SY0-701 Practice Test 25 — 15 Questions

Question 1

Match each procurement or oversight need to the best vendor due diligence artifact or clause. Use each item once.

Accepted Answer

Assess security controls: Security questionnaire. These artifacts support vendor due diligence: questionnaires assess controls, SOC 2 reports provide independent assurance, audit clauses enable customer verification, DPAs govern data handling, BCPs ensure resilience, and pen tests validate security.

Answer

Assess security controls: SOC 2 report

Answer

Data protection: Business continuity plan

Question 2

A help desk team manages 300 Windows laptops. A legacy accounting app sometimes fails after updates, so the company wants to reduce patch risk while still preventing long-term exposure. Which patching strategy is the best balance?

Accepted Answer

Use a pilot group and phased rollout process before wider deployment.. A phased rollout with a pilot group is the most balanced approach. It allows the team to test new patches on a few systems that reflect the production environment before exposing the entire fleet to possible compatibility issues. That lowers operational risk while still ensuring the organization patches regularly, which is essential for reducing exposure to known vulnerabilities and maintaining a secure baseline.

Why others are wrong: Option A is too labor-intensive and still lacks controlled validation. Option C accepts avoidable risk by deferring all updates indefinitely. Option D is reactive and leaves the fleet exposed until an incident occurs. The correct answer is the only one that preserves security and operational stability at the same time.

Answer

Apply updates manually to each laptop as soon as they are released.

Answer

Postpone all updates until the legacy accounting app is replaced.

Answer

Disable automatic updates permanently and patch only after a security incident.

Question 3

Match each requirement or instruction to the correct governance document type. Use each document type once.

Accepted Answer

Policy: High-level statement of management intent. These matches align with common governance document types in IT security frameworks: policy provides high-level direction, standard sets mandatory rules, procedure gives step-by-step instructions, guideline offers non-mandatory recommendations, baseline defines minimum configurations, and framework provides a structured approach.

Answer

Procedure: Recommended best practices, not mandatory

Answer

Guideline: Step-by-step instructions for performing a task

Question 4

Match each security monitoring artifact from the SOC alert queue to the best investigation focus.

Accepted Answer

Phishing: Investigate email headers and links. Each alert type suggests a specific investigation focus: phishing requires email analysis; malware needs file/behavior analysis; brute force focuses on auth logs; data exfiltration looks at outbound traffic; privileged misuse examines user activity; ransomware involves encryption events.

Answer

Brute force: Audit user activity logs for unusual administrative actions

Answer

Data exfiltration: Check for file encryption events and ransom notes

Answer

Privileged misuse: Monitor outbound traffic volume to unusual destinations

Answer

Ransomware: Review authentication logs for repeated failures

Question 5

Match each awareness-program metric to the interpretation the security team should use.
1. 8% of users clicked the simulated phishing link.
2. 34% of users reported the simulation using the report-phish button.
3. The median time from message delivery to first user report was 12 minutes.
4. 96% of staff completed the annual awareness module.

Accepted Answer

8% of users clicked: Indicates user susceptibility to phishing.. Each metric guides interpretation: click rate indicates susceptibility, report rate shows security culture, reaction time measures responsiveness, and completion rate reflects training adoption.

Answer

8% of users clicked: Demonstrates strong security culture.

Answer

34% of users reported: Measures susceptibility to phishing.

Question 6

Which four of the following are key components of a successful security awareness and training program within an organization? (Choose four.)

Accepted Answer

Executive-level sponsorship and support for the program. Role-based training is correct because it ensures that employees receive security education relevant to their specific job functions, such as data handling for finance or system access for IT, which increases the practical applicability and retention of security principles. Phishing simulations are correct as they provide hands-on reinforcement of skills, allowing employees to practice identifying and reporting malicious emails in a controlled environment, which directly reduces real-world risk. Metrics like click rates on simulated phishing emails are correct because they provide quantifiable data to measure program effectiveness, identify high-risk groups, and guide continuous improvement. Executive-level sponsorship is correct because it provides the necessary authority, resources, and organizational commitment to prioritize security awareness, ensuring the program is taken seriously across all departments.

Answer

Outsourcing all training content development to a single vendor without internal review

Answer

Annual one-time training with no follow-up assessments

Question 7

Match each access principle to the best description.

Accepted Answer

Least privilege: Users get minimal permissions needed. Least privilege grants minimal permissions, separation of duties splits critical tasks, defense in depth uses multiple security layers, need-to-know restricts data access, RBAC assigns permissions by role, and accountability ensures traceability.

