SY0-701 Practice Test 4 — 25 Questions

Question 1

A project team identifies a new risk with a high likelihood of minor data exposure during a pilot rollout. The impact is low, but the issue would become harder to address after production launch. The business owner wants the project to proceed. What should the risk owner do NEXT?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Document the risk, assign an owner, and escalate for acceptance or treatment before launch.. The risk owner must follow the formal risk management process: document the risk, assign an owner, and escalate it to the business owner for a decision on acceptance or treatment before the pilot launch. Even though the impact is low, the high likelihood and the fact that the issue becomes harder to address post-production mean the risk cannot be ignored or deferred; it requires a documented acceptance or a mitigation plan before proceeding.

Answer

Ignore the issue because the impact is low.

Answer

Wait until after production launch to see whether the issue actually occurs.

Answer

Transfer the risk by moving the pilot to a different business unit.

Question 2

A security analyst receives an alert from the intrusion detection system (IDS) indicating a high volume of outbound traffic from a single internal workstation to an external IP address known to be associated with a command-and-control (C2) server. The workstation's user reports no unusual activity. Which of the following should the analyst do FIRST?

Accepted Answer

Disconnect the workstation from the network.. The IDS alert indicates a high volume of outbound traffic to a known C2 server, which strongly suggests the workstation is compromised and communicating with an attacker. Disconnecting the workstation from the network (Option A) is the immediate containment step to prevent data exfiltration and further C2 communication, following the NIST incident response framework's containment phase. This action stops the threat at the network layer without waiting for additional analysis.

Answer

Run a full antivirus scan on the workstation.

Answer

Review firewall logs to see if the traffic is being blocked.

Answer

Inform the user to shut down the workstation.

Question 3

A project team must share a spreadsheet containing customer names, account numbers, and purchase history with an external auditor. The auditor only needs account numbers and totals. What is the best privacy control?

Accepted Answer

Redact unneeded personal data and transfer only the minimum necessary information through an approved encrypted channel. It applies the principle of data minimization and secure transmission. Redacting unneeded personal data (customer names) ensures only the minimum necessary information (account numbers and totals) is shared, reducing exposure. Transferring via an approved encrypted channel (e.g., SFTP, HTTPS, or encrypted email) protects data in transit from interception, which is required for compliance with regulations like GDPR or PCI DSS.

Answer

Send the full spreadsheet through regular email to avoid delaying the audit

Answer

Upload the spreadsheet to a public file-sharing site and protect it with a password

Answer

Compress the file with a password and reuse the same password for all auditors

Question 4

A security manager wants every corporate laptop to use the same mandatory settings, including disk encryption, a 10-minute screen lock, and removal of local administrator rights. Which document should define these specific requirements?

Accepted Answer

Standard. A standard defines mandatory, specific technical requirements that must be uniformly applied across all systems, such as enforcing AES-256 disk encryption, a 600-second screen lock timeout, and removal of local administrator rights. Unlike a policy, which is high-level and goal-oriented, a standard provides the precise configuration settings that implement the policy's intent. This aligns with the CompTIA SY0-701 domain of Security Program Management and Oversight, where standards bridge the gap between policy and technical implementation.

Answer

Policy

Answer

Guideline

Answer

Procedure

Question 5

An NDR tool shows a production web server sending small, periodic DNS queries to random-looking subdomains under a domain the company does not use. The pattern repeats every 60 seconds, even when normal web traffic is idle. What is the best interpretation and next step?

Accepted Answer

Suspect DNS-based command-and-control, then isolate the server and collect logs and packet data for analysis.. The small, periodic DNS queries to random-looking subdomains under an unused domain are a classic indicator of DNS-based command-and-control (C2) communication. Attackers often use DNS tunneling to exfiltrate data or send commands, as DNS traffic is typically allowed through firewalls. The fact that the pattern persists even during idle web traffic confirms it is not related to normal server operations, making isolation and forensic collection the appropriate next step.

