SY0-701 Practice Test 28 — 15 Questions

Question 1

After several employees clicked on phishing emails, management wants to reduce future click rates and show measurable improvement across finance, HR, and executive assistants. Which control best meets that goal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use role-based security awareness training with phishing simulations and metrics tracking.. Role-based security awareness training with phishing simulations and metrics tracking directly addresses the human factor by tailoring content to specific job roles (finance, HR, executive assistants) and provides measurable improvement through simulation click-rate data. This approach aligns with the NIST SP 800-50 framework for continuous security awareness, enabling management to track reduction in click rates over time.

Answer

Send a one-time company-wide memo reminding users not to click suspicious links.

Answer

Disable all external email attachments for every department indefinitely.

Answer

Require employees to complete annual policy acknowledgment without testing.

Question 2

A records manager is preparing to delete old HR emails next week under the retention schedule. Legal notifies the team that those messages may be needed for an active investigation. What should the records manager do first?

Accepted Answer

Place the emails on legal hold and suspend normal deletion for those records.. When legal notifies that emails may be needed for an active investigation, the records manager must immediately suspend normal deletion and place a legal hold on those records. This preserves the data in its original state, preventing spoliation and ensuring compliance with e-discovery obligations. Deleting or moving the emails could destroy metadata or chain of custody, violating legal hold requirements.

Answer

Delete the emails on schedule and archive only the subject lines.

Answer

Move the emails to a shared folder so legal can review them later.

Answer

Compress the emails into an encrypted file and continue with deletion.

Question 3

Based on the exhibit, which social engineering attack is most likely?

Accepted Answer

Spear phishing, because the email is tailored to a specific employee and business context.. Spear phishing involves crafting a message that is personalized to a specific individual or role within an organization, often referencing internal processes or names to increase credibility. In the exhibit, the email is addressed to a specific employee and mentions a legitimate-sounding business context (e.g., an internal document or procedure), which is the hallmark of spear phishing rather than a generic blast.

Answer

Phishing, because the message is a broad email that tries to trick the recipient.

Answer

Vishing, because the attacker is using a phone call to pressure the victim.

Answer

Baiting, because the attacker is offering a document that the user wants to open.

Question 4

Based on the exhibit, which cloud service model best fits the application's operational and security requirements?

Accepted Answer

Platform as a Service (PaaS), because it offloads OS and runtime maintenance while preserving application control.. The exhibit shows an application that requires the organization to manage the application code and data while offloading the underlying OS, runtime, and middleware maintenance. Platform as a Service (PaaS) provides this exact split: the cloud provider handles the OS patches, runtime updates, and infrastructure scaling, while the organization retains full control over the application deployment and configuration. This matches the requirement of preserving application control without the overhead of managing the guest OS.

Answer

Infrastructure as a Service (IaaS), because it gives full control over the guest operating system.

Answer

Software as a Service (SaaS), because the organization would not need to maintain anything.

Answer

Colocation, because the team can place its own servers in a provider facility and manage everything directly.

Question 5

A financial institution updates its access control policy to require that two different system administrators must approve and execute any changes to the core transaction processing database. Which security principle is this practice primarily designed to enforce?

Accepted Answer

Separation of duties. Requiring two different system administrators to approve and execute changes to the core transaction processing database enforces separation of duties. This principle ensures that no single individual has the authority to perform both the approval and execution steps, reducing the risk of fraud, error, or unauthorized modifications. In a financial institution, this is critical for maintaining the integrity of transaction data and complying with regulatory standards like SOX or PCI DSS.

Answer

Defense in depth

Answer

Least privilege

Answer

Need to know

Question 6

A business-critical internal reporting portal is exposed to all employees. A scan finds a high-severity vulnerability, but the vendor says a fix will not be available for 30 days. The application is only used by finance once a month, and the business can tolerate a brief outage if needed. Which risk treatment is the BEST immediate action?

