SY0-701 Practice Test 5 — 25 Questions

Question 1

A file server suddenly shows renamed files with a new extension, users see a ransom note demanding cryptocurrency, and shadow copies are deleted from the host. Which malware family is the best match?

Accepted Answer

Ransomware, because the attacker is encrypting data and demanding payment to restore access.. Ransomware is the correct classification because the scenario describes file encryption (renamed files with new extensions), a ransom note demanding cryptocurrency, and the deletion of shadow copies (Volume Shadow Copy Service snapshots) to prevent file recovery. These are hallmark behaviors of ransomware, specifically crypto-ransomware, which encrypts data and demands payment for decryption keys.

Answer

Trojan, because the attack requires a disguised program to install itself.

Answer

Spyware, because the attacker is likely trying to monitor file activity.

Answer

Logic bomb, because the malware likely triggered after a specific condition was met.

Question 2

A security operations center (SOC) analyst is overwhelmed by the volume of alerts. The management wants to implement a solution that can automatically respond to common threats, such as blocking an IP address or isolating a compromised endpoint, without requiring human intervention. Which of the following technologies best meets this requirement?

Accepted Answer

Security Orchestration, Automation, and Response (SOAR). SOAR is the correct choice because it is specifically designed to automate response actions to common security incidents, such as blocking an IP address via firewall APIs or isolating an endpoint through EDR integration, without requiring human intervention. This directly addresses the SOC analyst's alert fatigue by enabling playbook-driven, automated remediation.

Answer

Security Information and Event Management (SIEM)

Answer

Endpoint Detection and Response (EDR)

Answer

Cloud Access Security Broker (CASB)

Question 3

An office loses power several times each month, causing servers to shut down without warning. Which control best helps keep the systems running long enough for a safe shutdown?

Accepted Answer

A UPS sized to support the equipment for a short period.. A UPS (Uninterruptible Power Supply) provides battery backup power to connected equipment, allowing servers to continue running for a short duration after a power loss. This gives administrators enough time to perform a safe, orderly shutdown, preventing data corruption and hardware damage from abrupt power loss.

Answer

A better wallpaper design in the server room.

Answer

A stronger password for the power strip.

Answer

More user awareness training about turning monitors off.

Question 4

Based on the exhibit, what wireless threat is most likely occurring?

Accepted Answer

Evil twin access point. The exhibit shows a legitimate access point (SSID: 'CorpNet') with a second, rogue access point broadcasting the same SSID but with a stronger signal. This is the classic behavior of an evil twin attack, where an attacker sets up a fraudulent AP to intercept client connections and capture credentials or sensitive data. The victim's device automatically associates with the stronger signal, believing it is the legitimate network.

Answer

Bluetooth pairing abuse

Answer

NFC skimming

Answer

DNS poisoning

Question 5

A nightly backup job shows "Completed successfully" in the backup console, but a test restore fails with an authentication error after the backup service account password was rotated last week. What is the best next step?

Accepted Answer

Update the backup application with the current service account credentials and rerun a restore validation test.. The backup job succeeded because the service account had cached credentials or the backup process itself didn't require re-authentication at that point. However, the restore operation failed because the backup application's stored credentials for accessing the backup repository are now stale after the password rotation. Updating the backup application with the current service account credentials (Option B) directly resolves the authentication error and allows a proper restore validation test.

Answer

Increase the retention period so the backup console will keep more copies.

Answer

Disable the backup software firewall rule and try the restore again later.

Answer

Delete and recreate all protected files because the backup repository is probably corrupt.

Question 6

A forum lets users save a profile signature. One user enters a string containing script code, and later other users who view that profile see the script run in their browsers. What attack is this?

Accepted Answer

Cross-site scripting. This is a classic stored cross-site scripting (XSS) attack. The malicious script is permanently stored on the server (in the user's profile signature) and executed in the browsers of any other user who views that profile. The attack exploits the forum's failure to sanitize user input before rendering it in HTML, allowing arbitrary JavaScript to run in the victim's session context.

Answer

Command injection

Answer

CSRF

Answer

Broken authentication

Question 7

Based on the exhibit, what is the best handling decision for the requested file?

Accepted Answer

Treat it as Restricted, redact unnecessary fields, and provide only the minimum approved dataset through a logged encrypted transfer.. The file contains personally identifiable information (PII) in the form of a Social Security Number (SSN), which requires handling under a Restricted classification per most data governance frameworks. The correct procedure is to redact unnecessary fields, such as the full SSN, and transmit only the minimum approved dataset via a logged encrypted transfer (e.g., using SFTP or HTTPS with TLS 1.2+) to ensure confidentiality, integrity, and auditability. This aligns with the principle of least privilege and data minimization, which are core to security program management.

Answer

Share the full file by email as Confidential because only the last four digits of the SSN are included.

Answer

Label it Public because the contractor needs the information to troubleshoot effectively.

Answer

Mark it Internal and place it on the shared project drive for easy access.

