SY0-701 Practice Test 25 — 15 Questions

Question 1

Match each data example to the most appropriate classification label.
1. A public marketing flyer approved for external posting.
2. An internal org chart and office directory meant only for employees.
3. A customer case file with contact details and order history.
4. A vault export containing API keys and encryption secrets.

Accepted Answer

A public marketing flyer approved for external posting: Public. These matches follow a typical data classification scheme: Public for non-sensitive info, Internal for company-only data, Confidential for customer PII, and Restricted for highly sensitive secrets.

Answer

A vault export containing API keys and encryption secrets: Confidential

Answer

A public marketing flyer approved for external posting: Internal

Question 2

Which four of the following are effective mitigations against SQL injection attacks? (Choose four.)

Accepted Answer

Using parameterized queries or prepared statements. Parameterized queries and prepared statements are effective because they separate SQL logic from user input, ensuring that input is treated as data rather than executable code. This prevents attackers from injecting malicious SQL commands into query strings, as the database engine compiles the query structure before parameters are bound.

Answer

Blocking all user input containing the word 'SELECT'

Answer

Using client-side JavaScript validation exclusively

Question 3

Which four of the following are common indicators of a phishing attack? (Choose four.)

Accepted Answer

Spoofed sender email address that mimics a legitimate domain. These four options are correct because they represent classic hallmarks of phishing attacks. Urgent or threatening language is a social engineering tactic to bypass rational thought. Spoofed sender addresses exploit trust in familiar domains. Unsolicited attachments or links are the primary delivery mechanism for phishing payloads. Grammatical errors and poor formatting often indicate a lack of professional quality control typical of legitimate organizations.

Answer

A request for sensitive information via a secure web portal

Answer

Presence of a digital signature from a trusted certificate authority

Question 4

Match each cryptographic action to the most appropriate use case.

Accepted Answer

Encryption: Ensuring confidentiality. Encryption ensures confidentiality, hashing ensures integrity, digital signatures provide authentication and non-repudiation, key exchange enables secure key distribution, certificate signing establishes trust, and random numbers are essential for key generation.

Answer

Key Exchange: Ensuring integrity

Answer

Random Number Generation: Providing authentication

Question 5

Match each principle to the scenario that best illustrates it.

Accepted Answer

Least privilege: A user is given only the permissions needed to perform their job.. Least privilege limits access rights; separation of duties divides critical tasks; defense in depth uses multiple security layers; need to know restricts data access; accountability tracks actions; fail safe ensures security on failure.

Answer

Least privilege: Two people are required to approve a financial transaction.

Answer

Separation of duties: A user is given only the permissions needed to perform their job.

Answer

Defense in depth: An employee accesses customer data only when required for their role.

Question 6

A security analyst is reviewing the organization's incident response procedures. According to the NIST SP 800-61 framework, which four of the following are recognized phases of the incident response lifecycle? (Choose four.)

Accepted Answer

Preparation. The NIST SP 800-61 Revision 2 framework defines the incident response lifecycle as consisting of four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. These phases form a continuous cycle, with lessons learned from Post-Incident Activity feeding back into Preparation. The question asks for the four recognized phases, and these four options directly match the NIST model.

Answer

Threat Hunting

Answer

Risk Assessment

Question 7

A company wants guest laptops on Wi-Fi to reach the internet but not internal printers or servers. Which two changes best support this design? Select two.

Accepted Answer

Assign guest access points to a separate VLAN with its own subnet.. Assigning guest access points to a separate VLAN with its own subnet isolates guest traffic at Layer 2, preventing direct communication with internal devices like printers and servers. This segmentation is a foundational step for enforcing access control policies without relying solely on higher-layer filtering.

Answer

Allow guests on the same VLAN as employee devices for simpler routing.

Answer

Enable WPA2-Enterprise on employee wireless only, and reuse that on guest devices.

Answer

Put printers on the guest VLAN so guests can print directly.

Question 8

Users on the same VLAN report that their browser occasionally reaches a fake internal portal, and packet captures show one host sending forged ARP replies that claim to be the default gateway. Traffic from nearby systems begins flowing through that host. Which attack is occurring?

Accepted Answer

ARP spoofing. B is correct because the scenario describes ARP spoofing (also known as ARP poisoning). The attacker sends forged ARP replies to associate their MAC address with the default gateway's IP address, causing traffic from other hosts on the same VLAN to be redirected through the attacker's machine. This allows the attacker to intercept, modify, or redirect traffic to a fake internal portal, which is a classic man-in-the-middle (MITM) attack leveraging the stateless nature of ARP.

