SY0-701 Practice Test 27 — 15 Questions

Question 1

Based on the exhibit, what type of attack is most likely being used against the accounts payable team?

Accepted Answer

Spear phishing, because the email is tailored to a specific team, project, and recipient.. B is correct because spear phishing is a targeted attack where the email is customized for a specific individual or group, using personal details like the recipient's name, team, and project to increase credibility. The exhibit shows the email addresses the recipient by name, references the 'Acme Corp Q3 audit' project, and is sent to the accounts payable team, which matches the tailored nature of spear phishing. This makes it more convincing than generic phishing, as the attacker has researched the target to craft a relevant lure.

Answer

Phishing, because the message asks recipients to open a file and respond quickly.

Answer

Pretexting, because the sender claims to have spoken with the recipient before.

Answer

Baiting, because the attacker offers a useful file related to the project.

Question 2

A security architect at a retail company is deploying a new e-commerce platform that processes credit card payments. The architect needs to minimize the scope of the PCI DSS assessment. The platform consists of a web server, an application server, and a database server. The cardholder data (credit card numbers) will be processed and stored only on the database server. Which of the following network architecture designs would best reduce the PCI DSS scope?

Accepted Answer

Place the database server in a separate, isolated network segment with a dedicated firewall that blocks all traffic except from the application server on the required port.. Isolating the database server in a separate network segment with a dedicated firewall that restricts traffic to only the application server on the required port creates a clear network segmentation boundary. This segmentation limits the cardholder data environment (CDE) to just the database server, thereby minimizing the scope of the PCI DSS assessment by excluding the web and application servers from the CDE.

Answer

Place all servers in the same VLAN and apply a host-based firewall on the database server.

Answer

Encrypt all data in transit using TLS and at rest using AES-256.

Answer

Implement network intrusion detection systems on all network segments.

Question 3

A security manager at a financial services company is proposing a new policy that would require annual background checks for all employees with access to sensitive customer payment data. The proposed policy, if implemented, would increase the organization's operational costs by approximately $200,000 per year. The manager needs to obtain formal approval to implement this policy. Which of the following groups is MOST likely to have the authority to approve this policy and allocate the necessary budget?

Accepted Answer

Board of directors. The board of directors holds the ultimate fiduciary responsibility and authority over significant financial commitments and strategic policy changes. A $200,000 annual cost increase requires approval at the highest governance level, as it impacts the organization's budget and risk posture. The board is the only group with the formal power to allocate such a substantial operational expense and approve a new policy affecting all employees with access to sensitive payment data.

Answer

Chief Information Security Officer (CISO)

Answer

IT steering committee

Answer

Security operations team

Question 4

Employees sign in once to the corporate portal and then open email, the ticketing system, and an HR application without entering credentials again. The external SaaS providers should trust the company's identity provider rather than creating separate user databases. What architecture is being used?

Accepted Answer

Federation with single sign-on using the corporate identity provider. This scenario describes federation with single sign-on (SSO), where the corporate identity provider (IdP) authenticates the user once and issues a security token (e.g., SAML assertion or OIDC token) that external SaaS providers trust. This eliminates the need for separate user databases in each application and allows seamless access across multiple services without re-entering credentials.

Answer

Local authentication on each application with synchronized passwords

Answer

Network access control using 802.1X authentication

Answer

Role-based access control on the file server

Question 5

Based on the exhibit, which network change best isolates finance workstations from general user PCs while still allowing printing and application access?

VLAN table:
- VLAN 20 Users: 10.20.20.0/24
- VLAN 30 Finance: 10.20.30.0/24
- VLAN 40 Printers: 10.20.40.0/24
- VLAN 50 Accounting App: 10.20.50.0/24

Current SVI routing policy:
permit ip any any

Management goal:
Finance devices must not initiate traffic to User VLAN 20, but they must be able to print and access the accounting application.

Accepted Answer

Add inter-VLAN ACLs that deny Finance VLAN access to User VLAN 20 while permitting Finance VLAN traffic to VLAN 40 and VLAN 50.. It uses inter-VLAN ACLs to enforce the principle of least privilege: denying traffic from the Finance VLAN (10.20.30.0/24) to the User VLAN (10.20.20.0/24) while explicitly permitting traffic to the Printer VLAN (10.20.40.0/24) and the Accounting App VLAN (10.20.50.0/24). This preserves the required segmentation and still allows the necessary services (printing and application access) without altering the existing VLAN structure or routing policy.