Answer

This is normal DNS behavior, so no action is needed unless users report an outage.

Answer

Rotate the DNS server’s administrator password and leave the web server online.

Answer

Assume the web server is performing routine certificate renewal checks and ignore the alert.

Question 6

A security analyst is reviewing web server logs from an e-commerce application. The logs show repeated requests containing URLs with appended strings such as: `' OR '1'='1' --` and `'; DROP TABLE Users; --`. The application returned HTTP 200 responses with unexpected data in several instances. Which type of attack is most likely being attempted?

Accepted Answer

SQL injection. The repeated requests contain classic SQL injection payloads, such as `' OR '1'='1' --` (used to bypass authentication or extract data) and `'; DROP TABLE Users; --` (used to delete database tables). The HTTP 200 responses with unexpected data confirm that the application is vulnerable to SQL injection, as the injected SQL code is being executed against the backend database. This attack targets the SQL database layer, not LDAP directories or operating system commands.

Answer

LDAP injection

Answer

Command injection

Answer

Cross-site scripting (XSS)

Question 7

A defense contractor is deploying a new document management system that will store classified military intelligence. The security policy requires that user access to each document is strictly determined by the document's classification label (e.g., Confidential, Secret, Top Secret) and the user's verified security clearance level. Furthermore, system administrators must not be able to change these access rules or grant themselves access to documents above their clearance. Which access control model is best suited for this requirement?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) is the correct choice because it enforces access decisions based on security labels (e.g., classification levels) and user clearances, which are centrally managed and cannot be overridden by users or administrators. In this scenario, the system must strictly enforce that a user's clearance level matches or exceeds the document's classification label, and administrators cannot modify these rules or elevate their own access—a core property of MAC systems like SELinux or those implementing Bell-LaPadula.

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)

Question 8

A public-facing file transfer server is running an appliance firmware version that is now end-of-life. The vendor has stated that no further security patches will be released. Management wants the best long-term fix before the next audit. What should be done?

Accepted Answer

Replace or upgrade the end-of-life firmware with a supported version.. Running end-of-life firmware means no security patches will be released, leaving the server vulnerable to known exploits. The best long-term fix is to replace or upgrade to a supported firmware version that receives ongoing security updates, ensuring the system remains secure for the next audit and beyond.

Answer

Increase logging and keep the current firmware until a problem appears.

Answer

Move the server to a different subnet and continue using the same firmware.

Answer

Change the administrator password and leave the device in place.

Question 9

A security analyst is reviewing the source code of a custom network service written in C. The service allocates a 256-byte buffer and uses the strcpy() function to copy incoming data into that buffer without verifying the length of the input. If an attacker sends a specially crafted payload that exceeds 256 bytes, which security control would be most effective at detecting and preventing the resulting exploitation at runtime?

Accepted Answer

Stack canaries. Stack canaries are the most effective runtime control for detecting and preventing buffer overflow exploitation. When a buffer overflow overwrites the stack, it corrupts a canary value placed between the buffer and the return address; before the function returns, the canary is checked, and if altered, the program terminates immediately, preventing arbitrary code execution.

Answer

Transport Layer Security (TLS)

Answer

Code signing

Answer

Data Execution Prevention (DEP)

Question 10

After an internal PKI was rebuilt, users now see certificate warnings when connecting to the company intranet portal. The portal certificate chains to a new CA, but endpoint trust stores do not recognize it yet. What should the administrator deploy?

Accepted Answer

The root CA certificate for the new PKI to trusted endpoint stores.. The root CA certificate must be distributed to all endpoint trust stores to establish trust in the new PKI. Without the root CA in the trusted root certification authorities store, the certificate chain is incomplete, causing browsers to display certificate warnings. Deploying the root CA certificate via Group Policy or MDM resolves this by allowing endpoints to validate the portal's certificate chain.

Answer

The portal's private key so users can validate the certificate locally.

Answer

A new certificate signing request on each endpoint.

Answer

A self-signed certificate on the portal to avoid future CA problems.

