SY0-701 Practice Test 26 — 15 Questions

Question 1

A payroll SaaS provider has passed initial review, but before contract signing it announces that customer data will be processed by a new subcontractor in another country. The business wants to keep the onboarding timeline short, but security still needs assurance that the change does not increase exposure. What is the BEST next step?

Accepted Answer

Update the third-party risk assessment and require evidence of the subcontractor's controls before approval.. The correct answer is B because the introduction of a new subcontractor in a different country represents a material change to the data processing environment, which invalidates the initial risk assessment. Security must update the third-party risk assessment to evaluate the subcontractor's controls, such as data protection, encryption standards, and compliance with local regulations, before approval. This ensures that the change does not increase exposure, even if the primary provider passed initial review.

Answer

Approve the vendor because the primary provider already passed the initial review.

Answer

Wait until the first quarterly audit to review the subcontractor change.

Answer

Accept the change if the vendor provides a marketing brochure describing its security program.

Question 2

An employee receives an email from someone claiming to be from IT. The message says the employee must read back a one-time verification code so their mailbox can be 'repaired.' What social engineering technique is being used?

Accepted Answer

Pretexting, because the attacker is using a fake identity and story to gain trust.. The attacker is using a fabricated identity (IT support) and a false scenario (mailbox repair requiring a verification code) to manipulate the employee into divulging sensitive information. This is the classic definition of pretexting, where the attacker creates a believable pretext to lower the victim's defenses and extract data or access.

Answer

Tailgating, because the attacker is trying to enter a secure area physically.

Answer

DDoS, because the message is designed to overwhelm the mailbox server.

Answer

Shoulder surfing, because the attacker is watching the screen from nearby.

Question 3

An HR analyst must send a compensation spreadsheet to an external auditor. The auditor only needs employee names, departments, and salary totals; Social Security numbers and bank account fields are not required. What should the analyst do before sharing the file?

Accepted Answer

Remove or redact the fields the auditor does not need, then share only the minimum necessary data.. Option B is correct because the principle of data minimization requires sharing only the information necessary for the task. By removing or redacting the Social Security numbers and bank account fields, the analyst reduces the risk of exposing sensitive personally identifiable information (PII) to the external auditor, aligning with least privilege and need-to-know principles.

Answer

Encrypt the spreadsheet and send the full file as-is to preserve all records.

Answer

Store the file in a shared cloud folder and grant the auditor read-only access.

Answer

Convert the file to PDF so the sensitive information is harder to edit.

Question 4

Based on the exhibit, which control type best describes the jump host requirement?

Accepted Answer

Compensating control, because the jump host provides an alternate safeguard when the application cannot enforce MFA directly.. The jump host is implemented as a compensating control because the payroll server's application cannot natively enforce multi-factor authentication (MFA). Instead of leaving the server unprotected, the jump host provides an alternative security layer by requiring MFA at the jump host level, thereby compensating for the application's limitation. This aligns with the NIST definition of compensating controls as alternative safeguards that mitigate risks when primary controls are infeasible.

Answer

Preventive control, because the jump host blocks unauthorized access before it reaches the payroll server.

Answer

Detective control, because session recording helps the team discover misuse after the fact.

Answer

Directive control, because the administrators are being instructed to use a specific access path.

Question 5

An internal audit found that a procurement team uses the shared account procure-approve to approve emergency purchases. The log only shows the shared account name, and managers say they cannot prove which person approved each request. Which two changes best improve accountability and nonrepudiation? Select two.

Accepted Answer

Replace the shared account with named user accounts and unique credentials.. Option A is correct because replacing the shared account with named user accounts and unique credentials ensures that each approval action is tied to a specific individual. This directly addresses the lack of accountability and nonrepudiation, as each user's unique credentials create a verifiable link between the person and the action, preventing repudiation of the approval.

Answer

Require a longer password on the shared account.

Answer

Store screenshots of approval screens in a shared folder.

Answer

Encrypt the approval database at rest.

Question 6

An office wants finance workstations separated from general user PCs, but employees still need to print to a shared printer and access one accounting application. Which change best supports this?

