SY0-701 Practice Test 29 — 15 Questions

Question 1

After restoring a virtual file server from backup, users can log in and browse shares, but finance says the last day's edits are missing. Which two steps should the administrator take before declaring recovery complete? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify the restore point meets the required recovery point objective and the business expects the data loss window.. The Recovery Point Objective (RPO) defines the maximum acceptable data loss. If the restore point is from before the last day's edits, the administrator must confirm that this data loss window is acceptable to the business. Option B is correct because application-consistent backups often require replaying transaction logs (e.g., SQL Server VSS writer logs) to bring the database to the latest committed state; skipping this step leaves the data incomplete.

Answer

Rebuild the server from scratch without checking the backup timestamp.

Answer

Disable all backup jobs until the next maintenance window.

Answer

Change the DNS records so users point to a different server name.

Question 2

A company is implementing network segmentation to isolate the guest wireless network from the internal corporate network. Which of the following technologies is most appropriate to enforce this separation at Layer 2?

Accepted Answer

VLANs. VLANs (Virtual Local Area Networks) are the correct technology because they operate at Layer 2 (Data Link layer) of the OSI model, allowing network administrators to logically segment a physical switch into multiple isolated broadcast domains. By assigning the guest wireless network to a separate VLAN (e.g., VLAN 100) and the internal corporate network to another (e.g., VLAN 10), traffic between them is blocked at Layer 2 unless explicitly routed through a Layer 3 device with appropriate firewall rules. This directly enforces separation without requiring additional hardware, making VLANs the most appropriate and efficient choice for isolating guest traffic at Layer 2.

Answer

ACLs

Answer

DMZ

Answer

VPN

Question 3

Based on the exhibit, what is the most important next IR action?

Accepted Answer

Revoke active sessions and OAuth consent grants for the account.. The exhibit shows a compromised account with a suspicious inbox rule forwarding emails externally. The most critical next step is to revoke active sessions and OAuth consent grants to immediately terminate the attacker's access and prevent further data exfiltration, as changing the password alone does not invalidate existing OAuth tokens or active sessions.

Answer

Change the password again and monitor the mailbox for a few days.

Answer

Restore the deleted inbox rule from backup to preserve evidence.

Answer

Close the incident because the forwarding rule was removed.

Question 4

A customer service application shows the same session ID being used from two countries within five minutes. The legitimate user did not report a password change, but an order shipping address was modified successfully without reauthentication. What attack pattern is most likely?

Accepted Answer

Session abuse, because a stolen or replayed session token allowed unauthorized actions.. The simultaneous use of the same session ID from two different countries within five minutes, combined with a successful address change without reauthentication, indicates that an attacker has obtained and reused the legitimate user's session token. This is session abuse, where the attacker leverages a stolen or replayed session token to perform unauthorized actions, bypassing the need for credentials or reauthentication.

Answer

Broken authentication, because the application failed to verify the user again.

Answer

Cross-site request forgery, because the attacker may have tricked the browser into sending a request.

Answer

Credential stuffing, because the account was likely accessed using reused passwords.

Question 5

A Linux operations team has a standing need to restart services and edit protected configuration files on production servers, but administrators should not keep root privileges all day. Every elevation must be approved through a ticket and logged centrally. Which solution best meets this requirement?

Accepted Answer

Use privileged access management with just-in-time elevation and session logging. Privileged Access Management (PAM) with just-in-time (JIT) elevation and session logging meets the requirement because it grants temporary, request-based root privileges that are automatically revoked after the task, and it centrally logs all commands executed during the elevated session. This ensures every elevation is approved via a ticket and auditable, without administrators retaining permanent root access.

Answer

Create one shared root password and rotate it weekly

Answer

Assign each administrator the server local administrator role permanently

Answer

Use single sign-on so administrators only authenticate once each morning

Question 6

Based on the exhibit, what should the organization do before approving this SaaS vendor to process employee HR records?

