SY0-701 Practice Test 23 — 15 Questions

Question 1

Based on the exhibit, which change should be made first to secure remote administration of the network device?

Accepted Answer

Disable Telnet and allow SSHv2 only for remote administration.. Telnet transmits all data, including credentials, in cleartext, making it vulnerable to interception. SSHv2 provides encrypted remote administration and is the secure replacement for Telnet. Disabling Telnet and enabling only SSHv2 is the immediate and necessary first step to secure remote device management.

Answer

Enable FTP so administrators can upload and download configuration files securely.

Answer

Open the management interface to any internet host as long as the password is complex.

Answer

Use one shared local administrator account for all network engineers.

Question 2

A records manager is told that some HR emails may be needed for an active investigation, while unrelated messages are still due for deletion under the retention schedule. Which two actions should the manager take? Select two.

Accepted Answer

Place the affected emails on legal hold. A is correct because placing the affected emails on legal hold suspends the retention schedule for those specific records, ensuring they are preserved for the active investigation without altering the deletion policy for unrelated messages. This is a standard practice under eDiscovery and legal hold procedures, often implemented via Exchange Online or similar systems using litigation hold or in-place hold.

Answer

Delete all related records immediately to reduce storage costs

Answer

Move them into a personal archive folder

Answer

Rewrite the retention schedule without approval

Question 3

A SOC analyst wants to make sure logs from multiple servers can be compared accurately during an incident review. What should be configured on those systems?

Accepted Answer

Time synchronization using the same trusted time source. Time synchronization using a trusted time source (e.g., NTP) ensures that all servers share the same clock. During incident review, accurate log correlation depends on timestamps being consistent across systems; even a few seconds of drift can misalign event sequences. Without synchronized time, comparing logs from multiple servers becomes unreliable, potentially obscuring the true timeline of an attack.

Answer

A local administrator account with the same password on every server

Answer

A larger disk size on the log server

Answer

A separate VLAN for each application server

Question 4

An HR analyst must share a spreadsheet with an external auditor. The spreadsheet includes employee names, Social Security numbers, bank account numbers, and salary data, but the auditor only needs employee names and total payroll. Which three actions best protect the data? Select three.

Accepted Answer

Remove fields the auditor does not need before sharing the file.. Removing unnecessary fields (e.g., Social Security numbers, bank account numbers) before sharing the spreadsheet minimizes the exposure of sensitive personally identifiable information (PII) and financial data. This practice, known as data minimization, aligns with the principle of least privilege and reduces the risk of unauthorized access or data breach. By stripping out extraneous columns, the HR analyst ensures the auditor receives only the required data (employee names and total payroll), thereby protecting the organization from compliance violations under regulations like GDPR or PCI DSS.

Answer

Leave the full spreadsheet intact because the auditor requested a copy.

Answer

Post the spreadsheet in a shared public portal for easier access.

Question 5

The help desk can patch endpoints only after testing on a few pilot systems because one legacy app sometimes breaks after updates. What patching approach is most secure and least disruptive?

Accepted Answer

Apply updates to a small pilot group first, then roll them out in stages to the rest of the fleet.. It follows a phased rollout strategy: testing on a small pilot group first validates compatibility with the legacy app, then staged deployment minimizes disruption while ensuring security patches are applied promptly. This balances the need for security updates with the operational requirement to avoid breaking critical legacy software.

Answer

Wait until all applications are fully modernized before installing any security updates.

Answer

Patch every endpoint immediately at the same time without testing to reduce management overhead.

Answer

Disable automatic updates permanently and patch only after a confirmed incident.

Question 6

After a phishing-awareness campaign, which metric best shows that employees are becoming more resistant to phishing attempts?

Accepted Answer

The percentage of users who click phishing test links. The percentage of users who click phishing test links directly measures behavioral change in response to simulated phishing attacks. A decreasing click rate indicates that employees are better at recognizing and avoiding phishing attempts, which is the primary goal of a phishing-awareness campaign.

Answer

The number of spam emails received by the mail gateway

Answer

The average length of employee passwords

Answer

The count of antivirus alerts on endpoints

Question 7

An EDR console shows PowerShell launching from a scheduled task, decoding a command from memory, and spawning rundll32.exe. No suspicious executable is written to disk, and the activity stops when the process ends. Which threat best fits this behavior?

Accepted Answer

Fileless malware. The behavior describes PowerShell decoding a command from memory and spawning rundll32.exe without writing any executable to disk, which is the hallmark of fileless malware. Fileless malware operates entirely in memory, leveraging legitimate system tools (like PowerShell and rundll32) to execute malicious code, and it leaves no persistent file on the filesystem, so activity ceases when the process ends.

Answer

Trojan downloader

Answer

Rootkit

Answer

Worm

Question 8

Based on the exhibit, which document should be created or updated to make these settings mandatory and measurable?

Endpoint baseline draft:
- Full-disk encryption should be enabled on all corporate laptops.
- Screen lock should activate after 15 minutes of inactivity.
- Users should choose strong passwords.

