SY0-701 Practice Test 27 — 15 Questions

Question 1

Based on the exhibit, which security principle should the team strengthen to reduce the chance that stolen credentials alone provide access to sensitive data?

Accepted Answer

Zero trust, because every request should be re-evaluated instead of relying on the earlier VPN login.. The exhibit shows a scenario where a VPN session grants persistent access to sensitive data without re-authentication. Zero trust is correct because it mandates continuous verification of every request, not just the initial VPN login, so stolen credentials alone would not provide ongoing access to sensitive data. This principle enforces micro-segmentation and per-request authorization, directly addressing the vulnerability of credential theft.

Answer

Least privilege, because the user should only have the minimum file permissions needed.

Answer

Need-to-know, because all finance data should be hidden from anyone outside the department.

Answer

Defense in depth, because multiple layers are always better than one control.

Question 2

Based on the exhibit, which hardening change best prevents a laptop from booting unapproved tools from external media?

Exhibit:
UEFI Setup
- Secure Boot: Disabled
- Boot order: USB, External NIC, Internal SSD
- Firmware admin password: Not configured
- BitLocker status: Enabled

Incident note:
A technician confirmed the laptop was started from a USB recovery stick that bypassed the normal corporate login workflow.

Accepted Answer

Enable Secure Boot and change the firmware boot order so only the internal SSD is allowed first.. Enabling Secure Boot ensures that only signed, trusted firmware and bootloaders can execute, preventing unauthorized tools like USB recovery sticks from loading. Changing the boot order to prioritize the internal SSD over USB media stops the system from even attempting to boot from external devices, directly addressing the incident where the laptop bypassed corporate login via a USB stick.

Answer

Extend the Windows login timeout so users have more time to notice suspicious activity.

Answer

Turn off BitLocker so recovery tools can boot without errors.

Answer

Install a host firewall rule to block USB storage devices from the network.

Question 3

A security analyst is reviewing web server logs after a user reports that the company website displayed an error message containing raw database queries. The log shows repeated requests to the product search page with the following parameter: `?id=1 OR 1=1`. Which of the following should the analyst do FIRST to confirm the nature of the suspected attack?

Accepted Answer

Verify the request details against the web application firewall logs.. The analyst should first verify the request details against the web application firewall (WAF) logs to confirm whether the WAF detected and blocked the SQL injection attempt. The parameter `?id=1 OR 1=1` is a classic SQL injection payload, and WAF logs provide immediate evidence of whether the request was flagged, allowed, or blocked, enabling the analyst to correlate the user's report with actual security controls before taking further action.

Answer

Run a vulnerability scan against the web server.

Answer

Block the source IP address in the firewall.

Answer

Isolate the web server from the network immediately.

Question 4

Based on the exhibit, which control type best describes the jump host requirement?

Accepted Answer

Compensating control, because the jump host provides an alternate safeguard when the application cannot enforce MFA directly.. The jump host is implemented as a compensating control because the payroll server's application cannot natively enforce multi-factor authentication (MFA). Instead of leaving the server unprotected, the jump host provides an alternative security layer by requiring MFA at the jump host level, thereby compensating for the application's limitation. This aligns with the NIST definition of compensating controls as alternative safeguards that mitigate risks when primary controls are infeasible.

Answer

Preventive control, because the jump host blocks unauthorized access before it reaches the payroll server.

Answer

Detective control, because session recording helps the team discover misuse after the fact.

Answer

Directive control, because the administrators are being instructed to use a specific access path.

Question 5

A customer portal runs on a single application server behind a database cluster. Leadership wants the portal to keep working if that application server fails, but the budget is tight and the team wants the simplest design that can automatically fail over. What should they add?

Accepted Answer

A second application server configured as an active-passive failover pair with health checks.. An active-passive failover pair with health checks provides automatic failover at the lowest complexity and cost. The passive server remains on standby, and health checks (e.g., ICMP, TCP port checks, or HTTP GET requests) detect application server failure, triggering automatic IP or service takeover. This meets the requirement for automatic failover without the expense and complexity of active-active or multi-region designs.

Answer

A cold backup server that is started manually after the outage is detected.

Answer

A multi-region active-active deployment with global traffic steering.

Answer

Additional RAID storage in the application server to prevent service interruption.

Question 6

A security analyst in a SOC receives an alert indicating that a large volume of data was transferred from a user's workstation to an external IP address at 2:00 AM. The analyst suspects a data exfiltration attack. According to incident response best practices, what should the analyst do FIRST?