Question 8

An accounts payable clerk receives an email that appears to come from a long-time vendor. The message asks for an urgent change to bank routing information, says the CFO is traveling, and requests that no one call back because the matter is confidential. The display name looks legitimate, but the reply-to address is different from the sender identity. Which three findings most strongly indicate a pretexting or business email compromise attempt? Select three.

Accepted Answer

The message requests a payment change outside the normal approval workflow.. The request for a payment change outside the normal approval workflow is a classic indicator of business email compromise (BEC). Attackers exploit the absence of standard verification steps, such as dual authorization or manager sign-off, to redirect funds fraudulently. This bypass of established procedures directly aligns with the social engineering technique of pretexting, where the attacker fabricates a scenario (urgent, confidential, CFO traveling) to pressure the victim into violating policy.

Answer

The email contains a professional logo and a consistent signature block.

Answer

The email uses correct spelling and grammar throughout.

Question 9

A finance application stores approval records for wire transfers. Auditors need to prove which employee approved each transfer, and employees must not be able to deny their approval later. Which security objective is best addressed by binding each approval to an individual identity and preserving immutable logs?

Accepted Answer

Nonrepudiation, because the organization needs proof that a specific person performed the approval.. Nonrepudiation ensures that an action cannot be denied by the person who performed it. By binding each approval to a unique employee identity and preserving immutable logs, the organization can irrefutably prove who approved each wire transfer, preventing employees from later denying their approval. This directly addresses the requirement for accountability and proof of action.

Answer

Confidentiality, because the approval records should be hidden from everyone except finance staff.

Answer

Availability, because the approval system must remain online during business hours.

Answer

Integrity, because the record must never be changed after it is saved.

Question 10

Users on a wired subnet report intermittent outages when reaching an internal application. A packet capture shows the default gateway IP address repeatedly mapped to a different workstation MAC address, and traffic is being forwarded through that workstation. What attack is most likely occurring?

Accepted Answer

ARP spoofing, because false Layer 2 address mappings are redirecting traffic.. B is correct because ARP spoofing (also known as ARP poisoning) involves an attacker sending forged ARP messages over a local area network. This results in the attacker's MAC address being associated with the IP address of the default gateway, causing traffic destined for the gateway to be forwarded to the attacker's workstation instead. The packet capture evidence of the default gateway IP repeatedly mapped to a different workstation MAC address is the classic signature of this attack.

Answer

DNS poisoning, because the hostname is resolving to the wrong server.

Answer

Replay attack, because packets are being resent to the gateway.

Answer

Rogue DHCP service, because clients are losing access to the default gateway.

Question 11

After employees transfer departments, they keep access to old SaaS applications because app-specific accounts are removed only after a manual cleanup ticket. Which two changes best close the lifecycle gap? Select two.

Accepted Answer

Use automated provisioning and deprovisioning tied to HR events through SCIM or an equivalent interface.. Automating provisioning and deprovisioning via SCIM (System for Cross-domain Identity Management) ties account lifecycle directly to HR events (e.g., termination, transfer). This eliminates the manual cleanup ticket gap by instantly removing or modifying access when an employee changes departments, ensuring no stale SaaS accounts remain.

Answer

Keep app accounts manually managed so each app owner can decide independently.

Answer

Share a generic help desk password for quick access restoration.

Answer

Require password changes every 30 days for all users.

Question 12

After implementing MFA and stronger monitoring, a department still has a small chance of account misuse that could affect a low-value internal tool. The business owner reviews the remaining exposure and agrees it is within tolerance. What should happen next?

Accepted Answer

Document the residual risk and obtain formal acceptance from the risk owner.. After implementing MFA and stronger monitoring, the remaining exposure is residual risk that must be formally documented and accepted by the risk owner (the business owner). This aligns with the risk management process in Security Program Management, where residual risk that falls within the organization's risk appetite is accepted rather than eliminated. The business owner's agreement indicates formal acceptance, which should be recorded for audit and compliance purposes.

Answer

Escalate the issue to legal because all residual risk must be eliminated.

Answer

Remove MFA because the remaining risk is already low.

Answer

Treat the issue as resolved because monitoring alone eliminates all risk.

Question 13

An accounts payable specialist receives a reply inside an existing vendor email thread. The message uses the real invoice number, matches the vendor's usual tone, and asks the specialist to change payment instructions to a new bank account before the end of the day. The vendor later confirms its mailbox was compromised. What type of attack is most likely?

Accepted Answer

Business email compromise through conversation hijacking, because the attacker used a compromised mailbox to alter a trusted thread.. This is a business email compromise (BEC) attack specifically using conversation hijacking. The attacker gained access to the vendor's legitimate email account and inserted a fraudulent reply into an existing, trusted email thread, leveraging the compromised mailbox to bypass the specialist's suspicion. This differs from standard spear phishing because the attacker did not craft a new email from a spoofed address but instead hijacked an ongoing, authenticated conversation.

Answer

Spear phishing, because the attacker targeted one employee with a convincing message.

Answer

Baiting, because the attacker tried to tempt the user with urgency and financial pressure.

Answer

Vishing, because the attacker is trying to persuade the user to change banking details.

