and clear the recycle bin.

Question 12

A records clerk finds paper forms containing customer identifiers. The retention period has expired, and no legal hold applies. Which two actions are appropriate next? Select two.

Accepted Answer

Verify that the retention schedule has been satisfied and no hold exists. Before disposing of any records, the records clerk must confirm that the retention period has fully elapsed and that no legal hold (such as a litigation hold or regulatory hold) is active. This verification step ensures compliance with organizational data governance policies and avoids spoliation of evidence. Option B is correct because once verification is complete, the approved disposal method (e.g., cross-cut shredding, incineration, or secure shredding service) must be used to render the customer identifiers irrecoverable, aligning with data minimization and privacy requirements.

Answer

Keep the forms in a personal desk drawer until someone asks for them

Answer

Take the papers home for safe keeping before shredding later

Answer

Refile the forms in an archive cabinet because they are old records

Question 13

Before applying a major patch to a virtual machine, the administrator wants a quick way to return the VM to its exact pre-change state if the patch fails. What should the administrator create?

Accepted Answer

A snapshot of the virtual machine. A snapshot captures the exact state of the virtual machine (disk, memory, and power state) at a point in time, allowing the administrator to revert instantly if the patch fails. This is the fastest and most storage-efficient method for a quick rollback compared to a full backup, which is slower and more resource-intensive.

Answer

A full backup to removable media

Answer

A separate VLAN for the virtual machine

Answer

A digital certificate for the patch server

Question 14

An organization is redesigning its office network. Guest Wi-Fi must reach the internet only, employee laptops need access to internal apps, and a payment-processing system must be separated from general user traffic but still reach one database server. Which design best meets these requirements?

Accepted Answer

Create separate VLANs or subnets for guest, user, and payment zones, then filter inter-zone traffic with firewalls or ACLs.. It uses VLANs or subnets to segment guest, employee, and payment-processing traffic into separate broadcast domains, then applies firewall rules or ACLs to control inter-zone traffic. This allows guest Wi-Fi to be restricted to internet-only access, employee laptops to reach internal apps, and the payment system to communicate only with its specific database server while being isolated from general user traffic.

Answer

Place all devices on one flat network and rely on host firewalls for isolation.

Answer

Put the payment system in a DMZ and allow direct internet access for database synchronization.

Answer

Use NAT on every endpoint so internal devices cannot be individually identified on the network.

Question 15

A help desk technician receives an SMS claiming to be from the mobile carrier. The message says the user's corporate number will be suspended unless they open a link and confirm an MFA code. The user has not reported any account issues. What attack is this?

Accepted Answer

Smishing. Smishing is a phishing attack conducted via SMS (Short Message Service). The message impersonates the mobile carrier, creates urgency by threatening suspension, and lures the user to a malicious link to capture MFA codes or credentials. Since the attack vector is SMS, not email or voice, this is smishing.

Answer

Spear phishing

Answer

Vishing

Answer

Baiting