Accepted Answer

Review the user's login and activity logs.. In incident response, the first step is to gather evidence and understand the scope of the incident. Reviewing the user's login and activity logs (e.g., Windows Event Logs, authentication logs, and process creation logs) allows the analyst to verify if the user was actually logged in at 2:00 AM, identify any anomalous behavior (e.g., use of unauthorized tools or unusual file access patterns), and determine whether the data transfer was initiated by the user or by malware. This aligns with the NIST SP 800-61 incident response lifecycle, specifically the identification and analysis phase, where initial triage focuses on log review before taking containment actions.

Answer

Block the external IP address at the firewall.

Answer

Contact the user to inquire about the transfer.

Answer

Restore the workstation from a known good backup.

Question 7

A help desk technician receives a phone call from someone claiming to be the VP of Finance. The caller says they are in an airport, forgot their phone, and need a password reset immediately. They also ask the technician to skip callback verification because a meeting starts in five minutes. Which two details are the strongest indicators of a pretexting or vishing attempt? Select two.

Accepted Answer

the caller claims an executive title and uses authority to pressure the technician. The caller's use of an executive title (VP of Finance) and urgent authority pressure is a classic social engineering tactic known as pretexting. In a vishing (voice phishing) attack, the attacker fabricates a scenario to manipulate the technician into bypassing standard security procedures. This aligns with the SY0-701 domain on threats, vulnerabilities, and mitigations, specifically social engineering techniques.

Answer

the call is routed through the company ticketing system with an approved change record

Answer

the caller answers all security questions correctly after being prompted for them

Answer

the call occurs after normal business hours on a holiday weekend

Question 8

A SOC analyst is investigating an alert triggered when a user clicked a link in an email. The email appeared to be from a trusted vendor and included a PDF attachment with a macro, but the user did not run the macro. Upon reviewing the email headers, the analyst notices that the sender's domain is a common misspelling of the vendor's legitimate domain. Which of the following is the most direct indicator that this email is a phishing attempt?

Accepted Answer

The misspelled sender domain in the email headers. The misspelled sender domain in the email headers is the most direct indicator of a phishing attempt because it reveals the attacker's use of domain spoofing or a lookalike domain to impersonate a trusted vendor. This is a classic social engineering technique that bypasses the user's visual inspection, and since the user did not run the macro, the macro itself is not an active threat. The email headers provide forensic evidence of the domain mismatch, which is a definitive sign of phishing regardless of user actions.

Answer

The macro embedded in the PDF attachment

Answer

The alert generated by the user clicking the link

Answer

The email appeared to be from a known vendor

Question 9

NetFlow and authentication logs show one workstation opening SMB and WinRM sessions to many internal hosts within ten minutes. The same source also generates a sharp rise in Kerberos service-ticket requests and attempts to access administrative shares. Which three observations most strongly support lateral movement rather than normal admin activity? Select three.

Accepted Answer

A rapid burst of SMB and WinRM connections to many internal systems from one source host.. A rapid burst of SMB and WinRM connections from a single workstation to many internal hosts is a classic indicator of lateral movement. Normal administrative activity typically involves targeted, sequential connections to specific systems for maintenance, not a broad, automated sweep. This pattern suggests an attacker using tools like PsExec or PowerShell remoting to propagate across the network.

Answer

Regular outbound DNS lookups for common internet services like time synchronization or content delivery.

Answer

A successful sign-in to the user's cloud email account from the employee's home network at lunchtime.

Question 10

Based on the exhibit, what type of attack is most likely being used against the accounts payable team?

Accepted Answer

Spear phishing, because the email is tailored to a specific team, project, and recipient.. B is correct because spear phishing is a targeted attack where the email is customized for a specific individual or group, using personal details like the recipient's name, team, and project to increase credibility. The exhibit shows the email addresses the recipient by name, references the 'Acme Corp Q3 audit' project, and is sent to the accounts payable team, which matches the tailored nature of spear phishing. This makes it more convincing than generic phishing, as the attacker has researched the target to craft a relevant lure.

Answer

Phishing, because the message asks recipients to open a file and respond quickly.

Answer

Pretexting, because the sender claims to have spoken with the recipient before.

Answer

Baiting, because the attacker offers a useful file related to the project.

Question 11

A security architect at a retail company is deploying a new e-commerce platform that processes credit card payments. The architect needs to minimize the scope of the PCI DSS assessment. The platform consists of a web server, an application server, and a database server. The cardholder data (credit card numbers) will be processed and stored only on the database server. Which of the following network architecture designs would best reduce the PCI DSS scope?