Question 14

A department wants to keep using a cloud printing service even though the vendor has not yet completed the company's security questionnaire. The business owner agrees to add extra log monitoring until the review is finished. What is the best term for the added monitoring?

Accepted Answer

A compensating control, because it reduces risk while the normal control is unavailable.. The added log monitoring is a compensating control because it provides an alternative security measure to mitigate risk while the primary control (the vendor's completed security questionnaire) is not yet in place. Compensating controls are temporary or alternative safeguards that reduce risk exposure when the preferred control cannot be implemented immediately. In this scenario, the monitoring does not eliminate the need for the questionnaire but reduces the risk of undetected malicious activity until the vendor's security posture is formally assessed.

Answer

Residual risk, because all risk is eliminated once monitoring is added.

Answer

Risk acceptance, because the business owner has approved continued use of the service.

Answer

Due diligence, because the company is actively reviewing the vendor.

Question 15

During an incident, a server administrator needs elevated access to production logs for exactly two hours after manager approval. The organization does not want standing privileged accounts. Which solution is the best fit?

Accepted Answer

Use just-in-time privileged access through a privileged access management workflow.. Just-in-time (JIT) privileged access through a Privileged Access Management (PAM) workflow is the best fit because it grants the administrator elevated permissions for exactly two hours, then automatically revokes them. This aligns with the requirement for time-limited access without maintaining standing privileged accounts, reducing the attack surface and ensuring compliance with the principle of least privilege.

Answer

Add the administrator to a permanent domain admin group so access is always available.

Answer

Create a shared administrator account for the incident team and change the password afterward.

Answer

Grant access by sending the administrator a VPN profile with broader network reach.

Question 16

A help desk technician reviews a ticket where a user says they logged out of the payroll portal, but another employee who found the session cookie in a browser debug log could still access the account until the session expired. Which attack best matches this behavior?

Accepted Answer

Session hijacking, because a stolen session token was reused to impersonate the user.. The described behavior—where a session cookie stolen from a browser debug log is reused by another employee to access the payroll portal—is a classic session hijacking attack. Session hijacking occurs when an attacker captures a valid session token (e.g., a cookie containing a session ID) and uses it to impersonate the authenticated user, bypassing the need for credentials. In this case, the session cookie was not invalidated upon logout, allowing the attacker to reuse it until the session's expiration time.

Answer

Pretexting, because the attacker pretended to be an authorized employee on a phone call.

Answer

CSRF, because the victim was tricked into sending unwanted requests from their browser.

Answer

Insecure deserialization, because serialized objects were accepted without validation.

Question 17

A small company is redesigning its network for a public web application. The web front end must be reachable from the internet, but the database should never be exposed directly to external or general user traffic. Which architecture is the best choice?

Accepted Answer

Place the web server in a DMZ and keep the database in a private internal subnet with only required application traffic allowed.. It implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) where it is reachable from the internet, while the database is placed in a private internal subnet with strict firewall rules that only allow the required application traffic (e.g., TCP port 3306 for MySQL or 1433 for MSSQL) from the web server. This ensures the database is never directly exposed to external or general user traffic, reducing the attack surface and preventing direct internet-based attacks on the database.

Answer

Place both the web server and database in the same internal subnet and rely on host firewalls.

Answer

Place the database in the DMZ so the web server can query it directly without internal routing.

Answer

Keep both systems public but restrict access with NAT and strong administrator passwords.

Question 18

Based on the exhibit, which temporary control best reduces risk until the patch is released?

Accepted Answer

Place the service behind a reverse proxy or WAF and restrict access with source IP allow lists.. Placing the service behind a reverse proxy or Web Application Firewall (WAF) with source IP allow lists provides a temporary compensating control that reduces the attack surface until the vendor releases a patch. The reverse proxy or WAF can inspect and filter malicious traffic, while IP allow lists restrict access to trusted sources only, mitigating the risk of exploitation without removing the service entirely.

Answer

Increase scan frequency to daily and leave the service exposed.

Answer

Disable TLS so the traffic can be inspected more easily.

Answer

Move administrative access to the same 443 listener as user traffic.

Question 19

Based on the exhibit, which supply-chain threat is most likely?

Accepted Answer

Dependency compromise. The exhibit shows a dependency on a third-party library (e.g., a JavaScript package from a CDN or a software component from an external repository). A dependency compromise occurs when an attacker injects malicious code into that trusted third-party component, which is then pulled into the organization's environment during updates or builds. This is the most likely supply-chain threat because it directly exploits the trust placed in external dependencies.

Answer

Brute-force attack

Answer

SQL injection

Answer

Privilege escalation

Question 20

Based on the exhibit, which attack is the developer most likely observing?

Accepted Answer

Server-side request forgery (SSRF). The developer is most likely observing a server-side request forgery (SSRF) attack because the log shows the application making an outbound HTTP request to an internal IP address (10.0.0.1) initiated by user-supplied input (the 'url' parameter). SSRF occurs when an attacker manipulates the server to send crafted requests to internal or external resources, bypassing access controls. The exhibit's pattern of a server-side request to a private IP range directly indicates SSRF, not client-side or database attacks.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

CSRF