SY0-701 Practice Test 28 — 15 Questions

Question 1

Based on the exhibit, which logging capability should be enabled first to create an audit trail for cloud administration changes?

Exhibit:
2026-04-25 09:14:03  iam:AttachRolePolicy  user=alice
2026-04-25 09:15:10  ec2:AuthorizeSecurityGroupIngress  user=alice
2026-04-25 09:16:22  s3:PutBucketPolicy  user=alice

Requirement:
Security wants to track management-plane API calls and configuration changes across cloud resources.

Accepted Answer

Enable cloud control-plane audit logging such as CloudTrail or the provider equivalent.. Cloud control-plane audit logging (e.g., AWS CloudTrail, Azure Monitor, or GCP Cloud Audit Logs) captures all management-plane API calls—such as IAM role attachments, security group rule changes, and bucket policy modifications—as shown in the exhibit. This directly meets the requirement to track configuration changes across cloud resources, providing a tamper-proof audit trail for security and compliance.

Answer

Install a rootkit detector on each workload and ignore management-plane activity.

Answer

Capture only DNS traffic, because it reveals all admin changes indirectly.

Answer

Rely on manual change tickets in a spreadsheet because cloud platforms do not record useful logs.

Question 2

Based on the exhibit, which action best addresses both the unsanctioned software problem and the need for consistent endpoint configuration?

Exhibit:
Device group: Sales-Laptops
Baseline check:
- Approved browser: installed
- Approved EDR: installed
- Unapproved remote admin tool: detected on 14 endpoints
- Local administrator rights: granted to all users in group
- Patch compliance: 68%

Management wants to prevent unauthorized software from running and keep future builds consistent.

Accepted Answer

Deploy application allowlisting through centralized endpoint management and remove local administrator rights.. Application allowlisting (via AppLocker or Windows Defender Application Control) centrally enforces which software can run, directly addressing the unsanctioned remote admin tool. Removing local administrator rights prevents users from bypassing the allowlist or making unauthorized configuration changes, ensuring consistent endpoint builds and improving patch compliance by limiting user-driven modifications.

Answer

Keep users as local admins but require stronger email passwords for better overall security.

Answer

Disable the EDR agent during software installs to avoid false alerts from approved apps.

Answer

Store approved installers on a shared drive and let users choose what to install.

Question 3

An organization's file server contains sensitive HR data. The security team discovers that permissions on a confidential folder have been altered. Which of the following security controls would MOST likely help determine the account responsible for this change?

Accepted Answer

Audit logging. Audit logging is the correct answer because it records detailed information about who made changes to files and folders, including the account name, timestamp, and the specific permission alteration. By reviewing audit logs, the security team can trace the unauthorized permission change back to the responsible user account. This is a detective control that directly supports accountability and forensic investigation.

Answer

Data loss prevention (DLP) system

Answer

Mandatory access control (MAC)

Answer

Host-based intrusion prevention system (HIPS)

Question 4

A virtual file server was restored from last night’s backup. The service is online, but some finance users report missing spreadsheet changes and a few files show a 'recovered copy' timestamp. Which two checks should be completed before the team accepts the restore as successful? Select two.

Accepted Answer

Compare restored data against backup hashes or a manifest to verify that the copy is complete and uncorrupted.. Comparing restored data against backup hashes or a manifest ensures the data integrity and completeness of the restore process. Even though the file server is online, missing spreadsheet changes and 'recovered copy' timestamps suggest possible corruption or incomplete restoration. Verifying hashes (e.g., SHA-256) against a known-good manifest confirms that every file was restored without bit-rot or truncation, which is a standard post-restore validation step in backup and recovery procedures.

Answer

Assume the restore is acceptable because the file server is online and users can browse shares.

Answer

Delete the previous night’s backup so the team will not accidentally restore it again.

Answer

Expose the restored server directly to the internet so remote users can test it faster.

Question 5

A finance app uses the corporate IdP for authentication. A user who moved out of finance can still approve invoices until the browser session expires, and the app caches local roles. Which two changes best make access changes take effect faster without storing app passwords? Select two.