Accepted Answer

Place the database server in a separate, isolated network segment with a dedicated firewall that blocks all traffic except from the application server on the required port.. Isolating the database server in a separate network segment with a dedicated firewall that restricts traffic to only the application server on the required port creates a clear network segmentation boundary. This segmentation limits the cardholder data environment (CDE) to just the database server, thereby minimizing the scope of the PCI DSS assessment by excluding the web and application servers from the CDE.

Answer

Place all servers in the same VLAN and apply a host-based firewall on the database server.

Answer

Encrypt all data in transit using TLS and at rest using AES-256.

Answer

Implement network intrusion detection systems on all network segments.

Question 12

A security manager at a financial services company is proposing a new policy that would require annual background checks for all employees with access to sensitive customer payment data. The proposed policy, if implemented, would increase the organization's operational costs by approximately $200,000 per year. The manager needs to obtain formal approval to implement this policy. Which of the following groups is MOST likely to have the authority to approve this policy and allocate the necessary budget?

Accepted Answer

Board of directors. The board of directors holds the ultimate fiduciary responsibility and authority over significant financial commitments and strategic policy changes. A $200,000 annual cost increase requires approval at the highest governance level, as it impacts the organization's budget and risk posture. The board is the only group with the formal power to allocate such a substantial operational expense and approve a new policy affecting all employees with access to sensitive payment data.

Answer

Chief Information Security Officer (CISO)

Answer

IT steering committee

Answer

Security operations team

Question 13

Employees sign in once to the corporate portal and then open email, the ticketing system, and an HR application without entering credentials again. The external SaaS providers should trust the company's identity provider rather than creating separate user databases. What architecture is being used?

Accepted Answer

Federation with single sign-on using the corporate identity provider. This scenario describes federation with single sign-on (SSO), where the corporate identity provider (IdP) authenticates the user once and issues a security token (e.g., SAML assertion or OIDC token) that external SaaS providers trust. This eliminates the need for separate user databases in each application and allows seamless access across multiple services without re-entering credentials.

Answer

Local authentication on each application with synchronized passwords

Answer

Network access control using 802.1X authentication

Answer

Role-based access control on the file server

Question 14

Based on the exhibit, which network change best isolates finance workstations from general user PCs while still allowing printing and application access?

VLAN table:
- VLAN 20 Users: 10.20.20.0/24
- VLAN 30 Finance: 10.20.30.0/24
- VLAN 40 Printers: 10.20.40.0/24
- VLAN 50 Accounting App: 10.20.50.0/24

Current SVI routing policy:
permit ip any any

Management goal:
Finance devices must not initiate traffic to User VLAN 20, but they must be able to print and access the accounting application.

Accepted Answer

Add inter-VLAN ACLs that deny Finance VLAN access to User VLAN 20 while permitting Finance VLAN traffic to VLAN 40 and VLAN 50.. It uses inter-VLAN ACLs to enforce the principle of least privilege: denying traffic from the Finance VLAN (10.20.30.0/24) to the User VLAN (10.20.20.0/24) while explicitly permitting traffic to the Printer VLAN (10.20.40.0/24) and the Accounting App VLAN (10.20.50.0/24). This preserves the required segmentation and still allows the necessary services (printing and application access) without altering the existing VLAN structure or routing policy.

Answer

Put finance workstations on the same VLAN as the printers to simplify access.

Answer

Remove routing between all VLANs and let users print through email attachments.

Answer

Place the accounting application in the User VLAN so finance devices no longer need segmentation.

Question 15

A financial institution is implementing a new policy for all remote access to its payment processing system. The system will generate a unique digital signature for each administrative action, and all actions will be recorded in a tamper-evident audit log that is replicated to an immutable storage location. The primary objective of this policy is to ensure that administrators who perform sensitive operations cannot later deny having executed them. Which security goal is this policy primarily intended to enforce?

Accepted Answer

Non-repudiation. The policy's use of unique digital signatures for each administrative action, combined with a tamper-evident audit log replicated to immutable storage, directly enforces non-repudiation. Non-repudiation ensures that an administrator cannot deny having performed a specific action because the digital signature cryptographically binds the action to the administrator's identity, and the immutable log prevents any subsequent alteration or deletion of the record. This is the primary security goal when the objective is to prevent denial of responsibility for sensitive operations.

Answer

Authorization

Answer

Authentication

Answer

Availability