SY0-701 Practice Test 24 — 15 Questions

Question 1

A company wants to detect unauthorized changes to production server configurations before users notice an outage. Which two controls best fit this goal? Select two.

Accepted Answer

File integrity monitoring on critical system files. File integrity monitoring (FIM) on critical system files is correct because it detects unauthorized changes by comparing current file hashes against a known-good baseline. When a change occurs, FIM generates an alert, enabling the security team to investigate before users notice an outage. This directly addresses the goal of detecting configuration tampering proactively.

Answer

Full-disk encryption on the server volumes

Answer

Multifactor authentication for remote administrators

Answer

Network segmentation between user VLANs and server VLANs

Question 2

A records manager discovers 18-month-old paper onboarding forms stored in a cabinet. The retention schedule says the forms must be destroyed after 12 months unless legal hold applies, and no hold has been issued. What is the best next step?

Accepted Answer

Destroy the forms using an approved secure disposal method and document the action.. The retention schedule explicitly requires destruction after 12 months with no legal hold. An approved secure disposal method (e.g., cross-cut shredding or incineration) ensures the sensitive PII on onboarding forms is irrecoverable, and documenting the action provides an audit trail for compliance with data protection regulations like GDPR or HIPAA.

Answer

Keep the forms indefinitely in case a future audit asks for them.

Answer

Scan the forms into a shared folder and then throw away the paper.

Answer

Return the forms to HR so they can be reused for new hires.

Question 3

A login form sends user input directly into a database query. When a tester enters a single quote character, the application returns a database error. What attack is most likely?

Accepted Answer

SQL injection. The application directly concatenates user input into a database query without sanitization. Entering a single quote breaks the SQL syntax, causing a database error, which is a classic indicator of SQL injection (SQLi). This vulnerability allows an attacker to manipulate the query structure and potentially extract or modify database contents.

Answer

Cross-site scripting

Answer

Session hijacking

Answer

Insecure deserialization

Question 4

Which two documents are typically mandatory and organization-wide rather than optional guidance? Select two.

Accepted Answer

Security policy. Security policies are mandatory, high-level documents that define management's intent and direction for security, establishing rules that all employees must follow. They are organization-wide and enforceable, unlike guidelines which are optional. Standards are also mandatory and specify uniform technical controls or configurations (e.g., requiring AES-256 encryption) that must be implemented across the organization to comply with the security policy.

Answer

Guideline

Answer

Personal preference note

Answer

Architecture diagram

Question 5

Which two actions are examples of accounting in AAA? Select two.

Accepted Answer

Recording successful logons in a security log. Accounting in AAA involves recording user activities, such as successful logons, in a security log. This provides an audit trail for monitoring and compliance. Option C is correct because tracking which files a user opened during a session is a form of accounting that logs resource access for accountability and usage analysis.

Answer

Checking a username and password before access

Answer

Granting access to the finance folder

Answer

Requiring a fingerprint and a password

Question 6

Match each procurement or oversight need to the best vendor due diligence artifact or clause. Use each item once.

Accepted Answer

Assess security controls: Security questionnaire. These artifacts support vendor due diligence: questionnaires assess controls, SOC 2 reports provide independent assurance, audit clauses enable customer verification, DPAs govern data handling, BCPs ensure resilience, and pen tests validate security.

Answer

Assess security controls: SOC 2 report

Answer

Data protection: Business continuity plan

Question 7

A help desk team manages 300 Windows laptops. A legacy accounting app sometimes fails after updates, so the company wants to reduce patch risk while still preventing long-term exposure. Which patching strategy is the best balance?

Accepted Answer

Use a pilot group and phased rollout process before wider deployment.. A pilot group with phased rollout lets the team validate patches against the legacy accounting app on a small subset before broad deployment, catching compatibility regressions while still meeting patch SLAs. This balances availability risk against the security risk of unpatched systems.

Answer

Apply updates manually to each laptop as soon as they are released.

Answer

Postpone all updates until the legacy accounting app is replaced.

Answer

Disable automatic updates permanently and patch only after a security incident.

Question 8

Match each requirement or instruction to the correct governance document type. Use each document type once.

Accepted Answer

Policy: High-level statement of management intent. These matches align with common governance document types in IT security frameworks: policy provides high-level direction, standard sets mandatory rules, procedure gives step-by-step instructions, guideline offers non-mandatory recommendations, baseline defines minimum configurations, and framework provides a structured approach.