Answer

Least privilege: Splitting critical tasks among multiple people

Answer

Separation of duties: Users get minimal permissions

Question 8

Match each excerpt from a small enterprise security program to the correct governance artifact.

Accepted Answer

Policy: All employees must use multi-factor authentication. Policy defines mandatory rules; Procedure gives step-by-step instructions; Standard specifies technical requirements; Guideline offers best practices.

Answer

Procedure: All employees must use multi-factor authentication

Answer

Policy: It is recommended to use complex passwords

Question 9

A legacy production scanner cannot support MFA, but it must remain available for six months until replacement hardware arrives. What is the best security response?

Accepted Answer

Approve a time-bound exception with compensating controls and a review date.. It balances security with operational necessity by implementing a time-bound exception with compensating controls (e.g., network segmentation, strict access logging, or IP whitelisting) and a mandatory review date. This ensures the legacy scanner remains available for six months while mitigating the risk of unauthorized access, aligning with the principle of least privilege and security program oversight.

Answer

Permanently waive MFA for the scanner and leave the exception open-ended.

Answer

Shut down the scanner immediately until MFA can be enabled.

Answer

Create a shared administrator account so operators can sign in more easily.

Question 10

Which three of the following are examples of defense-in-depth security controls? (Choose three.)

Accepted Answer

A firewall at the network perimeter. Defense-in-depth is a layered security strategy that uses multiple, independent controls to protect assets. A firewall at the network perimeter provides network-level filtering (e.g., stateful inspection, ACLs) as the first line of defense. Mandatory access controls (MAC) on sensitive files enforce system-enforced restrictions based on labels (e.g., Bell-LaPadula model), adding a host-level layer. Regular security awareness training addresses the human factor, reducing social engineering and phishing risks, which is a critical administrative control.

Answer

Disabling all logging to save storage space

Answer

Using only one antivirus solution for all endpoints

Answer

A single password policy for all users

Question 11

Match each data example to the most appropriate classification label.
1. A public marketing flyer approved for external posting.
2. An internal org chart and office directory meant only for employees.
3. A customer case file with contact details and order history.
4. A vault export containing API keys and encryption secrets.

Accepted Answer

A public marketing flyer approved for external posting: Public. These matches follow a typical data classification scheme: Public for non-sensitive info, Internal for company-only data, Confidential for customer PII, and Restricted for highly sensitive secrets.

Answer

A vault export containing API keys and encryption secrets: Confidential

Answer

A public marketing flyer approved for external posting: Internal

Question 12

Which four of the following are effective mitigations against SQL injection attacks? (Choose four.)

Accepted Answer

Implementing input validation and sanitization. Parameterized queries and prepared statements are effective because they separate SQL logic from user input, ensuring that input is treated as data rather than executable code. This prevents attackers from injecting malicious SQL commands into query strings, as the database engine compiles the query structure before parameters are bound.

Answer

Using client-side JavaScript validation exclusively

Answer

Blocking all user input containing the word 'SELECT'

Question 13

Which four of the following are common indicators of a phishing attack? (Choose four.)

Accepted Answer

Urgent or threatening language demanding immediate action. These four options are correct because they represent classic hallmarks of phishing attacks. Urgent or threatening language is a social engineering tactic to bypass rational thought. Spoofed sender addresses exploit trust in familiar domains. Unsolicited attachments or links are the primary delivery mechanism for phishing payloads. Grammatical errors and poor formatting often indicate a lack of professional quality control typical of legitimate organizations.

Answer

Presence of a digital signature from a trusted certificate authority

Answer

A request for sensitive information via a secure web portal

Question 14

Match each cryptographic action to the most appropriate use case.

Accepted Answer

Encryption: Ensuring confidentiality. Encryption ensures confidentiality, hashing ensures integrity, digital signatures provide authentication and non-repudiation, key exchange enables secure key distribution, certificate signing establishes trust, and random numbers are essential for key generation.

Answer

Key Exchange: Ensuring integrity

Answer

Random Number Generation: Providing authentication

Question 15

Match each principle to the scenario that best illustrates it.

Accepted Answer

Least privilege: A user is given only the permissions needed to perform their job.. Least privilege limits access rights; separation of duties divides critical tasks; defense in depth uses multiple security layers; need to know restricts data access; accountability tracks actions; fail safe ensures security on failure.

Answer

Least privilege: Two people are required to approve a financial transaction.

Answer

Separation of duties: A user is given only the permissions needed to perform their job.

Answer

Defense in depth: An employee accesses customer data only when required for their role.