Accepted Answer

Shorten token and session lifetimes, and require reauthentication for high-risk actions.. Shortening token and session lifetimes reduces the window during which stale permissions remain active, and requiring reauthentication for high-risk actions (like approving invoices) ensures that the user's current authorization status is verified before sensitive operations. This directly addresses the problem of cached roles persisting beyond the user's actual group membership changes.

Answer

Increase password complexity but keep session duration unchanged.

Answer

Disable SSO and email one-time passwords for every login.

Answer

Keep long-lived sessions to reduce help desk tickets.

Question 6

Based on the exhibit, which document should be updated first to reflect the new ticketing platform while keeping approval requirements unchanged?

Accepted Answer

Procedure, because the step-by-step instructions and screenshots are now outdated.. The procedure document contains the step-by-step instructions, including screenshots and specific commands for the old ticketing platform. Since the new platform changes the user interface and workflow steps, the procedure must be updated first to ensure technicians can follow accurate instructions. Policies and standards define high-level rules and approval requirements, which remain unchanged, so they do not need immediate revision.

Answer

Policy, because every tool change requires rewriting the corporate mandate.

Answer

Standard, because the approval workflow and evidence rules are still the same.

Answer

Guideline, because optional content should always be revised before mandatory content.

Question 7

A security analyst is investigating a series of alerts from the web application firewall. Users are reporting that when they view a product review page on the company's e-commerce site, their browser automatically redirects to a malicious website. The analyst examines the database and finds that a product review submitted by a user contains a <script> tag that loads a JavaScript file from an external domain. Which type of attack has occurred?

Accepted Answer

Stored cross-site scripting (XSS). The attack is stored cross-site scripting (XSS) because the malicious <script> tag was permanently stored in the product review database. When any user views the product review page, the browser loads and executes the external JavaScript file from the attacker's domain, causing an automatic redirect to a malicious website. This matches the classic stored XSS pattern where payload persists in server-side storage and executes in the victim's browser context.

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Answer

Reflected cross-site scripting (XSS)

Question 8

During troubleshooting, several hosts in VLAN 20 lose access to the default gateway at random. Their ARP caches now map the gateway IP to a workstation MAC address, and traffic briefly flows through that workstation before timing out. What attack is most likely?

Accepted Answer

ARP poisoning, because false ARP replies are redirecting gateway traffic to another host.. The scenario describes classic ARP poisoning (also known as ARP spoofing). The attacker sends forged ARP replies to the hosts in VLAN 20, associating the gateway's IP address with the attacker's MAC address. This causes the hosts to forward traffic destined for the gateway to the attacker's workstation, where it is briefly forwarded (or dropped) before timing out, matching the symptoms of a man-in-the-middle attack via ARP cache corruption.

Answer

DNS poisoning, because the workstation name may be resolving to the wrong IP address.

Answer

Replay attack, because the attacker is reusing old network frames to confuse the hosts.

Answer

Denial of service, because traffic eventually times out and connectivity is lost.

Question 9

After several employees clicked on phishing emails, management wants to reduce future click rates and show measurable improvement across finance, HR, and executive assistants. Which control best meets that goal?

Accepted Answer

Use role-based security awareness training with phishing simulations and metrics tracking.. Role-based security awareness training with phishing simulations and metrics tracking directly addresses the human factor by tailoring content to specific job roles (finance, HR, executive assistants) and provides measurable improvement through simulation click-rate data. This approach aligns with the NIST SP 800-50 framework for continuous security awareness, enabling management to track reduction in click rates over time.

Answer

Send a one-time company-wide memo reminding users not to click suspicious links.

Answer

Disable all external email attachments for every department indefinitely.

Answer

Require employees to complete annual policy acknowledgment without testing.

Question 10

A records manager is preparing to delete old HR emails next week under the retention schedule. Legal notifies the team that those messages may be needed for an active investigation. What should the records manager do first?

Accepted Answer

Place the emails on legal hold and suspend normal deletion for those records.. When legal notifies that emails may be needed for an active investigation, the records manager must immediately suspend normal deletion and place a legal hold on those records. This preserves the data in its original state, preventing spoliation and ensuring compliance with e-discovery obligations. Deleting or moving the emails could destroy metadata or chain of custody, violating legal hold requirements.