Related documents:
Policy: Acceptable Use Policy
Standard: none
Procedure: Laptop imaging steps
Guideline: Suggested hardening tips

Accepted Answer

Create or update a standard because it defines mandatory, specific minimum requirements.. A standard defines mandatory, specific minimum requirements that must be met, such as 'full-disk encryption enabled' and 'screen lock after 15 minutes.' Unlike policies (high-level intent) or guidelines (suggestions), a standard provides measurable criteria that can be audited and enforced. Creating or updating a standard makes the endpoint baseline settings mandatory and measurable.

Answer

Update the policy because policies are always the most detailed technical documents.

Answer

Update the procedure because procedures are the best place for corporate requirements.

Answer

Update the guideline because guidelines are the strongest way to enforce compliance.

Question 9

A manufacturer identifies a rare but very costly ransomware risk. Executives decide not to eliminate the activity, but to purchase cyber insurance and formally acknowledge the remaining exposure. Which risk treatment is being used?

Accepted Answer

Transfer. (Transfer) because purchasing cyber insurance shifts the financial risk of the ransomware incident to the insurer. The executives formally acknowledge the remaining exposure, which confirms they are not simply accepting the risk but are actively transferring the monetary impact through a contractual agreement.

Answer

Avoidance

Answer

Mitigation

Answer

Acceptance

Question 10

A legal department needs a contract file that can later prove who signed it and whether the content changed after signing. Which cryptographic mechanism should be used?

Accepted Answer

Digital signature. A digital signature provides non-repudiation, ensuring the signer cannot deny signing the document, and integrity, detecting any changes after signing. It uses asymmetric cryptography where the signer's private key creates the signature, and the public key verifies it, making it the correct choice for proving both identity and content integrity.

Answer

Symmetric encryption

Answer

Hashing

Answer

Tokenization

Question 11

A user's workstation suddenly renames documents with a new extension, displays a ransom note, and blocks access to a shared drive. Which two indicators support ransomware? Select two.

Accepted Answer

Files are renamed or encrypted and no longer open normally. Ransomware typically encrypts files and renames them with a new extension (e.g., .encrypted, .locked), making them unopenable without the decryption key. This behavior directly matches the scenario where documents are renamed and access is blocked, confirming file encryption as a core indicator of ransomware.

Answer

The mouse pointer moves slowly after long idle periods

Answer

The browser homepage changed after a software update

Answer

A new USB keyboard is detected by the operating system

Question 12

A business owner asks whether to proceed with a medium-risk issue on an internal reporting system. The vulnerability is unlikely to be exploited because the system is reachable only from a segmented admin network, and no sensitive data is stored there. The owner wants to postpone remediation until the next planned upgrade window. Which risk treatment is being chosen?

Accepted Answer

Risk acceptance, because the business is choosing to live with the remaining risk for now.. Risk acceptance is the deliberate decision to acknowledge and tolerate a risk without immediate remediation. In this scenario, the business owner understands the vulnerability is low-likelihood (segmented admin network, no sensitive data) and chooses to postpone fixing it until the next planned upgrade, thereby accepting the residual risk for that period.

Answer

Risk avoidance, because the system will be upgraded later.

Answer

Risk transfer, because the upgrade window shifts responsibility to the vendor.

Answer

Risk escalation, because the issue is being sent to the help desk for tracking.

Question 13

A help desk technician receives a call from a user who says many of their documents now have strange file extensions and a ransom note appeared on the desktop. The files will not open. What type of malware is the user most likely experiencing?

Accepted Answer

Ransomware that encrypts files and demands payment for recovery. The user's symptoms—unopenable files with strange extensions and a ransom note—are classic indicators of ransomware. Ransomware encrypts files using a symmetric key (e.g., AES-256) and then demands payment, typically in cryptocurrency, to provide the decryption key. This matches the scenario exactly, as the files are rendered inaccessible and a note is left behind.

Answer

Spyware that silently records user activity over time

Answer

A worm that spreads mainly by scanning for other hosts

Answer

A rootkit that hides malicious processes from the operating system

Question 14

A web portal builds its database query by directly appending a user's search input. When the user types a single quote, the application returns a database error. Which attack is most likely?

Accepted Answer

SQL injection. The application directly concatenates user input into a database query without sanitization. When a single quote (') is appended, it breaks the SQL string delimiter, causing a syntax error that the database exposes. This is the classic indicator of a SQL injection vulnerability, where an attacker can manipulate the query structure.

Answer

Cross-site scripting

Answer

DNS poisoning

Answer

Privilege escalation

Question 15

An IDS generates an alert for possible SQL injection against an internal reporting portal at 02:00. The web logs show the source IP belongs to the company's approved vulnerability scanner, the request path matches the scheduled test window, and the WAF blocked the request. What is the most appropriate analyst conclusion?

Accepted Answer

Close it as expected activity after validating the scanner schedule and source IP.. The alert matches expected, authorized activity: the source IP belongs to the approved vulnerability scanner, the request occurred during the scheduled test window, and the WAF blocked the malicious payload. This is a classic false positive triggered by legitimate security testing, not an actual intrusion. The analyst should validate the scanner schedule and source IP, then close the alert as expected activity.

Answer

Treat it as a confirmed intrusion and immediately take the portal offline.

Answer

Classify it as malware because the blocked payload proves the scanner is infected.

Answer

Disable the WAF rule so the scanner can complete without generating more alerts.