Answer

Put finance workstations on the same VLAN as the printers to simplify access.

Answer

Remove routing between all VLANs and let users print through email attachments.

Answer

Place the accounting application in the User VLAN so finance devices no longer need segmentation.

Question 6

A financial institution is implementing a new policy for all remote access to its payment processing system. The system will generate a unique digital signature for each administrative action, and all actions will be recorded in a tamper-evident audit log that is replicated to an immutable storage location. The primary objective of this policy is to ensure that administrators who perform sensitive operations cannot later deny having executed them. Which security goal is this policy primarily intended to enforce?

Accepted Answer

Non-repudiation. The policy's use of unique digital signatures for each administrative action, combined with a tamper-evident audit log replicated to immutable storage, directly enforces non-repudiation. Non-repudiation ensures that an administrator cannot deny having performed a specific action because the digital signature cryptographically binds the action to the administrator's identity, and the immutable log prevents any subsequent alteration or deletion of the record. This is the primary security goal when the objective is to prevent denial of responsibility for sensitive operations.

Answer

Authorization

Answer

Authentication

Answer

Availability

Question 7

Based on the exhibit, which logging capability should be enabled first to create an audit trail for cloud administration changes?

Exhibit:
2026-04-25 09:14:03  iam:AttachRolePolicy  user=alice
2026-04-25 09:15:10  ec2:AuthorizeSecurityGroupIngress  user=alice
2026-04-25 09:16:22  s3:PutBucketPolicy  user=alice

Requirement:
Security wants to track management-plane API calls and configuration changes across cloud resources.

Accepted Answer

Enable cloud control-plane audit logging such as CloudTrail or the provider equivalent.. Cloud control-plane audit logging (e.g., AWS CloudTrail, Azure Monitor, or GCP Cloud Audit Logs) captures all management-plane API calls—such as IAM role attachments, security group rule changes, and bucket policy modifications—as shown in the exhibit. This directly meets the requirement to track configuration changes across cloud resources, providing a tamper-proof audit trail for security and compliance.

Answer

Install a rootkit detector on each workload and ignore management-plane activity.

Answer

Capture only DNS traffic, because it reveals all admin changes indirectly.

Answer

Rely on manual change tickets in a spreadsheet because cloud platforms do not record useful logs.

Question 8

Based on the exhibit, which action best addresses both the unsanctioned software problem and the need for consistent endpoint configuration?

Exhibit:
Device group: Sales-Laptops
Baseline check:
- Approved browser: installed
- Approved EDR: installed
- Unapproved remote admin tool: detected on 14 endpoints
- Local administrator rights: granted to all users in group
- Patch compliance: 68%

Management wants to prevent unauthorized software from running and keep future builds consistent.

Accepted Answer

Deploy application allowlisting through centralized endpoint management and remove local administrator rights.. Application allowlisting (via AppLocker or Windows Defender Application Control) centrally enforces which software can run, directly addressing the unsanctioned remote admin tool. Removing local administrator rights prevents users from bypassing the allowlist or making unauthorized configuration changes, ensuring consistent endpoint builds and improving patch compliance by limiting user-driven modifications.

Answer

Keep users as local admins but require stronger email passwords for better overall security.

Answer

Disable the EDR agent during software installs to avoid false alerts from approved apps.

Answer

Store approved installers on a shared drive and let users choose what to install.

Question 9

An organization's file server contains sensitive HR data. The security team discovers that permissions on a confidential folder have been altered. Which of the following security controls would MOST likely help determine the account responsible for this change?

Accepted Answer

Audit logging. Audit logging is the correct answer because it records detailed information about who made changes to files and folders, including the account name, timestamp, and the specific permission alteration. By reviewing audit logs, the security team can trace the unauthorized permission change back to the responsible user account. This is a detective control that directly supports accountability and forensic investigation.

Answer

Data loss prevention (DLP) system

Answer

Mandatory access control (MAC)

Answer

Host-based intrusion prevention system (HIPS)

Question 10

A virtual file server was restored from last night’s backup. The service is online, but some finance users report missing spreadsheet changes and a few files show a 'recovered copy' timestamp. Which two checks should be completed before the team accepts the restore as successful? Select two.