Question 11

A SOC analyst sees 38 failed logins for a finance user account from one public IP address over 4 minutes, followed by one successful login. What should the analyst do first?

Accepted Answer

Correlate the authentication logs with user activity and VPN records to verify whether the login pattern is expected.. The analyst must first verify whether the failed logins followed by a successful login represent a brute-force attack or legitimate behavior, such as a user mistyping their password and then succeeding. Correlating authentication logs with user activity and VPN records helps confirm if the public IP belongs to a known remote user or VPN endpoint, which is a standard first step in incident response to avoid false positives.

Answer

Immediately delete the account to stop any further access attempts.

Answer

Assume the account is compromised and notify all users to change their passwords.

Answer

Close the alert because one successful login means the activity was normal.

Question 12

A manager asks the security team to let Human Resources inspect the files on a laptop suspected of containing stolen customer data before IT touches it. What is the best response?

Accepted Answer

Create a forensic image of the device, document the handoff, and maintain chain of custody before any analysis.. The first priority in any investigation involving potential evidence is to preserve the data in its original state. Creating a forensic image (bit-for-bit copy) ensures that the original media is not altered, and documenting the handoff with a chain of custody form provides a verifiable audit trail. This process adheres to forensic best practices and legal requirements, preventing spoliation of evidence before any analysis begins.

Answer

Let HR browse the files first so they can confirm whether the data is sensitive.

Answer

Copy the files to a shared drive so multiple departments can review them quickly.

Answer

Factory reset the laptop immediately to prevent further leakage of customer data.

Question 13

A company uses an encryption key for a database backup process. The key is being replaced because the old one is near the end of its approved use period. What is this action called?

Accepted Answer

Key rotation, because an older key is replaced with a new one on schedule.. Key rotation is the scheduled replacement of an older encryption key with a new one, typically performed before the end of the key's cryptoperiod to maintain security and compliance. In this scenario, the database backup key is being replaced because it is near the end of its approved use period, which directly matches the definition of key rotation. This practice limits the amount of data encrypted with a single key and reduces the impact of a potential key compromise.

Answer

Key compression, because the key is made smaller before use.

Answer

Key translation, because the key is converted into another language.

Answer

Key formatting, because the key is stored in a different file type.

Question 14

Based on the exhibit, what is the best response to the facilities manager's request?

Accepted Answer

Deny the request and direct the manager to use an approved work-contact list or seek privacy review.. The facilities manager's request to export employee contact information for a separate system likely violates data privacy policies and potentially regulations like GDPR or CCPA. Option B is correct because the proper procedure is to deny the ad-hoc export and direct the manager to use an approved work-contact list or seek a privacy review, ensuring data handling complies with organizational data governance and privacy requirements.

Answer

Provide the export because the requester is a manager with a legitimate business relationship to employees.

Answer

Send the data to the manager if the manager promises not to share it externally.

Answer

Store the export in a shared drive so multiple teams can use it for convenience.

Question 15

A payroll SaaS provider has passed initial review, but before contract signing it announces that customer data will be processed by a new subcontractor in another country. The business wants to keep the onboarding timeline short, but security still needs assurance that the change does not increase exposure. What is the BEST next step?

Accepted Answer

Update the third-party risk assessment and require evidence of the subcontractor's controls before approval.. The introduction of a new subcontractor in a different country represents a material change to the data processing environment, which invalidates the initial risk assessment. Security must update the third-party risk assessment to evaluate the subcontractor's controls, such as data protection, encryption standards, and compliance with local regulations, before approval. This ensures that the change does not increase exposure, even if the primary provider passed initial review.

Answer

Approve the vendor because the primary provider already passed the initial review.

Answer

Wait until the first quarterly audit to review the subcontractor change.

Answer

Accept the change if the vendor provides a marketing brochure describing its security program.

Question 16

A software supplier used by your organization begins subcontracting a critical part of its service to an unknown hosting company. Which contractual control would BEST help manage this supply chain risk?

