SY0-701 Practice Test 28 — 15 Questions

Question 1

Based on the exhibit, which awareness action should the security manager prioritize next?

Accepted Answer

Launch role-based phishing training and reporting reinforcement for the highest-risk groups.. The exhibit shows that the highest-risk groups (e.g., finance, executives) have the highest phishing click rates. Option B is correct because role-based phishing training targets these specific users with simulated phishing campaigns and reporting reinforcement, which directly reduces the likelihood of successful social engineering attacks. This aligns with the principle of prioritizing remediation based on risk assessment data rather than blanket training.

Answer

Send the same annual awareness slide deck to everyone again without changing the content.

Answer

Block all external email so users cannot click suspicious messages.

Answer

Take no action because IT already reports suspicious messages well.

Question 2

Based on the exhibit, which data protection control best allows analysts to work with the records without exposing full card numbers?

Accepted Answer

Tokenize the card numbers and keep the token mapping in a secured vault.. Tokenization replaces sensitive card numbers with non-sensitive placeholders (tokens) that retain the format and length of the original data but have no exploitable value. The analytics team can work with the tokens for reporting and analysis, while the actual card numbers remain securely stored in a separate token vault, preventing exposure even if the analytics database is compromised.

Answer

Encrypt the entire analytics database and give the team the decryption key.

Answer

Hash the card numbers with SHA-256 so the analytics team can reverse them later if needed.

Answer

Delete all but the last four digits from the production database immediately.

Question 3

Based on the exhibit, which artifact is the strongest evidence that the firewall change was reviewed and approved before implementation?

Accepted Answer

The change request record with CAB approval timestamp and implementation time.. Option C is correct because the change request record with a CAB approval timestamp and implementation time provides a clear, auditable trail that the firewall change was formally reviewed and authorized by the Change Advisory Board before it was executed. This aligns with the change management process required for security program oversight, ensuring that changes are not implemented without proper governance.

Answer

The engineer's post-implementation email, because it confirms someone checked the change.

Answer

The firewall logs, because they show the rule was applied successfully on the device.

Answer

The vendor's maintenance notice, because it explains why the rule was needed.

Question 4

Based on the exhibit, which contract change would most directly reduce the organization's third-party response risk?

Accepted Answer

Add a breach notification timeframe and a right-to-review assurance clause in the contract.. Adding a breach notification timeframe and a right-to-review assurance clause directly reduces third-party response risk by ensuring the vendor must promptly report security incidents and allow the organization to audit their security posture. This contractual change enforces accountability and timely action, which is critical for minimizing the impact of a breach originating from the third party.

Answer

Ask the vendor to provide a color logo and updated marketing brochure for the pilot.

Answer

Allow the vendor to start first and decide later whether to add security terms.

Answer

Replace the pilot with a purely internal spreadsheet process to avoid any contract review.

Question 5

Based on the exhibit, which awareness control best addresses the observed failure pattern?

Accepted Answer

Run targeted vishing exercises and teach a callback verification procedure.. The exhibit shows a pattern where users are falling for phone-based social engineering (vishing), not email or general phishing. Option B directly addresses this by running targeted vishing exercises to simulate the real threat and teaching a callback verification procedure, which is a specific technical control to verify the identity of callers before taking action. This is the most effective awareness control because it trains users to recognize and respond to the exact attack vector observed.

Answer

Replace the phone-call simulation with longer monthly policy newsletters.

Answer

Disable MFA so users are not asked for one-time codes.

Answer

Tell users to ignore all requests from anyone outside the company.

Question 6

Based on the exhibit, which security principle should the team strengthen to reduce the chance that stolen credentials alone provide access to sensitive data?

Accepted Answer

Zero trust, because every request should be re-evaluated instead of relying on the earlier VPN login.. The exhibit shows a scenario where a VPN session grants persistent access to sensitive data without re-authentication. Zero trust is correct because it mandates continuous verification of every request, not just the initial VPN login, so stolen credentials alone would not provide ongoing access to sensitive data. This principle enforces micro-segmentation and per-request authorization, directly addressing the vulnerability of credential theft.

Answer

Least privilege, because the user should only have the minimum file permissions needed.

Answer

Need-to-know, because all finance data should be hidden from anyone outside the department.

Answer

Defense in depth, because multiple layers are always better than one control.

Question 7

Based on the exhibit, which finding is the best candidate for immediate remediation or emergency mitigation?

Accepted Answer

VPN-EDGE01, because a critical internet-facing RCE with public exploit code has the highest risk.. Option A is correct because VPN-EDGE01 is an internet-facing device with a critical remote code execution (RCE) vulnerability that has public exploit code available. This combination of high severity, network exposure, and weaponized exploit makes it the highest risk and most urgent for immediate remediation or emergency mitigation.

Answer

FILE-02, because file servers often affect many users and should always come before perimeter systems.

Answer

TEST-VM-17, because any high-severity issue deserves the fastest response regardless of exposure.

Answer

PRINTER-3F, because default credentials are the easiest issue to exploit and therefore the most dangerous.

Question 8

Based on the exhibit, which document should be updated first to reflect the new ticketing platform while keeping approval requirements unchanged?

Accepted Answer

Procedure, because the step-by-step instructions and screenshots are now outdated.. The procedure document contains the step-by-step instructions, including screenshots and specific commands for the old ticketing platform. Since the new platform changes the user interface and workflow steps, the procedure must be updated first to ensure technicians can follow accurate instructions. Policies and standards define high-level rules and approval requirements, which remain unchanged, so they do not need immediate revision.