Accepted Answer

Compare restored data against backup hashes or a manifest to verify that the copy is complete and uncorrupted.. Comparing restored data against backup hashes or a manifest ensures the data integrity and completeness of the restore process. Even though the file server is online, missing spreadsheet changes and 'recovered copy' timestamps suggest possible corruption or incomplete restoration. Verifying hashes (e.g., SHA-256) against a known-good manifest confirms that every file was restored without bit-rot or truncation, which is a standard post-restore validation step in backup and recovery procedures.

Answer

Assume the restore is acceptable because the file server is online and users can browse shares.

Answer

Delete the previous night’s backup so the team will not accidentally restore it again.

Answer

Expose the restored server directly to the internet so remote users can test it faster.

Question 11

A vulnerability scan finds a critical flaw on an internet-facing VPN appliance and says public exploit code is already available. Which issue should be remediated first?

Accepted Answer

A critical flaw on an internet-facing VPN appliance with known exploit code. The critical flaw on an internet-facing VPN appliance with known public exploit code represents the highest risk because it combines a severe vulnerability, direct exposure to the internet, and immediate weaponization potential. VPN appliances are common attack vectors for initial access, and an exploit in the wild means attackers can compromise the device without advanced skills, leading to potential network breach and lateral movement.

Answer

A low-severity finding on an internal test server with no network access

Answer

A cosmetic configuration warning on a printer management interface

Answer

A medium-severity issue on a device that is powered off and not in service

Question 12

A finance app uses the corporate IdP for authentication. A user who moved out of finance can still approve invoices until the browser session expires, and the app caches local roles. Which two changes best make access changes take effect faster without storing app passwords? Select two.

Accepted Answer

Shorten token and session lifetimes, and require reauthentication for high-risk actions.. Shortening token and session lifetimes reduces the window during which stale permissions remain active, and requiring reauthentication for high-risk actions (like approving invoices) ensures that the user's current authorization status is verified before sensitive operations. This directly addresses the problem of cached roles persisting beyond the user's actual group membership changes.

Answer

Increase password complexity but keep session duration unchanged.

Answer

Disable SSO and email one-time passwords for every login.

Answer

Keep long-lived sessions to reduce help desk tickets.

Question 13

Based on the exhibit, which document should be updated first to reflect the new ticketing platform while keeping approval requirements unchanged?

Accepted Answer

Procedure, because the step-by-step instructions and screenshots are now outdated.. The procedure document contains the step-by-step instructions, including screenshots and specific commands for the old ticketing platform. Since the new platform changes the user interface and workflow steps, the procedure must be updated first to ensure technicians can follow accurate instructions. Policies and standards define high-level rules and approval requirements, which remain unchanged, so they do not need immediate revision.

Answer

Policy, because every tool change requires rewriting the corporate mandate.

Answer

Standard, because the approval workflow and evidence rules are still the same.

Answer

Guideline, because optional content should always be revised before mandatory content.

Question 14

A security analyst is investigating a series of alerts from the web application firewall. Users are reporting that when they view a product review page on the company's e-commerce site, their browser automatically redirects to a malicious website. The analyst examines the database and finds that a product review submitted by a user contains a <script> tag that loads a JavaScript file from an external domain. Which type of attack has occurred?

Accepted Answer

Stored cross-site scripting (XSS). The attack is stored cross-site scripting (XSS) because the malicious <script> tag was permanently stored in the product review database. When any user views the product review page, the browser loads and executes the external JavaScript file from the attacker's domain, causing an automatic redirect to a malicious website. This matches the classic stored XSS pattern where payload persists in server-side storage and executes in the victim's browser context.

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Answer

Reflected cross-site scripting (XSS)

Question 15

During troubleshooting, several hosts in VLAN 20 lose access to the default gateway at random. Their ARP caches now map the gateway IP to a workstation MAC address, and traffic briefly flows through that workstation before timing out. What attack is most likely?

Accepted Answer

ARP poisoning, because false ARP replies are redirecting gateway traffic to another host.. The scenario describes classic ARP poisoning (also known as ARP spoofing). The attacker sends forged ARP replies to the hosts in VLAN 20, associating the gateway's IP address with the attacker's MAC address. This causes the hosts to forward traffic destined for the gateway to the attacker's workstation, where it is briefly forwarded (or dropped) before timing out, matching the symptoms of a man-in-the-middle attack via ARP cache corruption.

Answer

DNS poisoning, because the workstation name may be resolving to the wrong IP address.

Answer

Replay attack, because the attacker is reusing old network frames to confuse the hosts.

Answer

Denial of service, because traffic eventually times out and connectivity is lost.