Accepted Answer

Require advance notice and approval for subcontractor changes, plus right-to-audit and security obligations.. It establishes a contractual control that requires the supplier to notify and obtain approval before subcontracting critical services, while also imposing right-to-audit and security obligations. This directly addresses supply chain risk by ensuring the organization can vet and monitor the subcontractor's security posture, as recommended by NIST SP 800-161 for supply chain risk management.

Answer

Require the supplier to send monthly sales updates to the procurement team.

Answer

Ask the supplier to place all responsibility for the subcontractor on the customer.

Answer

Disable all vendor access immediately without reviewing the change.

Question 17

A workstation is suspected of malware infection, and it is still powered on and connected to the network. Which action best preserves volatile evidence before the system is shut down?

Accepted Answer

Capture memory and note running processes before taking further action.. Volatile evidence, such as the contents of RAM (running processes, network connections, open files), is lost when the system is powered off. Capturing a memory dump and recording running processes preserves this critical data for forensic analysis, allowing investigators to identify malware artifacts (e.g., injected code, hidden processes) that exist only in memory. This aligns with the NIST SP 800-86 forensic procedure of prioritizing volatile data collection before system shutdown.

Answer

Immediately power off the workstation to stop any malicious activity.

Answer

Run a full antivirus scan before documenting anything.

Answer

Delete temporary files to reduce the chance of reinfection.

Question 18

A router interface connects the DMZ subnet 10.10.10.0/24 to the internal network. A web server at 10.10.10.25 must reach an application server at 10.10.20.20 on TCP 8443, and all other DMZ-to-internal traffic must be blocked. Which two ACL entries should be applied inbound on the DMZ-facing interface? Select two.

Accepted Answer

permit tcp 10.10.10.25 host 10.10.20.20 eq 8443. It permits TCP traffic from the specific web server (10.10.10.25) to the application server (10.10.20.20) on destination port 8443, which is the only allowed DMZ-to-internal communication. This entry uses the 'host' keyword to specify the exact source IP and the 'eq' keyword to match the required destination port, implementing the principle of least privilege.

Answer

permit tcp host 10.10.20.20 any eq 8443

Answer

permit ip any any

Answer

permit udp 10.10.10.0/24 host 10.10.20.20 eq 8443

Question 19

Based on the exhibit, which control should be enabled to mitigate this issue?

Accepted Answer

Dynamic ARP inspection with DHCP snooping, because it validates ARP replies against trusted bindings.. Dynamic ARP inspection (DAI) with DHCP snooping validates ARP packets against a trusted binding database, preventing man-in-the-middle attacks where an attacker spoofs the MAC address of a legitimate host (e.g., the default gateway) to intercept traffic. The exhibit likely shows a scenario of ARP spoofing or cache poisoning, which DAI directly mitigates by dropping invalid ARP replies. DHCP snooping builds the trusted binding table by recording which IP address is assigned to which MAC address on which port.

Answer

DNSSEC, because it validates DNS records and would stop local address-to-MAC spoofing.

Answer

Port forwarding, because it can direct traffic to the correct internal host more reliably.

Answer

Load balancing, because it would distribute traffic and reduce the impact of connectivity issues.

Question 20

Your company is syncing design files to a cloud object store. The security team wants to reduce risk if the storage account is stolen and also protect the files while they travel across the internet. Which approach is the best fit?

Accepted Answer

Encrypt data in transit with TLS and enable encryption at rest with managed keys.. It addresses both risks: TLS (Transport Layer Security) encrypts data in transit, preventing interception or tampering during upload, while managed keys for encryption at rest protect the files if the storage account credentials are compromised. This dual-layer approach aligns with defense-in-depth and is a standard best practice for cloud object stores like Amazon S3 or Azure Blob Storage.

Answer

Password-protect each archive and upload it over plain HTTP.

Answer

Rename the files before upload so attackers cannot identify them.

Answer

Place the storage service on a private IP address and skip encryption.