SY0-701 Practice Test 23 — 15 Questions

Question 1

During testing, a login form returns all user records when the tester enters ' OR '1'='1 in a username field. What is the best fix for this issue?

Accepted Answer

Use parameterized queries or prepared statements. The SQL injection attack ' OR '1'='1 bypasses authentication by always evaluating to true, returning all user records. Parameterized queries (prepared statements) separate SQL logic from user input, preventing the injected string from altering the query structure. This is the industry-standard mitigation for SQL injection vulnerabilities.

Answer

Hide database error messages from the login page only

Answer

Require users to change passwords more often

Answer

Move the login page to a different URL

Question 2

A help desk team needs sample customer tickets in a lower environment for testing. The records contain names, phone numbers, and case details. Which approach best reduces privacy risk while still allowing useful testing?

Accepted Answer

Mask or tokenize the personal data before loading it into test. Data masking or tokenization replaces sensitive personal information (names, phone numbers) with realistic but fictitious values, preserving the dataset's utility for testing while minimizing exposure of real PII. This approach aligns with privacy best practices and regulatory requirements like GDPR or HIPAA, as the test environment never contains actual customer data.

Answer

Copy the production database exactly into the test system

Answer

Email the records to developers so they can import them manually

Answer

Store the records in an unencrypted spreadsheet on a shared drive

Question 3

Based on the exhibit, what is the MOST likely activity taking place on the network?

A user opened a spreadsheet shortly before unusual internal connection patterns began. The same account is now authenticating to many hosts in rapid succession.

Accepted Answer

An attacker is performing lateral movement using stolen credentials and remote administration tools.. The exhibit shows a user opening a spreadsheet (likely a phishing vector) followed by rapid authentication attempts from the same account to many hosts. This pattern matches lateral movement using stolen credentials, where an attacker uses remote administration tools like PsExec, WinRM, or RDP to move across the network after initial compromise.

Answer

A worm is flooding the network with broadcast traffic and exhausting bandwidth.

Answer

A malicious insider is exfiltrating data through a cloud sync application.

Answer

A misconfigured printer is repeatedly scanning the subnet for available services.

Question 4

After a routine dependency update, a development team notices that the customer portal begins making outbound connections to an unfamiliar domain during startup. The domain is not part of the application design, and the behavior started immediately after the third-party library was updated. Which threat is most likely?

Accepted Answer

Supply-chain compromise. The scenario describes a supply-chain compromise, where a trusted third-party library has been maliciously altered to include unauthorized outbound connections. This is a classic software supply-chain attack, as the dependency update introduced code that phones home to an unfamiliar domain, indicating the library's integrity was compromised before or during distribution.

Answer

Evil twin access point

Answer

Bluetooth pairing abuse

Answer

DNS poisoning on the client network

Question 5

An EDR alert shows winword.exe launching powershell.exe with an encoded command after a user opened an invoice attachment. No new executable file was written to disk, and the host is still online. Which two actions should the SOC analyst take first to validate the alert and collect usable evidence? Select two.

Accepted Answer

Review the parent-child process chain and the full PowerShell command line in EDR.. Reviewing the parent-child process chain (winword.exe → powershell.exe) and the full PowerShell command line in the EDR allows the analyst to immediately validate whether the alert is a true positive by confirming the process lineage and decoding the encoded command. This step is critical for understanding the attacker's intent without relying on disk artifacts, as the attack is fileless and memory-resident.

Answer

Compare the endpoint's outbound connections with its normal baseline and approved destinations.

Answer

Reimage the workstation immediately to eliminate any possible persistence.

Answer

Ask the user to delete the suspicious email and clear the recycle bin.

Question 6

A records clerk finds paper forms containing customer identifiers. The retention period has expired, and no legal hold applies. Which two actions are appropriate next? Select two.

Accepted Answer

Verify that the retention schedule has been satisfied and no hold exists. Before disposing of any records, the records clerk must confirm that the retention period has fully elapsed and that no legal hold (such as a litigation hold or regulatory hold) is active. This verification step ensures compliance with organizational data governance policies and avoids spoliation of evidence. Option B is correct because once verification is complete, the approved disposal method (e.g., cross-cut shredding, incineration, or secure shredding service) must be used to render the customer identifiers irrecoverable, aligning with data minimization and privacy requirements.

Answer

Keep the forms in a personal desk drawer until someone asks for them

Answer

Take the papers home for safe keeping before shredding later

Answer

Refile the forms in an archive cabinet because they are old records

Question 7

An organization is redesigning its office network. Guest Wi-Fi must reach the internet only, employee laptops need access to internal apps, and a payment-processing system must be separated from general user traffic but still reach one database server. Which design best meets these requirements?

Accepted Answer

Create separate VLANs or subnets for guest, user, and payment zones, then filter inter-zone traffic with firewalls or ACLs.. It uses VLANs or subnets to segment guest, employee, and payment-processing traffic into separate broadcast domains, then applies firewall rules or ACLs to control inter-zone traffic. This allows guest Wi-Fi to be restricted to internet-only access, employee laptops to reach internal apps, and the payment system to communicate only with its specific database server while being isolated from general user traffic.

Answer

Place all devices on one flat network and rely on host firewalls for isolation.

Answer

Put the payment system in a DMZ and allow direct internet access for database synchronization.