Accepted Answer

Require a security addendum and evidence review before onboarding, including notification timelines, deletion terms, subprocessors, and independent testing.. Before processing sensitive employee HR records, the organization must ensure the SaaS vendor meets security and compliance requirements. This includes reviewing contractual terms like notification timelines, data deletion policies, subprocessor usage, and independent testing evidence (e.g., SOC 2 Type II or ISO 27001 certification). Without these, the organization cannot verify the vendor's security posture or contractual obligations, which is critical for protecting PII and meeting regulatory requirements like GDPR or HIPAA.

Answer

Approve the vendor now because admin MFA is enabled and the deadline is urgent.

Answer

Request a formal risk acceptance memo and sign the contract without additional review.

Answer

Move the HR data into the vendor environment first and complete the review after production cutover.

Question 7

Based on the exhibit, which cloud deployment choice best satisfies the workload requirements?

Exhibit:
Workload requirements:
- Processes regulated customer records
- Should not share underlying compute with other tenants if avoidable
- Team wants provider-managed hardware maintenance
- Application will run in a public cloud

Which deployment choice is the best fit?

Accepted Answer

Public cloud with a dedicated host or equivalent single-tenant compute placement.. A dedicated host or single-tenant compute placement in a public cloud ensures the workload does not share underlying physical hardware with other tenants, meeting the 'should not share underlying compute' requirement. It also provides provider-managed hardware maintenance and runs in a public cloud, aligning with all stated workload requirements for processing regulated customer records.

Answer

Shared public tenancy on standard virtual machines.

Answer

Community cloud shared with other regulated organizations.

Answer

On-premises private cloud with company-owned servers and full hardware management.

Question 8

After a suspected compromise, a server's local tools report sshd listening on port 22, but netstat and the EDR console fail to show the process that owns the socket. A reboot does not remove the issue, and firmware integrity checks pass. Which malware type is most likely installed?

Accepted Answer

Rootkit, because it is designed to hide processes, drivers, or sockets from normal security tools.. A rootkit is specifically designed to hide its presence from the operating system and security tools by intercepting system calls (e.g., those used by netstat and EDR) to conceal processes, drivers, and network sockets. The persistence after reboot and clean firmware integrity checks indicate the rootkit is installed at the kernel or boot level, bypassing user-mode detection.

Answer

Spyware, because hidden software is often used to collect credentials and data.

Answer

Ransomware, because the server remains operational while still hiding evidence.

Answer

Logic bomb, because the issue persists after reboot and could trigger later.

Question 9

A security team can patch only one system today. Which asset should be remediated first?

Accepted Answer

An internet-facing application server with a critical vulnerability and a known exploit. An internet-facing application server with a critical vulnerability and a known exploit represents the highest risk: it is exposed to external threats, the vulnerability is critical, and a known exploit means attackers can reliably compromise it. Patching this system first reduces the likelihood of a remote breach that could lead to data exfiltration or service disruption, aligning with the principle of prioritizing assets with the greatest attack surface and exploitability.

Answer

An internal print server with a high-severity finding and no direct user access

Answer

A lab workstation with a critical finding and no sensitive data

Answer

A user laptop with a medium-severity issue that requires local access

Question 10

A legacy finance application cannot yet support multifactor authentication. The security team still wants administrators to use separate privileged accounts, receive elevated access only when a ticket is approved, and have those privileges removed automatically after the maintenance window ends. Which solution best fits?

Accepted Answer

Use privileged access management with separate admin accounts and time-bound elevation approvals.. Privileged Access Management (PAM) solutions are specifically designed to enforce just-in-time (JIT) privileged access. They allow administrators to request time-bound elevation of rights for a specific maintenance window, with automatic revocation after the window expires. This directly meets the requirements of separate privileged accounts, ticket-based approval, and automatic removal of privileges, even when the legacy application itself cannot support MFA.

