SY0-701 Practice Test 27 — 15 Questions

Question 1

Based on the exhibit, what is the best conclusion about the signed document?

Accepted Answer

The invoice was not changed after signing and the signer’s certificate chain validated correctly.. Option B is correct because a valid digital signature provides both integrity (the document was not altered after signing) and authentication (the signer's certificate chain validates to a trusted root). The exhibit shows a successful signature validation, which cryptographically proves that the invoice has not been modified since signing and that the signing certificate is trusted.

Answer

The invoice is confidential because the signature encrypts the document contents.

Answer

The invoice can be edited if the timestamp is still within business hours.

Answer

The sender’s private key is now public because the certificate verified successfully.

Question 2

Based on the exhibit, what is the best-supported conclusion for the SOC analyst?

Accepted Answer

The host is likely using DNS tunneling or DNS-based command and control.. The exhibit shows a high volume of DNS queries to multiple unusual domains with long subdomain strings, which is a classic indicator of DNS tunneling or DNS-based command and control (C2). DNS tunneling encodes data in DNS queries and responses, allowing attackers to exfiltrate data or communicate with a C2 server while bypassing traditional network controls. The SOC analyst should recognize this pattern as anomalous DNS activity rather than normal web browsing.

Answer

The traffic is normal web browsing to a content delivery network.

Answer

The issue is most likely ARP spoofing on the local switch port.

Answer

The evidence most strongly indicates a password spraying campaign.

Question 3

Based on the exhibit, what should the team do next after the account has been contained?

Accepted Answer

Remove mailbox persistence, revoke all tokens and app consent, then monitor for reentry.. Option B is correct because after containing a compromised account (e.g., disabling it or resetting its password), the attacker may still have established persistence mechanisms such as mailbox forwarding rules, OAuth app consent grants, or session tokens that survive a password reset. Removing these artifacts and revoking all tokens and app consents ensures the attacker cannot regain access via delegated permissions or persistent mailbox rules. Monitoring for reentry is critical to detect any residual access or new compromise attempts.

Answer

Close the incident because the password reset removed the attacker from the environment.

Answer

Reimage the user's laptop before reviewing mailbox settings.

Answer

Restore the mailbox from backup to remove the forwarding rule and keep the user productive.

Question 4

Based on the exhibit, what is the BEST fix for the vulnerability being exploited?

A user with a standard account can retrieve documents by changing the `docId` value in the request. The application returns another employee's file without any authorization error.

Accepted Answer

Enforce server-side object-level authorization checks before returning any document.. The vulnerability is an Insecure Direct Object Reference (IDOR), where the application trusts user-supplied input (the `docId` parameter) without verifying that the authenticated user is authorized to access the requested document. The best fix is to enforce server-side object-level authorization checks before returning any document, ensuring that the server validates the user's permissions against the specific resource ID before processing the request.

Answer

Add client-side JavaScript to hide document IDs from the user interface.

Answer

Require users to change passwords more frequently to prevent unauthorized document access.

Answer

Place the document server behind a load balancer to prevent direct access to the application.

Question 5

Based on the exhibit, what is the BEST response by the employee?

The message appears to come from a trusted internal support team, but the sender details and request do not align with normal procedures.

Accepted Answer

Verify the request using a known internal help desk number or portal before taking any action.. Option A is correct because verifying the request through a known internal help desk number or portal is the standard security practice to confirm the legitimacy of any unexpected communication, especially when sender details and procedures do not align. This approach mitigates the risk of social engineering attacks, such as phishing or business email compromise (BEC), where attackers impersonate trusted entities to trick employees into revealing sensitive information or performing unauthorized actions. By using an independently verified contact method, the employee ensures they are not falling victim to a fraudulent request that could lead to account compromise or data breach.

Answer

Reply with the six-digit code so the help desk can complete the repair quickly.

Answer

Open the linked repair page from the email and sign in immediately to avoid suspension.