Answer

Policy, because every tool change requires rewriting the corporate mandate.

Answer

Standard, because the approval workflow and evidence rules are still the same.

Answer

Guideline, because optional content should always be revised before mandatory content.

Question 9

Based on the exhibit, which security principle is the proposed access model most aligned with?

Accepted Answer

Zero trust, because access is continuously evaluated instead of trusted just because the device is on the VPN.. The proposed access model aligns with Zero Trust because it continuously evaluates access based on real-time conditions (e.g., device posture, user identity) rather than implicitly trusting the VPN connection. In Zero Trust, network location alone is insufficient for granting access; every request is authenticated and authorized regardless of the source. This contrasts with traditional perimeter-based models where VPN access implies trust.

Answer

Least privilege, because users are being limited to only the finance application they need.

Answer

Defense in depth, because the company is adding multiple security layers around the finance app.

Answer

Need-to-know, because users should only see the finance data required for their jobs.

Question 10

Before installing a vendor patch package on hundreds of endpoints, the security team wants to confirm the file was published by the vendor and was not altered during download. Which two verification steps should the team perform? Select two.

Accepted Answer

Verify the package signature with the vendor's public key.. Option A is correct because verifying the package signature with the vendor's public key confirms the package was cryptographically signed by the vendor, proving its authenticity and integrity. This process uses asymmetric cryptography where the vendor signs the package with their private key, and the security team uses the corresponding public key to validate that signature. It ensures the file was not tampered with after signing and that it originated from the claimed vendor.

Answer

Decrypt the package with the vendor's private key before installation.

Answer

Rotate the organization's internal encryption key before downloading.

Answer

Check only the file timestamp and size on disk.

Question 11

Based on the exhibit, which document type should the organization update if it wants the listed endpoint settings to be mandatory baseline requirements?

Accepted Answer

Standard, because it defines mandatory minimum settings that all systems must meet.. A standard is the correct document type because it defines mandatory, minimum-security configuration requirements that all systems must meet, such as specific endpoint settings. Unlike a policy, which states broad intent, a standard provides the enforceable baseline that ensures consistent security posture across the organization.

Answer

Policy, because it defines the organization's broad security intent and direction.

Answer

Procedure, because it provides the exact steps administrators follow to configure the setting.

Answer

Guideline, because it is the least restrictive document for endpoint protection.

Question 12

Before applying a critical patch to a production application server, which action best reduces the risk of extended downtime if the patch fails?

Accepted Answer

Create a verified backup or rollback plan before making the change.. Creating a verified backup or rollback plan before applying a critical patch ensures that if the patch causes unexpected failures or incompatibilities, the system can be restored to its previous stable state quickly. This directly reduces the risk of extended downtime by providing a reliable recovery path, which is a fundamental principle of change management and risk mitigation in production environments.

Answer

Apply the patch immediately without testing so the system is protected sooner.

Answer

Disable logging so the patch process uses fewer resources.

Answer

Postpone the patch indefinitely until all business users request it.

Question 13

Based on the exhibit, which principle should the organization enforce to reduce fraud risk while keeping the business process functional?

Accepted Answer

Separation of duties, because no single user should be able to complete every high-risk finance step alone.. Separation of duties (SoD) is the correct principle because it prevents any single employee from completing all steps in a high-risk financial transaction alone. By requiring at least two people to authorize and execute critical actions—such as initiating a payment and approving it—the organization reduces the risk of internal fraud without blocking the business workflow. This directly addresses the scenario where a single user could otherwise create, approve, and release a fraudulent payment.

Answer

Least privilege, because each employee should only have the fewest permissions needed for the shared account.

Answer

Need-to-know, because only employees with confidential financial data should see the workflow details.

Answer

Defense in depth, because the organization should add more security layers around the finance process.

Question 14

Based on the exhibit, which indicator should the security team prioritize for endpoint detection and hunting?

The attacker rotates infrastructure frequently, but one artifact has remained consistent across recent investigations.

Accepted Answer

The unique mutex name created by the malware on infected endpoints. Option B is correct because a mutex (mutual exclusion object) is a unique artifact created by malware to prevent multiple instances of itself from running on the same endpoint. Since the attacker rotates infrastructure frequently (IPs, domains, filenames), the consistent mutex name provides a stable indicator of compromise (IoC) that can be used for endpoint detection and hunting across different incidents. This makes it a reliable signature for identifying the same malware family or variant even when other indicators change.

Answer

The current source IP addresses hosting the payloads

Answer

The exact wording of the latest phishing email lure

Answer

The filename of the attachment used in the most recent incident

Question 15

Based on the exhibit, which malware type best explains the behavior?

Accepted Answer

Rootkit. A rootkit is designed to hide its presence and the presence of other malware by modifying the operating system's kernel or system calls, allowing it to evade detection by security tools. The exhibit likely shows behavior such as file hiding, process concealment, or system call interception, which are hallmarks of rootkit activity. This aligns with the SY0-701 objective on understanding malware types and their characteristics.

Answer

Trojan

Answer

Logic bomb

Answer

Spyware

SY0-701 Practice Test 28 — 15 Questions

Exhibit

SY0-701 Practice Test 28 — 15 Questions

Exhibit