SY0-701 Practice Test 26 — 15 Questions

Question 1

A security analyst is reviewing the organization's incident response procedures. According to the NIST SP 800-61 framework, which four of the following are recognized phases of the incident response lifecycle? (Choose four.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Preparation. The NIST SP 800-61 Revision 2 framework defines the incident response lifecycle as consisting of four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. These phases form a continuous cycle, with lessons learned from Post-Incident Activity feeding back into Preparation. The question asks for the four recognized phases, and these four options directly match the NIST model.

Answer

Threat Hunting

Answer

Risk Assessment

Question 2

A company wants guest laptops on Wi-Fi to reach the internet but not internal printers or servers. Which two changes best support this design? Select two.

Accepted Answer

Assign guest access points to a separate VLAN with its own subnet.. Assigning guest access points to a separate VLAN with its own subnet isolates guest traffic at Layer 2, preventing direct communication with internal devices like printers and servers. This segmentation is a foundational step for enforcing access control policies without relying solely on higher-layer filtering.

Answer

Allow guests on the same VLAN as employee devices for simpler routing.

Answer

Enable WPA2-Enterprise on employee wireless only, and reuse that on guest devices.

Answer

Put printers on the guest VLAN so guests can print directly.

Question 3

Users on the same VLAN report that their browser occasionally reaches a fake internal portal, and packet captures show one host sending forged ARP replies that claim to be the default gateway. Traffic from nearby systems begins flowing through that host. Which attack is occurring?

Accepted Answer

ARP spoofing. B is correct because the scenario describes ARP spoofing (also known as ARP poisoning). The attacker sends forged ARP replies to associate their MAC address with the default gateway's IP address, causing traffic from other hosts on the same VLAN to be redirected through the attacker's machine. This allows the attacker to intercept, modify, or redirect traffic to a fake internal portal, which is a classic man-in-the-middle (MITM) attack leveraging the stateless nature of ARP.

Answer

DNS poisoning

Answer

MAC flooding

Answer

SYN flood

Question 4

An organization is implementing a Security Information and Event Management (SIEM) system to enhance its security monitoring capabilities. Which four of the following are primary functions of a SIEM? (Choose four.)

Accepted Answer

Real-time alerting on security events. A SIEM's primary functions include correlation of log data from multiple sources to identify patterns and anomalies, real-time alerting on security events to enable immediate response, centralized log storage and retention for compliance and forensic analysis, and automated threat intelligence feed integration to enrich event data with known indicators of compromise (IOCs). These capabilities collectively provide comprehensive security monitoring and incident detection.

Answer

Vulnerability scanning and patch management

Answer

In-line network traffic blocking

Question 5

Match each detection pattern to the most likely security issue. Each item has one best match.

Accepted Answer

Repeated login failures: Brute-force attack. Repeated login failures indicate brute-force; Outbound connections to malicious IPs suggest C2; Large data transfers at odd hours indicate exfiltration; Random DNS subdomains are typical of tunneling; Conflicting ARP replies show spoofing; Multiple ICMP requests from many sources indicate DDoS.

Answer

Random DNS subdomains: DDoS

Answer

Conflicting ARP replies: Data exfiltration

Question 6

A security manager is designing a security program to align with business goals. Which three of the following are essential components of a security program that directly support governance and oversight? (Choose three.)

Accepted Answer

Conducting periodic risk assessments to inform decision-making. A security steering committee with executive sponsorship ensures that security initiatives have top-down support and alignment with business objectives, which is a core governance function. Developing and maintaining security policies, standards, and procedures provides the formal framework for enforcing security controls and ensuring compliance, directly supporting oversight. Conducting periodic risk assessments informs decision-making by identifying and prioritizing risks, which is essential for governance and resource allocation.

Answer

Installing endpoint detection and response agents on all workstations

Answer

Implementing a vulnerability scanning tool across all endpoints

Answer

Deploying a next-generation firewall to segment the network

Question 7

Match each security principle to the best description.

Accepted Answer

Confidentiality: Restricts access to authorized users.. These pairings match the CIA triad plus additional principles: confidentiality restricts access, integrity prevents unauthorized changes, availability ensures uptime, non-repudiation provides proof of actions, authentication verifies identity, and authorization defines permissions.

Answer

Non-repudiation: Ensures data is unchanged.

Answer

Authentication: Grants permissions.

Answer

Authorization: Verifies identity.

Question 8

Match each cloud security concept to the best description.

Accepted Answer

Encryption: Protects data by converting it into a secure format.. Each cloud security concept is matched to its primary function: encryption protects data at rest or in transit, IAM manages access, SIEM provides event analysis, IDS detects intrusions, and DLP prevents data loss.

Answer

Encryption: Manages user access to resources.

Answer

IAM: Protects data by encoding it.

Question 9

Match each security control type to the best example in a small office environment.

Accepted Answer

Administrative: Security awareness training policy. These matches classify security controls by type: administrative involves policies, technical uses technology, physical secures premises, deterrent discourages violations, preventive stops incidents, and detective identifies occurrences.

Answer

Administrative: Firewall

Answer

Physical: Security awareness training policy

Question 10

A hospital is redesigning its wireless network. Guest devices must reach only the internet. Staff laptops need access to internal applications. Medical devices must communicate with a monitoring server but never with guest devices or the broader employee LAN. What design best meets these goals with the least operational complexity?