Accepted Answer

Apply compensating controls, such as restricting access and adding a temporary control, until the vendor patch is available.. Applying compensating controls—such as restricting access to only the finance team and implementing a temporary web application firewall (WAF) rule—immediately reduces the attack surface while the vendor develops a patch. This aligns with the risk treatment of mitigation, as it lowers the likelihood of exploitation without requiring a full fix. The business can tolerate a brief outage, so a temporary access control list (ACL) or IP whitelist is a practical, immediate measure.

Answer

Accept the risk because the application is used infrequently and the impact is limited.

Answer

Transfer the risk by purchasing cyber insurance for the application.

Answer

Avoid the risk by permanently decommissioning the reporting portal.

Question 7

A security team is defining the minimum approved configuration for all new Linux web servers. The document must require specific logging settings, approved packages, and disabled services, and administrators must check servers against it during audits. Which governance artifact best fits this need?

Accepted Answer

Baseline, because it defines the minimum approved configuration that systems should meet.. A baseline is the correct governance artifact because it defines the minimum approved configuration that systems must meet, including specific logging settings, approved packages, and disabled services. In the context of Linux web servers, a baseline ensures consistent security posture by providing a measurable standard that administrators can audit against, such as verifying that rsyslog is configured for remote logging, only packages like Apache or Nginx from approved repositories are installed, and services like Telnet or FTP are disabled. This aligns with the requirement for enforcement and auditability, unlike a guideline which is merely advisory.

Answer

Guideline, because it suggests recommended settings without requiring enforcement.

Answer

Policy, because it is the high-level statement of intent for the organization.

Answer

Procedure, because it explains the exact steps to install and configure each server.

Question 8

A security manager is preparing a quarterly report for the board of directors on the effectiveness of the organization's security program. The manager has access to detailed technical data, including firewall log statistics, patch compliance percentages, and number of phishing simulation clicks. Which of the following would be the most appropriate way to present this information to the board?

Accepted Answer

Show a trend chart of the number of security incidents categorized by severity, along with average time to resolve.. It presents security program effectiveness in a business-relevant format: trend charts of incidents by severity and resolution times directly address risk reduction and operational efficiency, which board members need for strategic oversight. Unlike raw technical data, this aggregated, visualized information enables non-technical stakeholders to assess whether the security program is improving over time.

Answer

Provide a list of all firewall rule changes made during the quarter.

Answer

Include raw logs of the top 10 most frequent alerts from the SIEM.

Answer

Describe the technical architecture of the intrusion prevention system.

Question 9

A small company is publishing an internal website to the internet. The security team wants the web server reachable from the internet while keeping the database and file share isolated from direct internet access. Which design is best?

Accepted Answer

Place the web server in a DMZ and keep the database and file share on a private internal subnet.. It implements a DMZ architecture where the web server is placed in a publicly accessible network segment, while the database and file share reside on a private internal subnet. This design ensures that even if the web server is compromised, an attacker cannot directly access the internal resources because firewall rules restrict inbound traffic to only the DMZ and block any initiated connections from the DMZ to the internal network. This follows the principle of defense in depth and network segmentation as recommended by CompTIA for securing multi-tier applications.

Answer

Place the web server and database on the same flat internal network behind the firewall.

Answer

Place the database in the DMZ and keep the web server on the internal user VLAN.

Answer

Use a VPN for all users and keep every server on the same subnet.

Question 10

Based on the exhibit, what is the best governance action before the sales team uses the legacy portal without MFA?

Accepted Answer

Create a formal time-bound exception with compensating controls, approval, and an expiration date.. Governance requires that any exception to a security policy (such as bypassing MFA) must be formally documented, approved by management, time-bound, and include compensating controls to mitigate risk. In this scenario, the legacy portal lacks MFA support, so a formal exception with an expiration date ensures the risk is tracked and re-evaluated, rather than permanently weakening security posture.

Answer

Update the policy immediately to allow password-only access for all legacy systems.

Answer

Have the help desk approve the request informally in the ticket and proceed without further documentation.

