SY0-701 Practice Test 25 — 15 Questions

Question 1

An EDR console alerts that powershell.exe launched with an encoded command on a finance workstation, and a minute later the host begins making repeated outbound connections to an unfamiliar IP address. What is the best initial response?

Accepted Answer

Isolate the workstation through the EDR platform and preserve logs and volatile evidence for investigation.. Option B is correct because isolating the workstation via the EDR platform stops the immediate threat (the malicious outbound connections) while preserving volatile evidence (e.g., running processes, network connections, memory contents) and logs for forensic analysis. This aligns with the incident response principle of containment before eradication, and EDR isolation typically uses a host-based firewall rule to block all traffic except to the EDR management server, ensuring the host remains accessible for investigation.

Answer

Run a full antivirus scan first and leave the workstation online so the user can keep working.

Answer

Power off the workstation immediately to ensure the malicious process stops.

Answer

Create a permanent firewall rule that allows the unfamiliar IP address so you can observe more traffic.

Question 2

After installing a free utility from an unofficial website, a user's laptop starts quietly sending browsing data to an unknown server. What type of malware is most likely present?

Accepted Answer

Spyware. Spyware is designed to covertly collect user data, such as browsing habits, and transmit it to a remote server without consent. The scenario describes a free utility from an unofficial website that quietly exfiltrates browsing data, which is the classic behavior of spyware. Unlike other malware types, spyware focuses on surveillance and data theft rather than system damage or self-replication.

Answer

Ransomware

Answer

Worm

Answer

Rootkit

Question 3

An HR portal has three groups: HR staff can edit employee records, managers can approve leave, and payroll can view salary data. No one should have all functions. Which access model should the engineer implement?

Accepted Answer

Role-based access control with separate groups mapped to each business function.. Option A is correct because Role-Based Access Control (RBAC) allows the engineer to define three distinct roles (HR staff, managers, payroll) with granular permissions mapped to specific business functions, ensuring no single user inherits all privileges. This model enforces the principle of least privilege by separating duties across groups, preventing any user from having full access to the portal's sensitive operations.

Answer

A single shared admin account so all tasks can be completed quickly.

Answer

Mandatory access control with all users assigned the same clearance level.

Answer

Local account creation on the portal for each user, with permissions assigned manually one by one.

Question 4

An employee receives an email that appears to come from the company's payroll provider. It says payroll documents will be deleted today unless the employee signs in through the included link. What is the best first action?

Accepted Answer

Report the message and verify the request using a trusted contact method.. Option B is correct because the email exhibits classic signs of a phishing attack—urgency, a threat of data loss, and a link to a fake login page. The best first action is to report the suspicious message to the security team and independently verify the request by contacting the payroll provider through a trusted channel (e.g., a known phone number or a previously bookmarked URL). This prevents credential theft and potential account compromise.

Answer

Click the link quickly and sign in to avoid losing the documents.

Answer

Reply to the sender and ask whether the message is legitimate.

Answer

Forward the email to coworkers so they can watch for the same warning.

Question 5

An enterprise is moving from on-prem identity to a SaaS HR platform. Employees should sign in with corporate credentials, and terminated users must lose access quickly without manually creating or deleting SaaS passwords. Which solution best fits?

Accepted Answer

Implement federated SSO with the corporate identity provider and automated provisioning and deprovisioning.. Federated SSO with the corporate identity provider (IdP) allows employees to sign in using their existing corporate credentials via standards like SAML 2.0 or OIDC, eliminating the need for separate SaaS passwords. Automated provisioning and deprovisioning (e.g., via SCIM) ensures that when a user is terminated in the HR platform, their access to the SaaS application is revoked immediately without manual intervention, meeting the requirement for rapid access removal.

Answer

Create a shared HR password for all employees and change it quarterly.

Answer

Use LDAP bind accounts directly against the SaaS platform for every login.

Answer

Require each user to create a separate local SaaS account and store the credentials in a vault.