Answer

Procedure: Recommended best practices, not mandatory

Answer

Guideline: Step-by-step instructions for performing a task

Question 9

Match each security monitoring artifact from the SOC alert queue to the best investigation focus.

Accepted Answer

Phishing: Investigate email headers and links. Each alert type suggests a specific investigation focus: phishing requires email analysis; malware needs file/behavior analysis; brute force focuses on auth logs; data exfiltration looks at outbound traffic; privileged misuse examines user activity; ransomware involves encryption events.

Answer

Brute force: Audit user activity logs for unusual administrative actions

Answer

Data exfiltration: Check for file encryption events and ransom notes

Answer

Privileged misuse: Monitor outbound traffic volume to unusual destinations

Answer

Ransomware: Review authentication logs for repeated failures

Question 10

Match each awareness-program metric to the interpretation the security team should use.
1. 8% of users clicked the simulated phishing link.
2. 34% of users reported the simulation using the report-phish button.
3. The median time from message delivery to first user report was 12 minutes.
4. 96% of staff completed the annual awareness module.

Accepted Answer

8% of users clicked: Indicates user susceptibility to phishing.. Each metric guides interpretation: click rate indicates susceptibility, report rate shows security culture, reaction time measures responsiveness, and completion rate reflects training adoption.

Answer

8% of users clicked: Demonstrates strong security culture.

Answer

34% of users reported: Measures susceptibility to phishing.

Question 11

Which four of the following are key components of a successful security awareness and training program within an organization? (Choose four.)

Accepted Answer

Executive-level sponsorship and support for the program. Role-based training is correct because it ensures that employees receive security education relevant to their specific job functions, such as data handling for finance or system access for IT, which increases the practical applicability and retention of security principles. Phishing simulations are correct as they provide hands-on reinforcement of skills, allowing employees to practice identifying and reporting malicious emails in a controlled environment, which directly reduces real-world risk. Metrics like click rates on simulated phishing emails are correct because they provide quantifiable data to measure program effectiveness, identify high-risk groups, and guide continuous improvement. Executive-level sponsorship is correct because it provides the necessary authority, resources, and organizational commitment to prioritize security awareness, ensuring the program is taken seriously across all departments.

Answer

Outsourcing all training content development to a single vendor without internal review

Answer

Annual one-time training with no follow-up assessments

Question 12

Match each access principle to the best description.

Accepted Answer

Least privilege: Users get minimal permissions needed. Least privilege grants minimal permissions, separation of duties splits critical tasks, defense in depth uses multiple security layers, need-to-know restricts data access, RBAC assigns permissions by role, and accountability ensures traceability.

Answer

Least privilege: Splitting critical tasks among multiple people

Answer

Separation of duties: Users get minimal permissions

Question 13

Match each excerpt from a small enterprise security program to the correct governance artifact.

Accepted Answer

Policy: All employees must use multi-factor authentication. Policy defines mandatory rules; Procedure gives step-by-step instructions; Standard specifies technical requirements; Guideline offers best practices.

Answer

Procedure: All employees must use multi-factor authentication

Answer

Policy: It is recommended to use complex passwords

Question 14

A legacy production scanner cannot support MFA, but it must remain available for six months until replacement hardware arrives. What is the best security response?

Accepted Answer

Approve a time-bound exception with compensating controls and a review date.. It balances security with operational necessity by implementing a time-bound exception with compensating controls (e.g., network segmentation, strict access logging, or IP whitelisting) and a mandatory review date. This ensures the legacy scanner remains available for six months while mitigating the risk of unauthorized access, aligning with the principle of least privilege and security program oversight.

Answer

Permanently waive MFA for the scanner and leave the exception open-ended.

Answer

Shut down the scanner immediately until MFA can be enabled.

Answer

Create a shared administrator account so operators can sign in more easily.

Question 15

Which three of the following are examples of defense-in-depth security controls? (Choose three.)

Accepted Answer

Regular security awareness training for employees. Defense-in-depth is a layered security strategy that uses multiple, independent controls to protect assets. A firewall at the network perimeter provides network-level filtering (e.g., stateful inspection, ACLs) as the first line of defense. Mandatory access controls (MAC) on sensitive files enforce system-enforced restrictions based on labels (e.g., Bell-LaPadula model), adding a host-level layer. Regular security awareness training addresses the human factor, reducing social engineering and phishing risks, which is a critical administrative control.

Answer

Using only one antivirus solution for all endpoints

Answer

Disabling all logging to save storage space

Answer

A single password policy for all users