SY0-701 Practice Test 5 — 25 Questions

Question 1

A software supplier used by your organization begins subcontracting a critical part of its service to an unknown hosting company. Which contractual control would BEST help manage this supply chain risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Require advance notice and approval for subcontractor changes, plus right-to-audit and security obligations.. It establishes a contractual control that requires the supplier to notify and obtain approval before subcontracting critical services, while also imposing right-to-audit and security obligations. This directly addresses supply chain risk by ensuring the organization can vet and monitor the subcontractor's security posture, as recommended by NIST SP 800-161 for supply chain risk management.

Answer

Require the supplier to send monthly sales updates to the procurement team.

Answer

Ask the supplier to place all responsibility for the subcontractor on the customer.

Answer

Disable all vendor access immediately without reviewing the change.

Question 2

A workstation is suspected of malware infection, and it is still powered on and connected to the network. Which action best preserves volatile evidence before the system is shut down?

Accepted Answer

Capture memory and note running processes before taking further action.. Volatile evidence, such as the contents of RAM (running processes, network connections, open files), is lost when the system is powered off. Capturing a memory dump and recording running processes preserves this critical data for forensic analysis, allowing investigators to identify malware artifacts (e.g., injected code, hidden processes) that exist only in memory. This aligns with the NIST SP 800-86 forensic procedure of prioritizing volatile data collection before system shutdown.

Answer

Immediately power off the workstation to stop any malicious activity.

Answer

Run a full antivirus scan before documenting anything.

Answer

Delete temporary files to reduce the chance of reinfection.

Question 3

A router interface connects the DMZ subnet 10.10.10.0/24 to the internal network. A web server at 10.10.10.25 must reach an application server at 10.10.20.20 on TCP 8443, and all other DMZ-to-internal traffic must be blocked. Which two ACL entries should be applied inbound on the DMZ-facing interface? Select two.

Accepted Answer

permit tcp 10.10.10.25 host 10.10.20.20 eq 8443. It permits TCP traffic from the specific web server (10.10.10.25) to the application server (10.10.20.20) on destination port 8443, which is the only allowed DMZ-to-internal communication. This entry uses the 'host' keyword to specify the exact source IP and the 'eq' keyword to match the required destination port, implementing the principle of least privilege.

Answer

permit tcp host 10.10.20.20 any eq 8443

Answer

permit ip any any

Answer

permit udp 10.10.10.0/24 host 10.10.20.20 eq 8443

Question 4

Based on the exhibit, which control should be enabled to mitigate this issue?

Accepted Answer

Dynamic ARP inspection with DHCP snooping, because it validates ARP replies against trusted bindings.. Dynamic ARP inspection (DAI) with DHCP snooping validates ARP packets against a trusted binding database, preventing man-in-the-middle attacks where an attacker spoofs the MAC address of a legitimate host (e.g., the default gateway) to intercept traffic. The exhibit likely shows a scenario of ARP spoofing or cache poisoning, which DAI directly mitigates by dropping invalid ARP replies. DHCP snooping builds the trusted binding table by recording which IP address is assigned to which MAC address on which port.

Answer

DNSSEC, because it validates DNS records and would stop local address-to-MAC spoofing.

Answer

Port forwarding, because it can direct traffic to the correct internal host more reliably.

Answer

Load balancing, because it would distribute traffic and reduce the impact of connectivity issues.

Question 5

Your company is syncing design files to a cloud object store. The security team wants to reduce risk if the storage account is stolen and also protect the files while they travel across the internet. Which approach is the best fit?

Accepted Answer

Encrypt data in transit with TLS and enable encryption at rest with managed keys.. It addresses both risks: TLS (Transport Layer Security) encrypts data in transit, preventing interception or tampering during upload, while managed keys for encryption at rest protect the files if the storage account credentials are compromised. This dual-layer approach aligns with defense-in-depth and is a standard best practice for cloud object stores like Amazon S3 or Azure Blob Storage.

Answer

Password-protect each archive and upload it over plain HTTP.

Answer

Rename the files before upload so attackers cannot identify them.

Answer

Place the storage service on a private IP address and skip encryption.

Question 6

HR needs to share a copy of employee records with a benefits contractor for testing. The contractor only needs names and coverage selections, not Social Security numbers or bank details. Which two actions best satisfy data handling requirements? Select two.

Accepted Answer

Redact or mask unnecessary sensitive fields before sharing the file.. Redacting or masking sensitive fields like Social Security numbers and bank details ensures that the contractor receives only the necessary data (names and coverage selections) while protecting personally identifiable information (PII). This aligns with the principle of data minimization and compliance with regulations such as GDPR or HIPAA, which require that only the minimum necessary data be shared for a specific purpose. Masking techniques, such as replacing SSNs with placeholders or applying irreversible hashing, prevent unauthorized exposure even if the file is intercepted.

Answer

Send the full employee record set because the contractor is trusted.

Answer

Upload the file to a public collaboration site so the contractor can retrieve it easily.