Answer

Delete the emails on schedule and archive only the subject lines.

Answer

Move the emails to a shared folder so legal can review them later.

Answer

Compress the emails into an encrypted file and continue with deletion.

Question 11

Based on the exhibit, which social engineering attack is most likely?

Accepted Answer

Spear phishing, because the email is tailored to a specific employee and business context.. Spear phishing involves crafting a message that is personalized to a specific individual or role within an organization, often referencing internal processes or names to increase credibility. In the exhibit, the email is addressed to a specific employee and mentions a legitimate-sounding business context (e.g., an internal document or procedure), which is the hallmark of spear phishing rather than a generic blast.

Answer

Phishing, because the message is a broad email that tries to trick the recipient.

Answer

Vishing, because the attacker is using a phone call to pressure the victim.

Answer

Baiting, because the attacker is offering a document that the user wants to open.

Question 12

Based on the exhibit, which cloud service model best fits the application's operational and security requirements?

Accepted Answer

Platform as a Service (PaaS), because it offloads OS and runtime maintenance while preserving application control.. The exhibit shows an application that requires the organization to manage the application code and data while offloading the underlying OS, runtime, and middleware maintenance. Platform as a Service (PaaS) provides this exact split: the cloud provider handles the OS patches, runtime updates, and infrastructure scaling, while the organization retains full control over the application deployment and configuration. This matches the requirement of preserving application control without the overhead of managing the guest OS.

Answer

Infrastructure as a Service (IaaS), because it gives full control over the guest operating system.

Answer

Software as a Service (SaaS), because the organization would not need to maintain anything.

Answer

Colocation, because the team can place its own servers in a provider facility and manage everything directly.

Question 13

A financial institution updates its access control policy to require that two different system administrators must approve and execute any changes to the core transaction processing database. Which security principle is this practice primarily designed to enforce?

Accepted Answer

Separation of duties. Requiring two different system administrators to approve and execute changes to the core transaction processing database enforces separation of duties. This principle ensures that no single individual has the authority to perform both the approval and execution steps, reducing the risk of fraud, error, or unauthorized modifications. In a financial institution, this is critical for maintaining the integrity of transaction data and complying with regulatory standards like SOX or PCI DSS.

Answer

Defense in depth

Answer

Least privilege

Answer

Need to know

Question 14

A business-critical internal reporting portal is exposed to all employees. A scan finds a high-severity vulnerability, but the vendor says a fix will not be available for 30 days. The application is only used by finance once a month, and the business can tolerate a brief outage if needed. Which risk treatment is the BEST immediate action?

Accepted Answer

Apply compensating controls, such as restricting access and adding a temporary control, until the vendor patch is available.. Applying compensating controls—such as restricting access to only the finance team and implementing a temporary web application firewall (WAF) rule—immediately reduces the attack surface while the vendor develops a patch. This aligns with the risk treatment of mitigation, as it lowers the likelihood of exploitation without requiring a full fix. The business can tolerate a brief outage, so a temporary access control list (ACL) or IP whitelist is a practical, immediate measure.

Answer

Accept the risk because the application is used infrequently and the impact is limited.

Answer

Transfer the risk by purchasing cyber insurance for the application.

Answer

Avoid the risk by permanently decommissioning the reporting portal.

Question 15

A security team is defining the minimum approved configuration for all new Linux web servers. The document must require specific logging settings, approved packages, and disabled services, and administrators must check servers against it during audits. Which governance artifact best fits this need?

Accepted Answer

Baseline, because it defines the minimum approved configuration that systems should meet.. A baseline is the correct governance artifact because it defines the minimum approved configuration that systems must meet, including specific logging settings, approved packages, and disabled services. In the context of Linux web servers, a baseline ensures consistent security posture by providing a measurable standard that administrators can audit against, such as verifying that rsyslog is configured for remote logging, only packages like Apache or Nginx from approved repositories are installed, and services like Telnet or FTP are disabled. This aligns with the requirement for enforcement and auditability, unlike a guideline which is merely advisory.

Answer

Guideline, because it suggests recommended settings without requiring enforcement.

Answer

Policy, because it is the high-level statement of intent for the organization.

Answer

Procedure, because it explains the exact steps to install and configure each server.