Answer

Use NAT on every endpoint so internal devices cannot be individually identified on the network.

Question 8

A help desk technician receives an SMS claiming to be from the mobile carrier. The message says the user's corporate number will be suspended unless they open a link and confirm an MFA code. The user has not reported any account issues. What attack is this?

Accepted Answer

Smishing. Smishing is a phishing attack conducted via SMS (Short Message Service). The message impersonates the mobile carrier, creates urgency by threatening suspension, and lures the user to a malicious link to capture MFA codes or credentials. Since the attack vector is SMS, not email or voice, this is smishing.

Answer

Spear phishing

Answer

Vishing

Answer

Baiting

Question 9

Based on the exhibit, which change should be made first to secure remote administration of the network device?

Accepted Answer

Disable Telnet and allow SSHv2 only for remote administration.. Telnet transmits all data, including credentials, in cleartext, making it vulnerable to interception. SSHv2 provides encrypted remote administration and is the secure replacement for Telnet. Disabling Telnet and enabling only SSHv2 is the immediate and necessary first step to secure remote device management.

Answer

Enable FTP so administrators can upload and download configuration files securely.

Answer

Open the management interface to any internet host as long as the password is complex.

Answer

Use one shared local administrator account for all network engineers.

Question 10

A records manager is told that some HR emails may be needed for an active investigation, while unrelated messages are still due for deletion under the retention schedule. Which two actions should the manager take? Select two.

Accepted Answer

Place the affected emails on legal hold. A is correct because placing the affected emails on legal hold suspends the retention schedule for those specific records, ensuring they are preserved for the active investigation without altering the deletion policy for unrelated messages. This is a standard practice under eDiscovery and legal hold procedures, often implemented via Exchange Online or similar systems using litigation hold or in-place hold.

Answer

Delete all related records immediately to reduce storage costs

Answer

Move them into a personal archive folder

Answer

Rewrite the retention schedule without approval

Question 11

A SOC analyst wants to make sure logs from multiple servers can be compared accurately during an incident review. What should be configured on those systems?

Accepted Answer

Time synchronization using the same trusted time source. Time synchronization using a trusted time source (e.g., NTP) ensures that all servers share the same clock. During incident review, accurate log correlation depends on timestamps being consistent across systems; even a few seconds of drift can misalign event sequences. Without synchronized time, comparing logs from multiple servers becomes unreliable, potentially obscuring the true timeline of an attack.

Answer

A local administrator account with the same password on every server

Answer

A larger disk size on the log server

Answer

A separate VLAN for each application server

Question 12

An HR analyst must share a spreadsheet with an external auditor. The spreadsheet includes employee names, Social Security numbers, bank account numbers, and salary data, but the auditor only needs employee names and total payroll. Which three actions best protect the data? Select three.

Accepted Answer

Remove fields the auditor does not need before sharing the file.. Removing unnecessary fields (e.g., Social Security numbers, bank account numbers) before sharing the spreadsheet minimizes the exposure of sensitive personally identifiable information (PII) and financial data. This practice, known as data minimization, aligns with the principle of least privilege and reduces the risk of unauthorized access or data breach. By stripping out extraneous columns, the HR analyst ensures the auditor receives only the required data (employee names and total payroll), thereby protecting the organization from compliance violations under regulations like GDPR or PCI DSS.

Answer

Leave the full spreadsheet intact because the auditor requested a copy.

Answer

Post the spreadsheet in a shared public portal for easier access.

Question 13

The help desk can patch endpoints only after testing on a few pilot systems because one legacy app sometimes breaks after updates. What patching approach is most secure and least disruptive?

Accepted Answer

Apply updates to a small pilot group first, then roll them out in stages to the rest of the fleet.. It follows a phased rollout strategy: testing on a small pilot group first validates compatibility with the legacy app, then staged deployment minimizes disruption while ensuring security patches are applied promptly. This balances the need for security updates with the operational requirement to avoid breaking critical legacy software.

Answer

Wait until all applications are fully modernized before installing any security updates.

Answer

Patch every endpoint immediately at the same time without testing to reduce management overhead.

Answer

Disable automatic updates permanently and patch only after a confirmed incident.

Question 14

After a phishing-awareness campaign, which metric best shows that employees are becoming more resistant to phishing attempts?

Accepted Answer

The percentage of users who click phishing test links. The percentage of users who click phishing test links directly measures behavioral change in response to simulated phishing attacks. A decreasing click rate indicates that employees are better at recognizing and avoiding phishing attempts, which is the primary goal of a phishing-awareness campaign.

Answer

The number of spam emails received by the mail gateway

Answer

The average length of employee passwords

Answer

The count of antivirus alerts on endpoints

Question 15

An EDR console shows PowerShell launching from a scheduled task, decoding a command from memory, and spawning rundll32.exe. No suspicious executable is written to disk, and the activity stops when the process ends. Which threat best fits this behavior?

Accepted Answer

Fileless malware. The behavior describes PowerShell decoding a command from memory and spawning rundll32.exe without writing any executable to disk, which is the hallmark of fileless malware. Fileless malware operates entirely in memory, leveraging legitimate system tools (like PowerShell and rundll32) to execute malicious code, and it leaves no persistent file on the filesystem, so activity ceases when the process ends.

Answer

Trojan downloader

Answer

Rootkit

Answer

Worm