Accepted Answer

Move finance systems to a separate VLAN or subnet and allow only required traffic through filtering rules.. Option B is correct because placing finance systems on a separate VLAN or subnet with a Layer 3 boundary enforces network segmentation, which limits broadcast domains and restricts lateral movement. By configuring access control lists (ACLs) or firewall rules to permit only the required traffic (e.g., SMB/CIFS for printer sharing and specific TCP/UDP ports for the accounting application), the organization achieves a least-privilege network architecture. This approach aligns with the principle of defense-in-depth, reducing the attack surface while maintaining necessary business functionality.

Answer

Place all systems on one VLAN and rely on strong passwords.

Answer

Put the printer in a different building to make it more secure.

Answer

Enable screen lock timers on the finance PCs and keep the network flat.

Question 7

An organization is redesigning access for its HR portal. HR staff need to update employee records, managers need to approve leave requests, and payroll staff need access to salary data, but no single user should receive all of those permissions by default. What is the best access model?

Accepted Answer

Create separate roles for HR, managers, and payroll, and grant only the permissions needed for each job function.. Option A is correct because Role-Based Access Control (RBAC) assigns permissions based on job functions, ensuring that HR staff, managers, and payroll personnel receive only the privileges necessary for their roles. This enforces the principle of least privilege and prevents any single user from inheriting all permissions by default, which aligns with the organization's security requirement.

Answer

Assign everyone the same portal permissions to simplify administration.

Answer

Give every manager full HR and payroll access so approvals are faster.

Answer

Use one shared administrator account for all HR actions to keep audits simple.

Question 8

Based on the exhibit, what change would best protect the password database against precomputed attacks and make identical passwords less obvious?

Accepted Answer

Add a unique salt to each password before hashing it.. Adding a unique salt to each password before hashing ensures that even if two users have the same password, their hashes will differ. This defeats precomputed attacks like rainbow tables because the attacker would need to compute a separate table for each salt value, which is computationally infeasible. Salting is a standard defense recommended by NIST SP 800-63B and implemented in modern systems like bcrypt, scrypt, and PBKDF2.

Answer

Encrypt each password with the same server key before storing it in the database.

Answer

Use a digital signature on each password record so the database can verify authenticity.

Answer

Store the password hashes in uppercase so attackers cannot compare them easily.

Question 9

Based on the exhibit, what is the best eradication decision for the server compromise?

Accepted Answer

Rebuild the server from a trusted image and restore only known-good data after evidence is preserved.. Option C is correct because a server compromise implies that the attacker may have achieved persistence through modified binaries, kernel modules, or rootkits that cannot be reliably removed by simple remediation steps. Rebuilding from a trusted image ensures that all malicious artifacts are eliminated, and restoring only known-good data from backups (after forensic preservation) prevents reintroduction of compromised files. This aligns with the CompTIA incident response process, where eradication must remove all traces of the threat, and rebuilding is the safest approach for a confirmed compromise.

Answer

Restart sshd and monitor the system for another login attempt.

Answer

Manually delete the cron entry and reverse the SSH change on the live server.

Answer

Increase the SIEM retention period and keep the current server online.

Question 10

Based on the exhibit, what is the best fix so role changes are reflected promptly in the application?

Token and directory data:

09:10  Token issued for user jdoe
      groups=[Finance_Approver, Expense_Reviewer]
      auth_time=09:10
      exp=17:10
09:15  HR updated directory: jdoe moved to Sales
11:00  The application still accepts the original token and allows expense approval
11:01  Identity provider logs show no token revocation event

Accepted Answer

Shorten token and session lifetime and revoke active tokens when the directory role changes.. Option B is correct because the token's long lifetime (issued at 09:10, expires at 17:10) allows the application to continue accepting the original token even after the user's directory role changes at 09:15. Shortening the token lifetime forces more frequent reauthentication, and revoking active tokens when the directory role changes ensures that the application immediately reflects the updated authorization. This aligns with the principle of dynamic access control and token lifecycle management.

Answer

Increase the token lifetime so users reauthenticate less often.