Answer

DNS poisoning

Answer

MAC flooding

Answer

SYN flood

Question 9

An organization is implementing a Security Information and Event Management (SIEM) system to enhance its security monitoring capabilities. Which four of the following are primary functions of a SIEM? (Choose four.)

Accepted Answer

Automated threat intelligence feed integration. A SIEM's primary functions include correlation of log data from multiple sources to identify patterns and anomalies, real-time alerting on security events to enable immediate response, centralized log storage and retention for compliance and forensic analysis, and automated threat intelligence feed integration to enrich event data with known indicators of compromise (IOCs). These capabilities collectively provide comprehensive security monitoring and incident detection.

Answer

In-line network traffic blocking

Answer

Vulnerability scanning and patch management

Question 10

Match each detection pattern to the most likely security issue. Each item has one best match.

Accepted Answer

Repeated login failures: Brute-force attack. Repeated login failures indicate brute-force; Outbound connections to malicious IPs suggest C2; Large data transfers at odd hours indicate exfiltration; Random DNS subdomains are typical of tunneling; Conflicting ARP replies show spoofing; Multiple ICMP requests from many sources indicate DDoS.

Answer

Random DNS subdomains: DDoS

Answer

Conflicting ARP replies: Data exfiltration

Question 11

A security manager is designing a security program to align with business goals. Which three of the following are essential components of a security program that directly support governance and oversight? (Choose three.)

Accepted Answer

Establishing a security steering committee with executive sponsorship. A security steering committee with executive sponsorship ensures that security initiatives have top-down support and alignment with business objectives, which is a core governance function. Developing and maintaining security policies, standards, and procedures provides the formal framework for enforcing security controls and ensuring compliance, directly supporting oversight. Conducting periodic risk assessments informs decision-making by identifying and prioritizing risks, which is essential for governance and resource allocation.

Answer

Deploying a next-generation firewall to segment the network

Answer

Implementing a vulnerability scanning tool across all endpoints

Answer

Installing endpoint detection and response agents on all workstations

Question 12

Match each security principle to the best description.

Accepted Answer

Confidentiality: Restricts access to authorized users.. These pairings match the CIA triad plus additional principles: confidentiality restricts access, integrity prevents unauthorized changes, availability ensures uptime, non-repudiation provides proof of actions, authentication verifies identity, and authorization defines permissions.

Answer

Non-repudiation: Ensures data is unchanged.

Answer

Authentication: Grants permissions.

Answer

Authorization: Verifies identity.

Question 13

Match each cloud security concept to the best description.

Accepted Answer

Encryption: Protects data by converting it into a secure format.. Each cloud security concept is matched to its primary function: encryption protects data at rest or in transit, IAM manages access, SIEM provides event analysis, IDS detects intrusions, and DLP prevents data loss.

Answer

Encryption: Manages user access to resources.

Answer

IAM: Protects data by encoding it.

Question 14

Match each security control type to the best example in a small office environment.

Accepted Answer

Administrative: Security awareness training policy. These matches classify security controls by type: administrative involves policies, technical uses technology, physical secures premises, deterrent discourages violations, preventive stops incidents, and detective identifies occurrences.

Answer

Administrative: Firewall

Answer

Physical: Security awareness training policy

Question 15

A hospital is redesigning its wireless network. Guest devices must reach only the internet. Staff laptops need access to internal applications. Medical devices must communicate with a monitoring server but never with guest devices or the broader employee LAN. What design best meets these goals with the least operational complexity?

Accepted Answer

Create separate VLANs for guest, staff, and medical devices, then enforce traffic rules between them with firewall policies.. VLANs logically segment the network into isolated broadcast domains for guest, staff, and medical devices, while firewall policies (e.g., using ACLs or stateful inspection) enforce granular traffic rules. This design ensures medical devices can only communicate with the monitoring server, guests are restricted to internet-only access, and staff can reach internal applications, all without requiring complex physical reconfiguration.

Answer

Place all devices on one flat network and rely on endpoint antivirus for protection.

Answer

Use a single wireless SSID with client isolation enabled and NAT all traffic through one gateway.

Answer

Deploy network access control only at login time and allow all devices onto the same internal subnet afterward.