Answer

Forward the message to the manager and continue using the account until the suspension occurs.

Question 6

Based on the exhibit, what type of attack is most likely being used against the accounts payable team?

Accepted Answer

Spear phishing, because the email is tailored to a specific team, project, and recipient.. B is correct because spear phishing is a targeted attack where the email is customized for a specific individual or group, using personal details like the recipient's name, team, and project to increase credibility. The exhibit shows the email addresses the recipient by name, references the 'Acme Corp Q3 audit' project, and is sent to the accounts payable team, which matches the tailored nature of spear phishing. This makes it more convincing than generic phishing, as the attacker has researched the target to craft a relevant lure.

Answer

Phishing, because the message asks recipients to open a file and respond quickly.

Answer

Pretexting, because the sender claims to have spoken with the recipient before.

Answer

Baiting, because the attacker offers a useful file related to the project.

Question 7

Based on the exhibit, which access model best fits the business requirement without creating many custom roles?

Accepted Answer

ABAC, because access can be evaluated using user, resource, and environment attributes together.. B is correct because Attribute-Based Access Control (ABAC) evaluates multiple attributes (user, resource, environment) to dynamically determine access, which fits a business requirement that needs flexible, context-aware permissions without creating many custom roles. Unlike RBAC, ABAC avoids role explosion by using policies that combine attributes, making it ideal for environments where access decisions depend on factors like time, location, or data sensitivity.

Answer

RBAC, because every user can be placed into a fixed role that never changes.

Answer

DAC, because each file owner can decide access individually without any central rule engine.

Answer

MAC, because users should manually grant access to themselves when needed.

Question 8

Based on the exhibit, what is the most likely issue with the software component being built?

Accepted Answer

Supply-chain compromise, because the dependency may have been altered before it reached the build pipeline.. The exhibit shows a build pipeline that fetches a dependency from a public repository. If the dependency has been tampered with before it reaches the pipeline, this is a classic supply-chain compromise. Attackers often inject malicious code into popular open-source packages, which then gets incorporated into the build, compromising the final software component.

Answer

Cross-site scripting, because the package name suggests the application handles web content.

Answer

Credential stuffing, because automated systems frequently reuse credentials during updates.

Answer

Replay attack, because the nightly pipeline used an old copy of the package request.

Question 9

Based on the exhibit, what control type is the automated reapplication of the baseline?

Accepted Answer

Corrective control, because the MDM agent restores the approved baseline after the unauthorized change is found.. The automatic reapplication of the approved firewall baseline is a corrective control because it fixes a configuration that drifted away from the secure standard. The user was able to make the change, so the control was not preventive. The MDM system then returned the device to its approved state, which is the defining behavior of correction rather than simple detection or deterrence.

Why others are wrong: The user change was already allowed to happen, so the control was not preventive. The log shows an automatic restoration, not just an alert, so it is more than detective. A deterrent would merely discourage changes through warnings or visibility. The key evidence is the platform's automatic rollback to the approved baseline after the deviation was found.

Answer

Preventive control, because the system prevented the user from changing the firewall profile at all.

Answer

Detective control, because the help desk can review the event later.

Answer

Deterrent control, because the policy baseline discourages users from making changes.

Question 10

Based on the exhibit, what is the most likely explanation for the alert?

Accepted Answer

The workstation has been redirected to an approved corporate proxy, so the event is expected.. The alert indicates that the workstation's DNS traffic is being redirected to an internal proxy server (10.0.0.53), which is a common configuration in corporate environments for content filtering and security monitoring. Since the destination IP (10.0.0.53) is within the organization's private IP range and the proxy is explicitly approved, this behavior is expected and not malicious. The event is consistent with a transparent proxy or DNS-based proxy redirection, where the workstation's DNS queries are intercepted and forwarded to the corporate proxy.

Answer

A DNS cache poisoning attack is in progress and the workstation is now using a rogue gateway.

