SY0-701 Practice Test 23 — 15 Questions

Question 1

A vulnerability scanner reports a critical issue on a Linux server. The administrator checks the application and confirms the vulnerable package is installed, but the affected feature is not enabled anywhere in production. What should the security team do next?

Accepted Answer

Validate whether the issue is a false positive or lower-risk finding before prioritizing remediation. Option B is correct because the vulnerability scanner reports a critical issue, but the administrator has confirmed the vulnerable package is installed while the affected feature is not enabled in production. This means the actual risk is lower than the scanner's severity rating, as exploitation requires the feature to be active. The security team should validate whether this is a false positive or a lower-risk finding to prioritize remediation efforts appropriately, ensuring resources are allocated to genuine threats.

Answer

Ignore the finding permanently because the package is installed

Answer

Immediately shut down the server without further investigation

Answer

Apply an exception without documenting any compensating controls

Question 2

A support agent notices that changing `invoiceId=8842` to `invoiceId=8843` in a portal URL returns another customer's invoice PDF without any additional login prompt. The user is already authenticated to the application. Which vulnerability is most likely present?

Accepted Answer

Broken access control. The vulnerability is broken access control (B) because the application fails to verify that the authenticated user is authorized to access the resource identified by `invoiceId=8843`. By simply changing a numeric parameter in the URL, the user can view another customer's invoice PDF without any additional authentication or authorization check. This is a classic insecure direct object reference (IDOR) flaw, which falls under the broader category of broken access control.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Cross-site request forgery

Question 3

A vendor-supported application cannot be patched for 30 days, but the business must keep it online. What is the best short-term risk treatment?

Accepted Answer

Apply a compensating control, such as restricting access and monitoring traffic. Option B is correct because when a known vulnerability cannot be patched immediately, applying a compensating control—such as restricting network access via firewall rules (e.g., allowing only specific source IPs) and enabling deep packet inspection (DPI) or an intrusion prevention system (IPS) to monitor for exploit attempts—reduces the risk to an acceptable level without taking the application offline. This approach aligns with the principle of defense in depth, buying time until the vendor patch is available.

Answer

Accept the risk without any additional controls

Answer

Delete the application so the vulnerability no longer exists

Answer

Transfer the risk by telling users to work faster

Question 4

A vulnerability scan finds an administrative SSH service listening on 0.0.0.0 on a server that should be managed only from the internal network. What is the main security issue?

Accepted Answer

Exposed management service. The SSH service binding to 0.0.0.0 means it is listening on all network interfaces, including external-facing ones. This exposes the administrative management interface to potentially untrusted networks, violating the principle of least privilege and increasing the attack surface. The main security issue is that a service intended for internal management only is accessible from outside the trusted internal network.

Answer

Default credentials

Answer

Outdated component

Answer

Weak permissions

Question 5

A system administrator must run a weekly maintenance script that stops and restarts two services on 50 Linux servers. Security says the job must not use an interactive login and should have only the permissions needed for that task. What is the best approach?

Accepted Answer

Create a dedicated account with sudo rights limited to the required service commands.. Option B is correct because it follows the principle of least privilege by creating a dedicated service account with sudo rights restricted to only the specific service management commands (e.g., systemctl restart serviceA.service && systemctl restart serviceB.service). This avoids using the root account (which has unrestricted access) and eliminates the need for interactive logins or embedded credentials, while still allowing the scheduled job (e.g., via cron) to run non-interactively.

Answer

Use the root account for the scheduled job so it always succeeds.

Answer

Ask an administrator to log in manually each week and run the script.

Answer

Store the administrator password in the script so the task can authenticate automatically.

Question 6

A vulnerability scan finds a critical flaw on a public-facing server and a medium flaw on a lab system that is not connected to the production network. Which issue should be fixed first?

Accepted Answer

The critical flaw on the public-facing server, because it has higher business risk.. The critical flaw on the public-facing server should be fixed first because it presents a higher business risk. A public-facing server is directly accessible from the internet, making it a prime target for attackers. Exploiting a critical vulnerability could lead to data breaches, service disruption, or unauthorized access, with immediate and severe business impact. In contrast, the medium flaw on an isolated lab system poses no direct threat to production operations or sensitive data.

Answer

The medium flaw on the isolated lab system, because all vulnerabilities should be fixed in alphabetical order.

Answer

Both systems can wait until the next quarterly patch cycle.

Answer

The lab system, because internal systems always outrank external systems.

Question 7

A web application lets users save a profile "display name." One employee enters a value that contains script code, and later other users who view that profile start seeing pop-ups and redirects to a fake login page. Which attack is most likely occurring?

Accepted Answer

Cross-site scripting, because untrusted content is executed in another user's browser context.. Option B is correct because the employee's display name containing script code is stored in the database and later rendered in the browsers of other users without proper sanitization. This is a classic stored cross-site scripting (XSS) attack, where untrusted user input is executed as HTML/JavaScript in the context of another user's session, leading to pop-ups and redirects to a fake login page.

Answer

SQL injection, because the database is being queried with unsafe concatenated input.

Answer

Cross-site request forgery, because the attacker is forcing the victim to submit a form automatically.

Answer

Broken authentication, because the login system is failing to verify usernames correctly.

Question 8

A web portal for customer refunds checks device health at sign-in, then re-checks the device and user context before each refund over a threshold. A session that started on a managed laptop is blocked when the laptop later fails posture checks, even though the password remains valid. Which principle is best illustrated?

