SY0-701 Practice Test 24 — 15 Questions

Question 1

Based on the exhibit, which document should be created or updated to make these settings mandatory and measurable?

Endpoint baseline draft:
- Full-disk encryption should be enabled on all corporate laptops.
- Screen lock should activate after 15 minutes of inactivity.
- Users should choose strong passwords.

Related documents:
Policy: Acceptable Use Policy
Standard: none
Procedure: Laptop imaging steps
Guideline: Suggested hardening tips

Accepted Answer

Create or update a standard because it defines mandatory, specific minimum requirements.. A standard defines mandatory, specific minimum requirements that must be met, such as 'full-disk encryption enabled' and 'screen lock after 15 minutes.' Unlike policies (high-level intent) or guidelines (suggestions), a standard provides measurable criteria that can be audited and enforced. Creating or updating a standard makes the endpoint baseline settings mandatory and measurable.

Answer

Update the policy because policies are always the most detailed technical documents.

Answer

Update the procedure because procedures are the best place for corporate requirements.

Answer

Update the guideline because guidelines are the strongest way to enforce compliance.

Question 2

A manufacturer identifies a rare but very costly ransomware risk. Executives decide not to eliminate the activity, but to purchase cyber insurance and formally acknowledge the remaining exposure. Which risk treatment is being used?

Accepted Answer

Transfer. (Transfer) because purchasing cyber insurance shifts the financial risk of the ransomware incident to the insurer. The executives formally acknowledge the remaining exposure, which confirms they are not simply accepting the risk but are actively transferring the monetary impact through a contractual agreement.

Answer

Avoidance

Answer

Mitigation

Answer

Acceptance

Question 3

A legal department needs a contract file that can later prove who signed it and whether the content changed after signing. Which cryptographic mechanism should be used?

Accepted Answer

Digital signature. A digital signature provides non-repudiation, ensuring the signer cannot deny signing the document, and integrity, detecting any changes after signing. It uses asymmetric cryptography where the signer's private key creates the signature, and the public key verifies it, making it the correct choice for proving both identity and content integrity.

Answer

Symmetric encryption

Answer

Hashing

Answer

Tokenization

Question 4

A user's workstation suddenly renames documents with a new extension, displays a ransom note, and blocks access to a shared drive. Which two indicators support ransomware? Select two.

Accepted Answer

Files are renamed or encrypted and no longer open normally. Ransomware typically encrypts files and renames them with a new extension (e.g., .encrypted, .locked), making them unopenable without the decryption key. This behavior directly matches the scenario where documents are renamed and access is blocked, confirming file encryption as a core indicator of ransomware.

Answer

The mouse pointer moves slowly after long idle periods

Answer

The browser homepage changed after a software update

Answer

A new USB keyboard is detected by the operating system

Question 5

A business owner asks whether to proceed with a medium-risk issue on an internal reporting system. The vulnerability is unlikely to be exploited because the system is reachable only from a segmented admin network, and no sensitive data is stored there. The owner wants to postpone remediation until the next planned upgrade window. Which risk treatment is being chosen?

Accepted Answer

Risk acceptance, because the business is choosing to live with the remaining risk for now.. Risk acceptance is the deliberate decision to acknowledge and tolerate a risk without immediate remediation. In this scenario, the business owner understands the vulnerability is low-likelihood (segmented admin network, no sensitive data) and chooses to postpone fixing it until the next planned upgrade, thereby accepting the residual risk for that period.

Answer

Risk avoidance, because the system will be upgraded later.

Answer

Risk transfer, because the upgrade window shifts responsibility to the vendor.

Answer

Risk escalation, because the issue is being sent to the help desk for tracking.

Question 6

A help desk technician receives a call from a user who says many of their documents now have strange file extensions and a ransom note appeared on the desktop. The files will not open. What type of malware is the user most likely experiencing?

Accepted Answer

Ransomware that encrypts files and demands payment for recovery. The user's symptoms—unopenable files with strange extensions and a ransom note—are classic indicators of ransomware. Ransomware encrypts files using a symmetric key (e.g., AES-256) and then demands payment, typically in cryptocurrency, to provide the decryption key. This matches the scenario exactly, as the files are rendered inaccessible and a note is left behind.

Answer

Spyware that silently records user activity over time

Answer

A worm that spreads mainly by scanning for other hosts

Answer

A rootkit that hides malicious processes from the operating system

Question 7

A web portal builds its database query by directly appending a user's search input. When the user types a single quote, the application returns a database error. Which attack is most likely?

Accepted Answer

SQL injection. The application directly concatenates user input into a database query without sanitization. When a single quote (') is appended, it breaks the SQL string delimiter, causing a syntax error that the database exposes. This is the classic indicator of a SQL injection vulnerability, where an attacker can manipulate the query structure.

Answer

Cross-site scripting

Answer

DNS poisoning

Answer

Privilege escalation

Question 8

An IDS generates an alert for possible SQL injection against an internal reporting portal at 02:00. The web logs show the source IP belongs to the company's approved vulnerability scanner, the request path matches the scheduled test window, and the WAF blocked the request. What is the most appropriate analyst conclusion?