Answer

Move the application to a different subnet to isolate it from HR systems.

Answer

Disable group-based authorization and let any authenticated user approve expenses.

Question 11

Based on the exhibit, what is the best improvement to reduce the impact if one backup server is compromised?

Accepted Answer

Store encryption keys in a centralized KMS or HSM and use distinct keys with rotation.. Option C is correct because using a centralized Key Management System (KMS) or Hardware Security Module (HSM) with distinct, rotated keys ensures that compromising one backup server does not expose the encryption keys for all backups. This isolates the impact to only the data encrypted with that specific key, and key rotation further limits the window of exposure. In contrast, sharing a single key file across servers creates a single point of failure, as compromising one server reveals the key for all backups.

Answer

Keep the same key file but rename it so attackers cannot find it easily.

Answer

Replace AES with SHA-256 so the backups are harder to read.

Answer

Email the key file to backup operators so they can restore data quickly.

Question 12

An operations manager is worried a single network administrator could quietly push an unauthorized firewall rule. The manager wants every rule change reviewed by a second person and documented before implementation. Which control best addresses this concern?

Accepted Answer

Require a documented change-management workflow with two approvers before any firewall rule is applied.. Option B is correct because a documented change-management workflow with two approvers directly enforces separation of duties, ensuring that no single administrator can implement a firewall rule change without peer review and documented approval. This control addresses the manager's concern about unauthorized changes by requiring a second person to review and approve before the rule is applied, which is a fundamental principle of access control and change management.

Answer

Enable detailed firewall logging so each packet match is written to disk.

Answer

Move the firewall appliance into a locked equipment rack.

Answer

Encrypt the firewall configuration backup with a strong key.

Question 13

Based on the exhibit, which governance artifact is the security team reviewing?

Accepted Answer

Baseline, because it defines the approved minimum configuration for a system type.. The exhibit shows a list of approved operating systems, software versions, and patches for a specific system type (e.g., Windows 10 22H2 with specific security updates). This is a baseline, which defines the minimum acceptable configuration for a system type. Option C is correct because a baseline establishes a known good state that systems must meet, not just intent (policy), mandatory technical requirements (standard), or step-by-step instructions (procedure).

Answer

Policy, because it describes the organization's overall intent and direction.

Answer

Standard, because it sets mandatory technical requirements for systems.

Answer

Procedure, because it gives step-by-step instructions for completing a task.

Question 14

Based on the exhibit, users report that the new payment portal opens only after they bypass a browser warning. Which remediation best restores secure access without weakening certificate validation?

Accepted Answer

Reissue the server certificate so the subject or SAN matches pay.example.net and chain it to the trusted CA.. The browser warning indicates a hostname mismatch or untrusted CA. Reissuing the server certificate with the correct subject or SAN (Subject Alternative Name) matching pay.example.net and chaining it to a trusted CA resolves the warning while maintaining full certificate validation. This ensures the browser can verify both the identity and trustworthiness of the server without weakening security.

Answer

Install the same certificate on every client so the browser warning is suppressed.

Answer

Disable certificate name checking in the browser until the certificate expires.

Answer

Replace TLS with a shared symmetric key configured on the web server and all users.

Question 15

Based on the exhibit, what is the most likely conclusion after correlating the logs?

A configuration-management task ran from a jump host and generated repeated login alerts on target servers. The SOC wants to determine whether this is malicious activity or approved automation.

Accepted Answer

This is a likely false positive caused by approved automation, so the alert should be correlated with the change window.. Option B is correct because the logs show repeated login attempts from a jump host, which is a common pattern for configuration-management tools (e.g., Ansible, Puppet) that execute tasks across multiple servers. The SOC should correlate these events with the approved change window to confirm they are part of legitimate automation, not malicious activity. Failed logins alone do not indicate a brute-force attack, as automation scripts may retry connections or use cached credentials that occasionally fail due to network latency or credential rotation.

Answer

This is a true brute-force attack because any failed login must be malicious.

Answer

This indicates DNS poisoning because both servers were contacted from the same source IP.

Answer

This is proof of ransomware spreading laterally over SMB.