Answer

Keep an unrestricted copy on multiple shared drives for convenience.

Question 7

A cloud-hosted API lets users supply a URL for the service to fetch an image. Shortly after release, logs show requests to 169.254.169.254 and internal admin addresses. What control best reduces this risk?

Accepted Answer

Restrict outbound requests to an allowlist and block internal address ranges.. Restricting outbound requests to an allowlist and blocking internal address ranges directly mitigates the Server-Side Request Forgery (SSRF) vulnerability. The requests to 169.254.169.254 (the AWS/GCP/Azure metadata endpoint) and internal admin addresses indicate an attacker is using the API to probe internal services. An allowlist ensures the API only connects to trusted external hosts, while blocking private and link-local ranges prevents access to internal infrastructure.

Answer

Allow the API to follow any redirect so it works with more image sources.

Answer

Store the fetched image in encrypted form before sending it to users.

Answer

Increase the session timeout to reduce repeated logins by legitimate users.

Question 8

Based on the exhibit, what type of malware is most likely present?

Accepted Answer

Logic bomb. The exhibit shows a script that checks for a specific employee name and, if the condition is met, deletes critical system files. This is a classic logic bomb: malicious code embedded in a legitimate program that executes when predefined conditions (e.g., a specific user, date, or event) are satisfied. Logic bombs do not self-replicate or continuously spy; they lie dormant until triggered.

Answer

Worm

Answer

Spyware

Answer

Rootkit

Question 9

EDR shows encoded PowerShell launched by a word processor and an outbound connection to a rare domain. What is the best immediate containment action?

Accepted Answer

Isolate the endpoint from the network using the EDR console.. Isolating the endpoint from the network using the EDR console is the best immediate containment action because it stops the outbound connection to the rare domain, preventing potential command-and-control (C2) communication or data exfiltration. The encoded PowerShell launched by a word processor strongly suggests a malicious macro or exploit, and isolating the host contains the threat without disrupting the entire network. This aligns with the incident response priority of containment before eradication or recovery.

Answer

Uninstall the word processor from every workstation.

Answer

Wait to see whether more alerts appear before responding.

Answer

Send a notice to all users reminding them not to open attachments.

Question 10

A caller says they are from IT support and asks a user to read back the one-time MFA code that just arrived on their phone. What type of attack is this most likely?

Accepted Answer

Vishing. This is a vishing (voice phishing) attack because the attacker uses a phone call to socially engineer the victim into revealing a one-time MFA code. Unlike phishing (email) or smishing (SMS), vishing relies on voice communication to bypass technical controls and trick the user into providing the code, which the attacker can then use to authenticate as the victim.

Answer

Phishing

Answer

Smishing

Answer

Baiting

Question 11

A development team needs a centralized service to store, rotate, and control access to encryption keys for applications. Which solution best fits?

Accepted Answer

Key management service, because it centralizes key storage and rotation controls.. A key management service (KMS) centralizes the lifecycle of cryptographic keys, including secure storage, automated rotation, and fine-grained access control via IAM policies. This directly meets the requirement for a centralized service to store, rotate, and control access to encryption keys for applications, as KMS is purpose-built for these tasks.

Answer

Port forwarding rule, because it allows applications to reach the encryption system.

Answer

Load balancer, because it distributes encryption requests across servers.

Answer

Web application firewall, because it protects the keys from injection attacks.

Question 12

A file server suddenly shows renamed files with a new extension, users see a ransom note demanding cryptocurrency, and shadow copies are deleted from the host. Which malware family is the best match?

Accepted Answer

Ransomware, because the attacker is encrypting data and demanding payment to restore access.. Ransomware is the correct classification because the scenario describes file encryption (renamed files with new extensions), a ransom note demanding cryptocurrency, and the deletion of shadow copies (Volume Shadow Copy Service snapshots) to prevent file recovery. These are hallmark behaviors of ransomware, specifically crypto-ransomware, which encrypts data and demands payment for decryption keys.

Answer

Trojan, because the attack requires a disguised program to install itself.

Answer

Spyware, because the attacker is likely trying to monitor file activity.

Answer

Logic bomb, because the malware likely triggered after a specific condition was met.

Question 13

A security operations center (SOC) analyst is overwhelmed by the volume of alerts. The management wants to implement a solution that can automatically respond to common threats, such as blocking an IP address or isolating a compromised endpoint, without requiring human intervention. Which of the following technologies best meets this requirement?

Accepted Answer

Security Orchestration, Automation, and Response (SOAR). SOAR is the correct choice because it is specifically designed to automate response actions to common security incidents, such as blocking an IP address via firewall APIs or isolating an endpoint through EDR integration, without requiring human intervention. This directly addresses the SOC analyst's alert fatigue by enabling playbook-driven, automated remediation.

Answer

Security Information and Event Management (SIEM)

Answer

Endpoint Detection and Response (EDR)

Answer

Cloud Access Security Broker (CASB)

Question 14

An office loses power several times each month, causing servers to shut down without warning. Which control best helps keep the systems running long enough for a safe shutdown?