Answer

Ignore the MFA requirement because the portal is owned by a trusted partner.

Question 11

Based on the exhibit, which attack is most likely being attempted against the application?

Accepted Answer

Server-side request forgery, because the application is being tricked into making internal requests on the attacker's behalf.. The exhibit shows an attacker manipulating a URL parameter (e.g., `?url=http://169.254.169.254/latest/meta-data/`) to make the application fetch an internal resource. This is a classic Server-Side Request Forgery (SSRF) attack, where the application is tricked into making requests to internal services (like cloud metadata endpoints) on the attacker's behalf, bypassing network segmentation.

Answer

Cross-site scripting, because the attacker is trying to inject script into the victim's browser session.

Answer

Cross-site request forgery, because the attacker is forcing an authenticated user to submit an unwanted request.

Answer

SQL injection, because the attacker is manipulating a query parameter to expose backend data.

Question 12

Based on the exhibit, which identity architecture change best addresses the repeated password resets and delayed offboarding across the company's SaaS applications?

Exhibit:
- SaaS A uses local user accounts
- SaaS B uses local user accounts
- SaaS C supports SAML and automated provisioning
- Help desk reports 120 password reset tickets per month
- Former employees can remain active in two apps for up to 24 hours after termination

Management wants one sign-in and faster deprovisioning.

Accepted Answer

Implement federated SSO with the enterprise identity provider and automated provisioning for SaaS users.. Implementing federated SSO with the enterprise identity provider (IdP) centralizes authentication, allowing users to sign in once. Combined with automated provisioning (SCIM), it enables near-instant deprovisioning when an employee is terminated, eliminating the 24-hour delay and reducing password reset tickets by removing the need for local account management.

Answer

Create one shared account for each application and store the passwords in a vault.

Answer

Keep local accounts in every SaaS app and reset passwords whenever staff change roles.

Answer

Put the SaaS apps behind a network firewall and use source IP filtering instead of identity.

Question 13

Based on the exhibit, which document type should be updated to make the approval and retention requirements mandatory across the organization?

Accepted Answer

Policy, because it sets mandatory rules that apply organization-wide.. A policy document is the correct choice because it establishes mandatory rules that apply organization-wide, making approval and retention requirements enforceable across all departments. Unlike guidelines or procedures, policies are authoritative and require compliance, which is essential for standardizing security controls like data retention periods.

Answer

Guideline, because it provides flexible advice without requiring enforcement.

Answer

Procedure, because it lists the exact steps the help desk follows.

Answer

Architecture diagram, because it shows where documents are stored.

Question 14

Based on the exhibit, what is the best change to improve accountability without removing emergency access?

Accepted Answer

Require named accounts with role-based elevation through a privileged access workflow.. Implementing named accounts with role-based elevation through a privileged access workflow (PAW) ensures each administrator has a unique identity for auditing, while still allowing temporary privilege escalation for emergency tasks. This directly improves accountability by tying actions to specific users, unlike shared accounts which obscure individual responsibility. The workflow maintains emergency access by granting time-limited elevated permissions through an approval process, avoiding permanent standing privileges.

Answer

Keep the shared account and add more logging of the shared password.

Answer

Remove all command logging to protect administrator privacy.

Answer

Use a single shared account with a longer password and monthly rotation.

Question 15

Based on the exhibit, which data protection control best allows analysts to work with the records without exposing full card numbers?

Accepted Answer

Tokenize the card numbers and keep the token mapping in a secured vault.. Tokenization replaces sensitive card numbers with non-sensitive placeholders (tokens) that retain the format and length of the original data but have no exploitable value. The analytics team can work with the tokens for reporting and analysis, while the actual card numbers remain securely stored in a separate token vault, preventing exposure even if the analytics database is compromised.

Answer

Encrypt the entire analytics database and give the team the decryption key.

Answer

Hash the card numbers with SHA-256 so the analytics team can reverse them later if needed.

Answer

Delete all but the last four digits from the production database immediately.