Accepted Answer

Zero trust. The scenario describes a system that continuously verifies trust—checking device health at sign-in and re-evaluating both device and user context before each high-value action—and blocks access even when the password is valid. This is the core of Zero Trust: 'never trust, always verify,' where authentication and authorization are re-assessed at every transaction, not just at session start. The policy enforces access decisions based on real-time posture (e.g., device compliance, user behavior) rather than relying solely on a static credential.

Answer

Defense in depth

Answer

Least privilege

Answer

Need-to-know

Question 9

A vendor-supported legacy application can run only with a deprecated browser plug-in on two engineering workstations for 30 days while a replacement is tested. Management wants to allow the exception without weakening the security program. What is the best action?

Accepted Answer

Document a time-bound exception, record the risk, apply compensating controls, and schedule review before expiration.. Option B is correct because it follows the formal exception process required by a mature security program: documenting the exception with a specific time bound (30 days), recording the associated risk, applying compensating controls (such as network segmentation or host-based firewall rules to isolate the deprecated plug-in), and scheduling a review before expiration ensures the risk is managed and the exception does not become permanent. This aligns with the SY0-701 objective of implementing risk management processes, where time-bound exceptions with compensating controls are the standard way to handle legacy dependencies without weakening the overall security posture.

Answer

Approve the exception informally by email and revisit it if problems appear.

Answer

Disable all monitoring on the workstations so the application will function normally.

Answer

Publish the exception as a permanent guideline so other teams can follow it.

Question 10

A workstation suddenly begins making SMB connections to many internal servers within a few minutes. What is the best immediate response?

Accepted Answer

Isolate the workstation from the network for containment.. Option B is correct because the workstation's sudden SMB connections to many internal servers strongly indicate compromise, such as ransomware or worm propagation. Isolating the workstation immediately contains the threat, preventing lateral movement and further damage while preserving forensic evidence.

Answer

Allow the traffic because SMB is a normal file-sharing protocol.

Answer

Delete the local event logs to reduce alert noise.

Answer

Disable all SMB services on every server immediately.

Question 11

A weekly scan reports three findings: a medium-severity missing patch on a lab VM with no network access, a high-severity default credential on a management interface reachable from the internet, and a low-severity outdated browser plug-in on a visitor kiosk. Which issue should be remediated first?

Accepted Answer

The high-severity default credential on the management interface exposed to the internet.. Option C is correct because the high-severity default credential on a management interface reachable from the internet represents an immediate, exploitable risk. Default credentials are well-known and can be used by attackers to gain full administrative control over the device, often leading to a complete compromise of the network. In contrast, the other findings have compensating controls (no network access) or lower impact (outdated browser plug-in), making them lower priority in a risk-based remediation strategy.

Answer

The medium-severity missing patch on the isolated lab VM.

Answer

The low-severity outdated browser plug-in on the visitor kiosk.

Answer

All three issues have the same priority because they were found in the same scan cycle.

Question 12

A vulnerability scan reports that a public web server is running an operating system version that no longer receives security updates. Which issue is present?

Accepted Answer

Outdated component. An operating system version that no longer receives security updates is an outdated component. This means the vendor has ceased patching known vulnerabilities, leaving the system exposed to exploits that target unpatched flaws. In the context of a public web server, this directly violates the principle of maintaining a secure baseline and is a common finding in vulnerability scans.

Answer

Weak permissions

Answer

DNS poisoning

Answer

Smishing

Question 13

After a suspected compromise, a server's local tools report sshd listening on port 22, but netstat and the EDR console fail to show the process that owns the socket. A reboot does not remove the issue, and firmware integrity checks pass. Which malware type is most likely installed?

Accepted Answer

Rootkit, because it is designed to hide processes, drivers, or sockets from normal security tools.. Option B is correct because a rootkit is specifically designed to hide its presence from the operating system and security tools by intercepting system calls (e.g., those used by netstat and EDR) to conceal processes, drivers, and network sockets. The persistence after reboot and clean firmware integrity checks indicate the rootkit is installed at the kernel or boot level, bypassing user-mode detection.

Answer

Spyware, because hidden software is often used to collect credentials and data.

Answer

Ransomware, because the server remains operational while still hiding evidence.

Answer

Logic bomb, because the issue persists after reboot and could trigger later.

Question 14

An auditor asks for evidence that the new workstation hardening baseline is actually applied across all finance laptops. Which evidence is the best to provide?

Accepted Answer

An automated compliance report from the configuration management tool showing baseline status across all devices.. Option D is correct because an automated compliance report from a configuration management tool (e.g., Microsoft Intune, SCCM, or Ansible) provides verifiable, centralized evidence that the hardening baseline is applied across all finance laptops. Unlike manual screenshots or policy documents, this report shows real-time or historical compliance status for every device, proving enforcement at scale.

Answer

A copy of the hardening policy that says all laptops must be secured.

Answer

A manager’s email confirming that the baseline was announced to the team.

Answer

Screenshots from one finance laptop showing the baseline settings.

Question 15

After a phishing simulation, many employees still almost entered credentials into a fake login page. Leadership wants the fastest improvement without creating training fatigue or disrupting daily work. Which three measures are the best balance of security and usability? Select three.

Accepted Answer

Provide targeted microtraining only to users who clicked or nearly clicked.. Option A is correct because targeted microtraining focuses only on the users who demonstrated risky behavior (clicking or nearly clicking), which directly addresses the root cause without wasting time on users who did not engage. This approach avoids training fatigue by keeping content brief and relevant, and it does not disrupt daily work for the majority of employees who already exhibit secure behavior.

Answer

Replace email access with a weekly manual approval queue for all messages.

Answer

Publicly identify the worst performers in team meetings to discourage mistakes.