Answer

The endpoint is infected with malware that is hiding its traffic through encrypted tunnels.

Answer

The workstation is under a denial-of-service attack because it sent repeated DNS lookups.

Question 11

Based on the exhibit, which change best reduces the blast radius if a user workstation is compromised?

Accepted Answer

Remove direct user access to the backup VLAN and allow only the dedicated backup path.. Option C is correct because removing direct user access to the backup VLAN and allowing only the dedicated backup path enforces network segmentation, which limits lateral movement. If a workstation in VLAN 10 is compromised, an attacker cannot pivot directly to the backup server in VLAN 30, reducing the blast radius. This aligns with the principle of least privilege and defense-in-depth for backup infrastructure.

Answer

Add more allow rules from VLAN 10 to VLAN 30 for SMB and RDP so restore jobs stay flexible.

Answer

Move the backup server into the user VLAN to avoid routing and ACL complexity.

Answer

Increase the DHCP lease time so backup jobs run less often during business hours.

Question 12

Based on the exhibit, what should the security team recommend for the finance workstation pilot?

Accepted Answer

Require the vendor to provide the missing supply-chain documentation or an approved compensating-control plan before approval.. Option B is correct because the exhibit indicates missing supply-chain documentation for the finance workstation pilot. Without this documentation, the security team cannot verify the integrity and provenance of the hardware and software, which is critical for a pilot involving sensitive financial data. Requiring the vendor to provide the missing documentation or an approved compensating-control plan ensures compliance with supply-chain risk management policies before approval.

Answer

Approve the pilot because the workstations are limited to read-only data and the application is signed.

Answer

Disable segmentation so the pilot can access more systems if troubleshooting is needed.

Answer

Let the finance director sign an informal email and skip the security review.

Question 13

Based on the exhibit, which action should the incident response team take next to eradicate the threat?

Accepted Answer

Reimage the endpoint from a known-good build and reset potentially exposed credentials.. Option C is correct because the exhibit indicates a confirmed compromise (e.g., a scheduled task establishing outbound C2 traffic). Eradication requires removing all traces of the attacker's foothold, which is best achieved by reimaging the endpoint from a known-good build. Additionally, any credentials that may have been exposed during the compromise must be reset to prevent lateral movement or re-entry.

Answer

Return the workstation to the user since the outbound connection was blocked.

Answer

Delete only the scheduled task and reconnect the host to monitor for more alerts.

Answer

Close the incident because memory capture has already preserved the evidence.

Question 14

Based on the exhibit, what should the organization do before approving this SaaS vendor to process employee HR records?

Accepted Answer

Require a security addendum and evidence review before onboarding, including notification timelines, deletion terms, subprocessors, and independent testing.. Option C is correct because before processing sensitive employee HR records, the organization must ensure the SaaS vendor meets security and compliance requirements. This includes reviewing contractual terms like notification timelines, data deletion policies, subprocessor usage, and independent testing evidence (e.g., SOC 2 Type II or ISO 27001 certification). Without these, the organization cannot verify the vendor's security posture or contractual obligations, which is critical for protecting PII and meeting regulatory requirements like GDPR or HIPAA.

Answer

Approve the vendor now because admin MFA is enabled and the deadline is urgent.

Answer

Request a formal risk acceptance memo and sign the contract without additional review.

Answer

Move the HR data into the vendor environment first and complete the review after production cutover.

Question 15

Based on the exhibit, which attack is most likely occurring on the local network?

Accepted Answer

ARP spoofing. ARP spoofing is the most likely attack because the exhibit shows an attacker sending forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. This poisons the ARP cache of the victim, causing all traffic destined for the gateway to be sent to the attacker instead, enabling man-in-the-middle interception.

Answer

DNS cache poisoning

Answer

Replay attack

Answer

Amplification denial-of-service

SY0-701 Practice Test 27 — 15 Questions

Exhibit

SY0-701 Practice Test 27 — 15 Questions

Exhibit