Question 6

An EDR alert shows winword.exe launching powershell.exe with an encoded command after a user opened an invoice attachment. No new executable file was written to disk, and the host is still online. Which two actions should the SOC analyst take first to validate the alert and collect usable evidence? Select two.

Accepted Answer

Review the parent-child process chain and the full PowerShell command line in EDR.. Option A is correct because reviewing the parent-child process chain (winword.exe → powershell.exe) and the full PowerShell command line in the EDR allows the analyst to immediately validate whether the alert is a true positive by confirming the process lineage and decoding the encoded command. This step is critical for understanding the attacker's intent without relying on disk artifacts, as the attack is fileless and memory-resident.

Answer

Compare the endpoint's outbound connections with its normal baseline and approved destinations.

Answer

Reimage the workstation immediately to eliminate any possible persistence.

Answer

Ask the user to delete the suspicious email and clear the recycle bin.

Question 7

An endpoint investigation shows winword.exe launching powershell.exe with -nop -w hidden -enc arguments. The same host also has a newly created WMI permanent event subscription, and no new executable has appeared in Downloads or Program Files. Which two findings are most consistent with a fileless compromise and persistence mechanism? Select two.

Accepted Answer

PowerShell was launched with encoded, hidden execution arguments from a document process.. Option A is correct because the use of winword.exe to launch powershell.exe with `-nop -w hidden -enc` arguments is a classic fileless execution technique. The encoded command runs entirely in memory without writing a payload to disk, and the launch from a document process (winword.exe) indicates a macro or exploit-based initial access, consistent with a fileless compromise.

Answer

A new executable named updater.exe was copied into Program Files by an administrator.

Answer

The browser cache was cleared after a routine user sign-out.

Answer

A signed video driver updated successfully through Windows Update.

Question 8

An employee notices that a contractor left a printed report containing customer data on a conference room table. What should the employee do first?

Accepted Answer

Secure the report and report the incident through the company's approved process.. Option B is correct because the immediate priority is to protect the sensitive customer data from further unauthorized access by securing the report, and then to follow the organization's incident response policy. This aligns with the principle of data breach containment and the requirement to report security incidents through official channels to ensure proper investigation and compliance with regulations like GDPR or HIPAA.

Answer

Take a photo of the report and post it in the team chat as a warning.

Answer

Leave the report where it is so the contractor can collect it later.

Answer

Shred the report immediately without telling anyone.

Question 9

A weekly vulnerability scan returns five findings across different systems. Which three should be remediated first? Select three.

Accepted Answer

A critical remote-code-execution flaw on an internet-facing VPN appliance with active exploitation reported.. Option A is correct because a critical remote-code-execution (RCE) vulnerability on an internet-facing VPN appliance with active exploitation reported represents the highest risk: it is exposed to the internet, allows full system compromise, and is actively being exploited in the wild, making immediate remediation essential to prevent a breach.

Answer

A medium-severity missing patch on an offline lab VM with no network connectivity.

Answer

A low-severity TLS configuration warning on a public site that does not handle sensitive information.

Question 10

An EDR console shows `mshta.exe` launching `powershell.exe` from a user profile directory, followed by a script that never writes a new executable to disk. Minutes later, the host begins making regular outbound HTTPS connections to an unfamiliar IP address. What type of malware behavior is most likely being observed?

Accepted Answer

Fileless attack. The EDR console shows mshta.exe (a Microsoft binary for executing HTML Applications) launching PowerShell from a user profile directory, followed by a script that never writes a new executable to disk. This is classic fileless malware behavior, where the malicious payload runs entirely in memory (e.g., via PowerShell or .NET reflection) without dropping a file, making it harder for traditional signature-based antivirus to detect. The subsequent outbound HTTPS connections to an unfamiliar IP indicate command-and-control (C2) communication, consistent with a fileless attack that persists only in memory.