Accepted Answer

A UPS sized to support the equipment for a short period.. A UPS (Uninterruptible Power Supply) provides battery backup power to connected equipment, allowing servers to continue running for a short duration after a power loss. This gives administrators enough time to perform a safe, orderly shutdown, preventing data corruption and hardware damage from abrupt power loss.

Answer

A better wallpaper design in the server room.

Answer

A stronger password for the power strip.

Answer

More user awareness training about turning monitors off.

Question 15

Based on the exhibit, what wireless threat is most likely occurring?

Accepted Answer

Evil twin access point. The exhibit shows a legitimate access point (SSID: 'CorpNet') with a second, rogue access point broadcasting the same SSID but with a stronger signal. This is the classic behavior of an evil twin attack, where an attacker sets up a fraudulent AP to intercept client connections and capture credentials or sensitive data. The victim's device automatically associates with the stronger signal, believing it is the legitimate network.

Answer

Bluetooth pairing abuse

Answer

NFC skimming

Answer

DNS poisoning

Question 16

A nightly backup job shows "Completed successfully" in the backup console, but a test restore fails with an authentication error after the backup service account password was rotated last week. What is the best next step?

Accepted Answer

Update the backup application with the current service account credentials and rerun a restore validation test.. The backup job succeeded because the service account had cached credentials or the backup process itself didn't require re-authentication at that point. However, the restore operation failed because the backup application's stored credentials for accessing the backup repository are now stale after the password rotation. Updating the backup application with the current service account credentials (Option B) directly resolves the authentication error and allows a proper restore validation test.

Answer

Increase the retention period so the backup console will keep more copies.

Answer

Disable the backup software firewall rule and try the restore again later.

Answer

Delete and recreate all protected files because the backup repository is probably corrupt.

Question 17

A forum lets users save a profile signature. One user enters a string containing script code, and later other users who view that profile see the script run in their browsers. What attack is this?

Accepted Answer

Cross-site scripting. This is a classic stored cross-site scripting (XSS) attack. The malicious script is permanently stored on the server (in the user's profile signature) and executed in the browsers of any other user who views that profile. The attack exploits the forum's failure to sanitize user input before rendering it in HTML, allowing arbitrary JavaScript to run in the victim's session context.

Answer

Command injection

Answer

CSRF

Answer

Broken authentication

Question 18

Based on the exhibit, what is the best handling decision for the requested file?

Accepted Answer

Treat it as Restricted, redact unnecessary fields, and provide only the minimum approved dataset through a logged encrypted transfer.. The file contains personally identifiable information (PII) in the form of a Social Security Number (SSN), which requires handling under a Restricted classification per most data governance frameworks. The correct procedure is to redact unnecessary fields, such as the full SSN, and transmit only the minimum approved dataset via a logged encrypted transfer (e.g., using SFTP or HTTPS with TLS 1.2+) to ensure confidentiality, integrity, and auditability. This aligns with the principle of least privilege and data minimization, which are core to security program management.

Answer

Share the full file by email as Confidential because only the last four digits of the SSN are included.

Answer

Label it Public because the contractor needs the information to troubleshoot effectively.

Answer

Mark it Internal and place it on the shared project drive for easy access.

Question 19

An accounts payable clerk receives an email that appears to come from a long-time vendor. The message asks for an urgent change to bank routing information, says the CFO is traveling, and requests that no one call back because the matter is confidential. The display name looks legitimate, but the reply-to address is different from the sender identity. Which three findings most strongly indicate a pretexting or business email compromise attempt? Select three.

Accepted Answer

The message requests a payment change outside the normal approval workflow.. The request for a payment change outside the normal approval workflow is a classic indicator of business email compromise (BEC). Attackers exploit the absence of standard verification steps, such as dual authorization or manager sign-off, to redirect funds fraudulently. This bypass of established procedures directly aligns with the social engineering technique of pretexting, where the attacker fabricates a scenario (urgent, confidential, CFO traveling) to pressure the victim into violating policy.

Answer

The email contains a professional logo and a consistent signature block.

Answer

The email uses correct spelling and grammar throughout.

Question 20

A finance application stores approval records for wire transfers. Auditors need to prove which employee approved each transfer, and employees must not be able to deny their approval later. Which security objective is best addressed by binding each approval to an individual identity and preserving immutable logs?

Accepted Answer

Nonrepudiation, because the organization needs proof that a specific person performed the approval.. Nonrepudiation ensures that an action cannot be denied by the person who performed it. By binding each approval to a unique employee identity and preserving immutable logs, the organization can irrefutably prove who approved each wire transfer, preventing employees from later denying their approval. This directly addresses the requirement for accountability and proof of action.

Answer

Confidentiality, because the approval records should be hidden from everyone except finance staff.

Answer

Availability, because the approval system must remain online during business hours.

Answer

Integrity, because the record must never be changed after it is saved.