Answer

Create one shared administrator account and rotate its password every week.

Answer

Assign permanent administrator rights through role-based access control and rely on audit logs afterward.

Answer

Move the application behind a federation service so all users can sign in with a single password.

Question 11

A security analyst is responding to a potential ransomware incident on a Windows server that is still running. The analyst needs to preserve forensic evidence for analysis. Which of the following actions should the analyst perform first, based on the order of volatility?

Accepted Answer

Capture a full memory dump of the server. The order of volatility dictates that the most volatile data (memory) must be captured first because it contains critical evidence like running processes, network connections, and encryption keys that will be lost when the system is powered off. A full memory dump preserves this volatile data before any other actions that could alter the system state.

Answer

Shut down the server to prevent further damage

Answer

Create a forensic disk image of the hard drive

Answer

Run a full antivirus scan on the system

Question 12

A security team stores employee passwords in a database. Which method best protects the passwords if the database is stolen?

Accepted Answer

Hash the passwords with a unique salt for each account.. Hashing with a unique salt per account ensures that even if two users have the same password, their hashes will differ, and precomputed rainbow table attacks are rendered ineffective. The salt is stored alongside the hash, but the one-way nature of the hash function means an attacker cannot reverse the hash to recover the original password without performing an expensive brute-force search for each salted hash individually.

Answer

Store the passwords in plain text so users can recover them easily.

Answer

Encrypt the passwords and keep the decryption key in the same database.

Answer

Compress the passwords before storing them to make them smaller.

Question 13

A security analyst receives an alert that a user clicked a link in a phishing email and entered their corporate credentials on a fake login page. Which of the following should the analyst do FIRST to minimize further damage?

Accepted Answer

Disable the user's account and block the compromised system from the network. Immediately disabling the user's account and blocking the compromised system from the network stops the attacker from using the stolen credentials to authenticate to corporate resources, such as email, VPN, or file shares. This containment step is the highest priority in incident response to prevent lateral movement and further compromise, as the attacker already has valid credentials and could be actively using them.

Answer

Run a full antivirus scan on the user's workstation

Answer

Reset the user's password and force re-authentication

Answer

Contact law enforcement and report the phishing site

Question 14

A finance team receives emails that appear to come from the CEO's assistant and ask them to review a document. Several users entered their passwords on a fake login page, and the attackers then signed in from a new country using the same credentials. Which control most directly reduces successful account takeover if a password is stolen?

Accepted Answer

Use phishing-resistant MFA such as FIDO2 or WebAuthn.. Phishing-resistant MFA, such as FIDO2 or WebAuthn, directly prevents account takeover even when a password is stolen because these methods use public-key cryptography and origin-bound credentials. The fake login page cannot intercept the private key or replay the authentication, so the attacker cannot sign in from a new country despite having the password.

Answer

Require password changes every 30 days for all users.

Answer

Turn off all external email to eliminate the chance of future messages.

Answer

Use single sign-on without MFA so users authenticate only once.

Question 15

EDR reports that a workstation launched PowerShell from a word processor, created a scheduled task named WinUpdateSvc, and began making repeated HTTPS connections to a rare external domain. The user is still logged in to several cloud apps. Which two response actions are best to initiate from the EDR console? Select two.

Accepted Answer

Isolate the endpoint from the network to stop further communication and lateral movement.. Isolating the endpoint from the network immediately stops the active HTTPS command-and-control (C2) communication and prevents lateral movement to other systems. Given the suspicious chain (word processor spawning PowerShell, creating a scheduled task, and connecting to a rare external domain), this is a strong indicator of a malware infection or unauthorized remote access. Isolation preserves the forensic state while cutting off the attacker's access.

Answer

Delete the scheduled task immediately so the host returns to normal operation.

Answer

Reimage the workstation from the golden image as the first response.

Answer

Ignore the alert because the PowerShell binary is built into Windows and therefore safe.