Answer

Ransomware

Answer

Worm

Answer

Rootkit

Question 11

An investigator receives a suspect laptop that may be needed in court. The goal is to create a forensic image without changing the original drive contents. Which three actions best support chain of custody and evidence integrity? Select three.

Accepted Answer

Use a hardware write blocker during acquisition so the original disk cannot be modified.. A hardware write blocker is essential because it physically prevents any write commands from reaching the suspect drive at the SATA/IDE or USB level, ensuring the original disk's contents remain unaltered during acquisition. This is a foundational requirement for maintaining evidence integrity in forensic imaging, as any modification could render the evidence inadmissible in court.

Answer

Browse the original disk using the operating system file explorer to confirm the case folder is present.

Answer

Store the suspect drive and the forensic copy in the same unlocked folder to simplify access.

Question 12

An office loses power several times each month, causing servers to shut down without warning. Which control best helps keep the systems running long enough for a safe shutdown?

Accepted Answer

A UPS sized to support the equipment for a short period.. A UPS (Uninterruptible Power Supply) provides battery backup power to connected equipment, allowing servers to continue running for a short duration after a power loss. This gives administrators enough time to perform a safe, orderly shutdown, preventing data corruption and hardware damage from abrupt power loss.

Answer

A better wallpaper design in the server room.

Answer

A stronger password for the power strip.

Answer

More user awareness training about turning monitors off.

Question 13

At 10:15, a file server begins renaming documents and creating payment notes. The SOC confirms the server is also making SMB connections to other internal hosts, but users can still access shared folders. What should the incident handler do FIRST?

Accepted Answer

Disconnect the server from the network or isolate it through EDR containment while preserving power. The correct first step is to contain the incident by disconnecting the server from the network or using EDR containment while preserving power. This stops the spread of malicious SMB connections and prevents further damage, while keeping the system powered on to preserve volatile evidence (e.g., memory, running processes) for forensic analysis. Immediate containment aligns with the NIST incident response framework's containment phase, prioritizing isolation over eradication or recovery.

Answer

Shut down the server immediately to stop all malicious activity

Answer

Restore the server from backup before taking any other action

Answer

Wait for users to report more symptoms before responding

Question 14

An investigator has just created a bit-for-bit image of a suspect's SSD using a write blocker. Before the drive is returned to evidence storage, what action most directly validates the integrity of both the original media and the image?

Accepted Answer

Calculate cryptographic hashes of the source and the image and record them.. Option B is correct because cryptographic hashing (e.g., SHA-256 or MD5) generates a unique digital fingerprint of the original SSD and the forensic image. By comparing the hash values, the investigator can verify that the bit-for-bit copy is identical to the source, ensuring data integrity and admissibility in legal proceedings. This step directly validates that no data has been altered or omitted during acquisition.

Answer

Defragment the original SSD to make later analysis faster.

Answer

Compress the image file to reduce storage usage before documentation.

Answer

Wipe free space on the original SSD to remove deleted remnants.

Question 15

An online retailer is redesigning a network for a public web app. Customers must reach only the web tier from the internet. The web tier must reach the application tier, and the application tier must reach the database tier. Which two design changes best support this zoning model? Select two.

Accepted Answer

Put the internet-facing web tier in a DMZ with tightly filtered inbound rules.. Option B is correct because placing the internet-facing web tier in a DMZ (demilitarized zone) with tightly filtered inbound rules ensures that external users can only reach the web servers, while the DMZ network isolates them from internal tiers. This aligns with the principle of defense in depth, where the DMZ acts as a buffer zone, and inbound rules (e.g., allowing only TCP/443 for HTTPS) minimize the attack surface. The web tier can then initiate outbound connections to the application tier through a firewall with specific allow-lists, maintaining strict segmentation.

Answer

Place all three server tiers on the same flat VLAN and rely on host firewalls.

Answer

Give the database server a public IP address so the web tier can connect faster.

Answer

Use a single NAT device for all servers and disable interserver filtering.