Accepted Answer

Create separate VLANs for guest, staff, and medical devices, then enforce traffic rules between them with firewall policies.. VLANs logically segment the network into isolated broadcast domains for guest, staff, and medical devices, while firewall policies (e.g., using ACLs or stateful inspection) enforce granular traffic rules. This design ensures medical devices can only communicate with the monitoring server, guests are restricted to internet-only access, and staff can reach internal applications, all without requiring complex physical reconfiguration.

Answer

Place all devices on one flat network and rely on endpoint antivirus for protection.

Answer

Use a single wireless SSID with client isolation enabled and NAT all traffic through one gateway.

Answer

Deploy network access control only at login time and allow all devices onto the same internal subnet afterward.

Question 11

A security manager at a healthcare organization is reviewing the results of a third-party vendor risk assessment for a cloud-based email service that will store protected health information (PHI). The assessment reveals that the vendor encrypts data at rest using AES-256 but does not support customer-managed encryption keys. The vendor's data center is located in a country that is not subject to HIPAA jurisdiction. The vendor's previous penetration test report is over 18 months old. Which of the following is the most appropriate risk management action for the security manager to take?

Accepted Answer

Request the vendor to obtain a current SOC 2 Type II report and review the findings before making a decision.. A SOC 2 Type II report provides an independent assessment of a vendor's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time. Given the vendor's lack of customer-managed keys and outdated penetration test, the security manager needs a current, comprehensive audit report to evaluate whether compensating controls adequately mitigate the risks of storing PHI outside HIPAA jurisdiction. This action allows an informed risk acceptance or mitigation decision without prematurely terminating a potentially compliant service.

Answer

Accept the risk because the vendor uses strong encryption.

Answer

Terminate the contract immediately and select a different vendor.

Answer

Require the vendor to implement customer-managed keys and provide a new penetration test report within 30 days.

Question 12

A security analyst notices repeated attempts to copy large amounts of data to USB drives from a user's workstation. The analyst suspects the user may be exfiltrating company proprietary data. The company wants to implement a technical control that can both detect and block such data exfiltration without completely disabling all USB ports, as some users require USB for authorized work. Which of the following would best meet this requirement?

Accepted Answer

Deploy a data loss prevention (DLP) agent configured with rules to monitor and block unauthorized data transfers to removable media.. A Data Loss Prevention (DLP) agent can be configured with granular rules to monitor and block unauthorized data transfers to removable media (e.g., USB drives) based on content inspection, file type, or volume thresholds. This allows authorized USB usage while preventing exfiltration of proprietary data, meeting the requirement for both detection and blocking without disabling all USB ports.

Answer

Implement a host-based intrusion detection system (HIDS) that alerts on USB insertion events.

Answer

Enable BitLocker encryption on all USB drives to prevent unauthorized data access.

Answer

Configure the local group policy to disable all USB ports on all workstations.

Question 13

Based on the exhibit, which principle is most directly being violated by the current share permissions?

Accepted Answer

Need-to-know, because only the people working on valuation models should access them.. The exhibit shows share permissions granting 'Finance Dept' full control over a folder containing valuation models. The need-to-know principle restricts access to only those individuals who require the information to perform their job functions. Since not all Finance Dept members work on valuation models, granting the entire department access violates need-to-know, as only the specific users building those models should have access.

Answer

Least privilege, because the broad Finance Dept access exceeds what many users require.

Answer

Zero trust, because the share should refuse access until every file request is reauthenticated.

Answer

Defense in depth, because the folder should have several separate layers of encryption.

Question 14

Based on the exhibit, what change would best protect the password database against precomputed attacks and make identical passwords less obvious?

Accepted Answer

Add a unique salt to each password before hashing it.. Adding a unique salt to each password before hashing ensures that even if two users have the same password, their hashes will differ. This defeats precomputed attacks like rainbow tables because the attacker would need to compute a separate table for each salt value, which is computationally infeasible. Salting is a standard defense recommended by NIST SP 800-63B and implemented in modern systems like bcrypt, scrypt, and PBKDF2.

Answer

Encrypt each password with the same server key before storing it in the database.

Answer

Use a digital signature on each password record so the database can verify authenticity.

Answer

Store the password hashes in uppercase so attackers cannot compare them easily.

Question 15

A security manager at a healthcare organization is responsible for maintaining the information security policy. A project manager requests a policy exception to use a cloud-based analytics platform that stores patient data. The platform currently encrypts data at rest with AES-128 instead of the required AES-256. The security manager assesses the risk and determines that the likelihood of data exposure is low due to other compensating controls already in place, but the impact would be high. The residual risk is within the organization's risk appetite. Which of the following is the most appropriate action for the security manager to take?

Accepted Answer

Approve the exception and document the compensating controls and a review date.. The security manager has assessed the risk, determined that compensating controls reduce the likelihood of data exposure, and confirmed that the residual risk is within the organization's risk appetite. Formally approving the exception with documented compensating controls and a review date ensures governance, accountability, and a timeline for reassessment, which aligns with the policy exception process in security program management.

Answer

Deny the exception and require the project to use an approved platform that meets the AES-256 requirement.

Answer

Accept the risk and allow the project to proceed without a formal exception.

Answer

Escalate the request to the chief information officer for a final decision.