SY0-701 Practice Test 24 — 15 Questions

Question 1

After a successful phishing attempt, the security team adds MFA, email sandboxing, endpoint isolation, and immutable backups so that one failed safeguard does not expose the company. Which principle does this best illustrate?

Accepted Answer

Defense in depth. Defense in depth is the best fit because the organization is using several independent safeguards across different layers: user authentication, email inspection, endpoint containment, and backup recovery. The idea is that a single compromise, such as one successful phishing email, should not lead directly to full compromise. Security+ expects you to recognize layered protection as a strategy, not just list individual tools.

Why others are wrong: Need-to-know concerns restricting information to only those who require it for their job. Availability is one of the CIA triad objectives, but it is not a layered security strategy. Compensating control refers to an alternative measure used because the preferred control is unavailable or impractical; here the organization is not replacing one missing control, but strengthening multiple defenses at once.

Answer

Need-to-know

Answer

Availability

Answer

Compensating control

Question 2

After a ransomware incident, management says backups are available but will not approve closure until the team proves the restore process works without risking production data. Which two actions best validate recoverability? Select two.

Accepted Answer

Restore a recent backup to an isolated test system that mirrors production.. Restoring to an isolated test system that mirrors production (Option A) is correct because it validates the backup's integrity and the restore process without any risk to the live production environment. This approach ensures the backup data is readable and the restoration steps are documented and repeatable, directly addressing management's requirement to prove recoverability without endangering production data.

Answer

Increase backup retention without testing the restore process.

Answer

Keep the original ransomware-affected server online until the backup is approved.

Answer

Use the backup job report as proof that the data can be recovered.

Question 3

A Windows file server was rebuilt from a gold image, but later troubleshooting re-enabled Remote Desktop, SMBv1, and the Print Spooler. The security team wants to harden the host and catch the same configuration changes early in the future. Which three actions are the best fit? Select three.

Accepted Answer

Disable unnecessary services and remove legacy protocols that are not required.. Option A is correct because disabling unnecessary services like the Print Spooler and removing legacy protocols such as SMBv1 directly reduces the attack surface. SMBv1 is known for vulnerabilities like EternalBlue (MS17-010), and the Print Spooler has been exploited in PrintNightmare attacks. This aligns with the principle of least functionality, a core security architecture concept.

Answer

Leave all management ports open so technicians can troubleshoot from anywhere.

Answer

Turn off logging to reduce the chance that attackers can see the server.

Question 4

After an internal PKI was rebuilt, users now see certificate warnings when connecting to the company intranet portal. The portal certificate chains to a new CA, but endpoint trust stores do not recognize it yet. What should the administrator deploy?

Accepted Answer

The root CA certificate for the new PKI to trusted endpoint stores.. The correct answer is B because the root CA certificate must be distributed to all endpoint trust stores to establish trust in the new PKI. Without the root CA in the trusted root certification authorities store, the certificate chain is incomplete, causing browsers to display certificate warnings. Deploying the root CA certificate via Group Policy or MDM resolves this by allowing endpoints to validate the portal's certificate chain.

Answer

The portal's private key so users can validate the certificate locally.

Answer

A new certificate signing request on each endpoint.

Answer

A self-signed certificate on the portal to avoid future CA problems.

Question 5

A web service begins experiencing severe latency. Netflow shows thousands of short DNS queries leaving the attacker network, while a much larger volume of DNS responses is arriving at the victim’s public IP address from many open resolvers. Which attack is most likely occurring?

Accepted Answer

DNS reflection and amplification denial-of-service attack. The attack described is a DNS reflection and amplification denial-of-service attack. The attacker sends thousands of short DNS queries with a spoofed source IP (the victim's IP) to many open resolvers, which then send large DNS responses to the victim, overwhelming its bandwidth. NetFlow shows a small volume of queries leaving the attacker and a much larger volume of responses arriving at the victim, which is the hallmark of amplification (small request, large response) combined with reflection (responses from third-party resolvers).

Answer

Replay attack using previously captured packets

Answer

ARP poisoning that redirects local traffic on a LAN

Answer

Session hijacking through stolen authentication cookies

Question 6

After a routine dependency update, a development team notices that the customer portal begins making outbound connections to an unfamiliar domain during startup. The domain is not part of the application design, and the behavior started immediately after the third-party library was updated. Which threat is most likely?

Accepted Answer

Supply-chain compromise. The scenario describes a supply-chain compromise, where a trusted third-party library has been maliciously altered to include unauthorized outbound connections. This is a classic software supply-chain attack, as the dependency update introduced code that phones home to an unfamiliar domain, indicating the library's integrity was compromised before or during distribution.

Answer

Evil twin access point

Answer

Bluetooth pairing abuse

Answer

DNS poisoning on the client network

Question 7

A workstation opens an attachment labeled as an invoice and then begins creating scheduled tasks, disabling security services, and contacting a known malicious IP address. What is the best first containment action?

Accepted Answer

Isolate the workstation from the network using the EDR containment feature. Option B is correct because the workstation is actively communicating with a known malicious IP address and disabling security services, indicating an active compromise. Isolating the workstation via EDR containment immediately stops the outbound command-and-control traffic and prevents lateral movement, which is the priority first step in incident response before any remediation or analysis.

Answer

Run a full antivirus scan while leaving the system connected

Answer

Reboot the workstation to clear any active malicious processes

Answer

Uninstall the email client that delivered the attachment

Question 8

After a phishing incident, the security team wants to preserve evidence for later review. Which action is most appropriate?