Accepted Answer

Close it as expected activity after validating the scanner schedule and source IP.. The alert matches expected, authorized activity: the source IP belongs to the approved vulnerability scanner, the request occurred during the scheduled test window, and the WAF blocked the malicious payload. This is a classic false positive triggered by legitimate security testing, not an actual intrusion. The analyst should validate the scanner schedule and source IP, then close the alert as expected activity.

Answer

Treat it as a confirmed intrusion and immediately take the portal offline.

Answer

Classify it as malware because the blocked payload proves the scanner is infected.

Answer

Disable the WAF rule so the scanner can complete without generating more alerts.

Question 9

A company wants to detect unauthorized changes to production server configurations before users notice an outage. Which two controls best fit this goal? Select two.

Accepted Answer

File integrity monitoring on critical system files. File integrity monitoring (FIM) on critical system files is correct because it detects unauthorized changes by comparing current file hashes against a known-good baseline. When a change occurs, FIM generates an alert, enabling the security team to investigate before users notice an outage. This directly addresses the goal of detecting configuration tampering proactively.

Answer

Full-disk encryption on the server volumes

Answer

Multifactor authentication for remote administrators

Answer

Network segmentation between user VLANs and server VLANs

Question 10

A records manager discovers 18-month-old paper onboarding forms stored in a cabinet. The retention schedule says the forms must be destroyed after 12 months unless legal hold applies, and no hold has been issued. What is the best next step?

Accepted Answer

Destroy the forms using an approved secure disposal method and document the action.. The retention schedule explicitly requires destruction after 12 months with no legal hold. An approved secure disposal method (e.g., cross-cut shredding or incineration) ensures the sensitive PII on onboarding forms is irrecoverable, and documenting the action provides an audit trail for compliance with data protection regulations like GDPR or HIPAA.

Answer

Keep the forms indefinitely in case a future audit asks for them.

Answer

Scan the forms into a shared folder and then throw away the paper.

Answer

Return the forms to HR so they can be reused for new hires.

Question 11

A security architect is evaluating a zero trust architecture (ZTA) for a remote workforce. Which three of the following components are essential to the implementation? (Choose three.)

Accepted Answer

Microsegmentation to limit lateral movement even after initial access is granted.. A policy engine is essential in zero trust architecture (ZTA) because it continuously evaluates trust based on user identity, device health, and context, dynamically granting or denying access. Microsegmentation is critical as it enforces granular access controls between workloads, preventing lateral movement even after an initial breach. Encrypting all traffic, including east-west communications, ensures data confidentiality and integrity across the network, aligning with the ZTA principle of never trusting and always verifying.

Answer

A single, static firewall rule that allows all traffic from the corporate VPN IP range.

Answer

A mandatory VPN for all remote users before accessing any resource.

Answer

Implicit trust for all devices that are connected to the internal network.

Question 12

A login form sends user input directly into a database query. When a tester enters a single quote character, the application returns a database error. What attack is most likely?

Accepted Answer

SQL injection. The application directly concatenates user input into a database query without sanitization. Entering a single quote breaks the SQL syntax, causing a database error, which is a classic indicator of SQL injection (SQLi). This vulnerability allows an attacker to manipulate the query structure and potentially extract or modify database contents.

Answer

Cross-site scripting

Answer

Session hijacking

Answer

Insecure deserialization

Question 13

Which two documents are typically mandatory and organization-wide rather than optional guidance? Select two.

Accepted Answer

Security policy. Security policies are mandatory, high-level documents that define management's intent and direction for security, establishing rules that all employees must follow. They are organization-wide and enforceable, unlike guidelines which are optional. Standards are also mandatory and specify uniform technical controls or configurations (e.g., requiring AES-256 encryption) that must be implemented across the organization to comply with the security policy.

Answer

Guideline

Answer

Personal preference note

Answer

Architecture diagram

Question 14

Which two actions are examples of accounting in AAA? Select two.

Accepted Answer

Recording successful logons in a security log. Accounting in AAA involves recording user activities, such as successful logons, in a security log. This provides an audit trail for monitoring and compliance. Option C is correct because tracking which files a user opened during a session is a form of accounting that logs resource access for accountability and usage analysis.

Answer

Checking a username and password before access

Answer

Granting access to the finance folder

Answer

Requiring a fingerprint and a password

Question 15

An EDR alert shows a finance workstation launching rundll32 from %AppData%, creating a scheduled task, and making repeated HTTPS beacons to a rare domain. The user still has open accounting files, and the SOC wants to slow spread without losing evidence. What two actions should be taken first? Select two.

Accepted Answer

Isolate the workstation from the network using EDR or NAC containment.. Isolating the workstation (A) stops the malware from communicating with its C2 server via HTTPS beacons and prevents lateral movement, while preserving the evidence on disk. Capturing volatile evidence (C) before any shutdown or isolation ensures that memory-resident artifacts, active network connections, and running processes are preserved, which are critical for forensic analysis and understanding the attack chain.

Answer

Immediately wipe and reimage the workstation before collecting anything else.

Answer

Power the workstation off immediately to stop the malware process.

Answer

Disable every user account in the finance department to prevent further compromise.