Accepted Answer

Capture and save the email headers and message content. Option B is correct because preserving the email headers and message content is essential for forensic analysis. Email headers contain routing information, including the originating IP address, authentication results (SPF, DKIM, DMARC), and timestamps, which are critical for tracing the source of the phishing attack and understanding the attack vector. Deleting or forwarding the email would destroy this evidence, compromising the investigation.

Answer

Have the user delete the phishing email to avoid further exposure

Answer

Forward the email to every employee as a warning

Answer

Change the user's office seat assignment immediately

Question 9

After a phishing campaign, 18 employees entered credentials on a fake login page. Management wants a program that both reduces future click rates and provides measurable improvement over time. What should security implement?

Accepted Answer

Simulated phishing with targeted follow-up training and metrics. Option B is correct because simulated phishing campaigns directly address the human factor by providing a controlled, repeatable test that measures click rates over time. When an employee falls for the simulation, targeted follow-up training (e.g., micro-learning modules) reinforces secure behavior, and the metrics (e.g., click-through rate, reporting rate) allow management to track improvement. This aligns with the security program management goal of continuous improvement through measurable security awareness.

Answer

A one-time company email reminding employees to be careful

Answer

An updated password complexity rule for all users

Answer

A banner that all external email is untrusted

Question 10

After a user signs in, a file server checks whether they can edit a shared folder. Which AAA concept is being applied?

Accepted Answer

Authorization. The file server is checking whether the authenticated user has the specific permission to edit the shared folder. This is the definition of authorization: determining what an authenticated user is allowed to do. Authentication (A) only verifies identity, not rights; accounting (C) tracks usage; encryption (D) protects data in transit or at rest.

Answer

Authentication

Answer

Accounting

Answer

Encryption

Question 11

After a workstation reboot, users see many files renamed with random extensions. A ransom note demands cryptocurrency, and Volume Shadow Copies were deleted from the machine. What malware type is most likely?

Accepted Answer

Ransomware, because the files were encrypted and payment was demanded.. The scenario describes files renamed with random extensions (indicating encryption), a ransom note demanding cryptocurrency, and deletion of Volume Shadow Copies (VSS) to prevent file recovery. These are hallmark behaviors of ransomware, specifically a crypto-ransomware variant that encrypts user data and removes backup copies to maximize extortion pressure.

Answer

Trojan, because the malware may have been disguised as a legitimate application.

Answer

Worm, because the malware likely spread automatically to other systems.

Answer

Rootkit, because the attacker would want to hide persistence on the system.

Question 12

After a workstation hardening baseline is updated, the security team wants to confirm that finance laptops actually match the new settings. Which control is the best way to verify this?

Accepted Answer

Run a configuration compliance scan against the updated baseline. A configuration compliance scan compares the current settings of the finance laptops against the updated hardening baseline. This automated process checks specific registry keys, file permissions, service states, and security policy settings (e.g., via SCAP or CIS benchmarks) to verify alignment. It provides objective, measurable evidence of compliance, unlike subjective user feedback or assumptions.

Answer

Ask users whether they think their laptops are secure

Answer

Assume the baseline was applied because the change ticket was approved

Answer

Delete the old baseline so there is only one policy to reference

Question 13

After employees transfer departments, they keep access to old SaaS applications because app-specific accounts are removed only after a manual cleanup ticket. Which two changes best close the lifecycle gap? Select two.

Accepted Answer

Use automated provisioning and deprovisioning tied to HR events through SCIM or an equivalent interface.. Option A is correct because automating provisioning and deprovisioning via SCIM (System for Cross-domain Identity Management) ties account lifecycle directly to HR events (e.g., termination, transfer). This eliminates the manual cleanup ticket gap by instantly removing or modifying access when an employee changes departments, ensuring no stale SaaS accounts remain.

Answer

Keep app accounts manually managed so each app owner can decide independently.

Answer

Share a generic help desk password for quick access restoration.

Answer

Require password changes every 30 days for all users.

Question 14

A web application must keep running if one application server fails. Management wants the simplest design that automatically switches traffic to a healthy server. Which two choices support that goal? Select two.

Accepted Answer

Place the application behind a load balancer with health checks.. Option A is correct because a load balancer with health checks can automatically detect a failed application server and redirect traffic to healthy servers, ensuring continuous availability. This is the simplest design that meets the requirement for automatic failover without manual intervention. Health checks typically use HTTP/HTTPS probes or TCP port checks to verify server responsiveness.

Answer

Run the application on a single server with nightly backups.

Answer

Disable health checks to avoid false failovers.

Answer

Put the database on the public internet for easier access.

Question 15

An accounts payable clerk receives an email that appears to continue an existing thread with a shipping vendor. The sender name, signature block, and invoice number all match a real open order, and the message asks the clerk to use a "new payment portal" and confirm bank details before 3 PM to avoid delayed shipment. The email contains no attachments and only one URL. Which attack type is most likely?

Accepted Answer

Pretexting, because the attacker is impersonating a trusted vendor to create a believable reason for the request.. Option B is correct because the attacker is not just sending a generic targeted email but is actively impersonating a trusted vendor and fabricating a scenario (the need to use a new payment portal to avoid shipment delay) to manipulate the victim into divulging sensitive bank details. This aligns with pretexting, where the attacker creates a false pretext (a believable reason) to obtain information, rather than relying on malicious attachments or links alone. The email's use of an existing thread, matching sender details, and time pressure all support the pretext, making it a classic impersonation-based social engineering attack.

Answer

Spear phishing, because the email uses targeted business context and time pressure.

Answer

Smishing, because the attacker is using a text message to reach the victim.

Answer

Baiting, because the attacker is offering a portal link that appears helpful to the recipient.