SY0-701 Practice Test 29 — 15 Questions

Question 1

A security manager is preparing a quarterly report for the board of directors on the effectiveness of the organization's security program. The manager has access to detailed technical data, including firewall log statistics, patch compliance percentages, and number of phishing simulation clicks. Which of the following would be the most appropriate way to present this information to the board?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Show a trend chart of the number of security incidents categorized by severity, along with average time to resolve.. It presents security program effectiveness in a business-relevant format: trend charts of incidents by severity and resolution times directly address risk reduction and operational efficiency, which board members need for strategic oversight. Unlike raw technical data, this aggregated, visualized information enables non-technical stakeholders to assess whether the security program is improving over time.

Answer

Provide a list of all firewall rule changes made during the quarter.

Answer

Include raw logs of the top 10 most frequent alerts from the SIEM.

Answer

Describe the technical architecture of the intrusion prevention system.

Question 2

A small company is publishing an internal website to the internet. The security team wants the web server reachable from the internet while keeping the database and file share isolated from direct internet access. Which design is best?

Accepted Answer

Place the web server in a DMZ and keep the database and file share on a private internal subnet.. It implements a DMZ architecture where the web server is placed in a publicly accessible network segment, while the database and file share reside on a private internal subnet. This design ensures that even if the web server is compromised, an attacker cannot directly access the internal resources because firewall rules restrict inbound traffic to only the DMZ and block any initiated connections from the DMZ to the internal network. This follows the principle of defense in depth and network segmentation as recommended by CompTIA for securing multi-tier applications.

Answer

Place the web server and database on the same flat internal network behind the firewall.

Answer

Place the database in the DMZ and keep the web server on the internal user VLAN.

Answer

Use a VPN for all users and keep every server on the same subnet.

Question 3

Based on the exhibit, what is the best governance action before the sales team uses the legacy portal without MFA?

Accepted Answer

Create a formal time-bound exception with compensating controls, approval, and an expiration date.. Governance requires that any exception to a security policy (such as bypassing MFA) must be formally documented, approved by management, time-bound, and include compensating controls to mitigate risk. In this scenario, the legacy portal lacks MFA support, so a formal exception with an expiration date ensures the risk is tracked and re-evaluated, rather than permanently weakening security posture.

Answer

Update the policy immediately to allow password-only access for all legacy systems.

Answer

Have the help desk approve the request informally in the ticket and proceed without further documentation.

Answer

Ignore the MFA requirement because the portal is owned by a trusted partner.

Question 4

Based on the exhibit, which attack is most likely being attempted against the application?

Accepted Answer

Server-side request forgery, because the application is being tricked into making internal requests on the attacker's behalf.. The exhibit shows an attacker manipulating a URL parameter (e.g., `?url=http://169.254.169.254/latest/meta-data/`) to make the application fetch an internal resource. This is a classic Server-Side Request Forgery (SSRF) attack, where the application is tricked into making requests to internal services (like cloud metadata endpoints) on the attacker's behalf, bypassing network segmentation.

Answer

Cross-site scripting, because the attacker is trying to inject script into the victim's browser session.

Answer

Cross-site request forgery, because the attacker is forcing an authenticated user to submit an unwanted request.

Answer

SQL injection, because the attacker is manipulating a query parameter to expose backend data.

Question 5

Based on the exhibit, which identity architecture change best addresses the repeated password resets and delayed offboarding across the company's SaaS applications?

Exhibit:
- SaaS A uses local user accounts
- SaaS B uses local user accounts
- SaaS C supports SAML and automated provisioning
- Help desk reports 120 password reset tickets per month
- Former employees can remain active in two apps for up to 24 hours after termination

Management wants one sign-in and faster deprovisioning.

Accepted Answer

Implement federated SSO with the enterprise identity provider and automated provisioning for SaaS users.. Implementing federated SSO with the enterprise identity provider (IdP) centralizes authentication, allowing users to sign in once. Combined with automated provisioning (SCIM), it enables near-instant deprovisioning when an employee is terminated, eliminating the 24-hour delay and reducing password reset tickets by removing the need for local account management.

Answer

Create one shared account for each application and store the passwords in a vault.

Answer

Keep local accounts in every SaaS app and reset passwords whenever staff change roles.

Answer

Put the SaaS apps behind a network firewall and use source IP filtering instead of identity.

Question 6

Based on the exhibit, which document type should be updated to make the approval and retention requirements mandatory across the organization?

Accepted Answer

Policy, because it sets mandatory rules that apply organization-wide.. A policy document is the correct choice because it establishes mandatory rules that apply organization-wide, making approval and retention requirements enforceable across all departments. Unlike guidelines or procedures, policies are authoritative and require compliance, which is essential for standardizing security controls like data retention periods.

Answer

Guideline, because it provides flexible advice without requiring enforcement.

Answer

Procedure, because it lists the exact steps the help desk follows.

Answer

Architecture diagram, because it shows where documents are stored.

Question 7

Based on the exhibit, what is the best change to improve accountability without removing emergency access?

Accepted Answer

Require named accounts with role-based elevation through a privileged access workflow.. Implementing named accounts with role-based elevation through a privileged access workflow (PAW) ensures each administrator has a unique identity for auditing, while still allowing temporary privilege escalation for emergency tasks. This directly improves accountability by tying actions to specific users, unlike shared accounts which obscure individual responsibility. The workflow maintains emergency access by granting time-limited elevated permissions through an approval process, avoiding permanent standing privileges.

Answer

Keep the shared account and add more logging of the shared password.

Answer

Remove all command logging to protect administrator privacy.

Answer

Use a single shared account with a longer password and monthly rotation.

Question 8

Based on the exhibit, which data protection control best allows analysts to work with the records without exposing full card numbers?

Accepted Answer

Tokenize the card numbers and keep the token mapping in a secured vault.. Tokenization replaces sensitive card numbers with non-sensitive placeholders (tokens) that retain the format and length of the original data but have no exploitable value. The analytics team can work with the tokens for reporting and analysis, while the actual card numbers remain securely stored in a separate token vault, preventing exposure even if the analytics database is compromised.

Answer

Encrypt the entire analytics database and give the team the decryption key.

Answer

Hash the card numbers with SHA-256 so the analytics team can reverse them later if needed.

Answer

Delete all but the last four digits from the production database immediately.

Question 9

After restoring a virtual file server from backup, users can log in and browse shares, but finance says the last day's edits are missing. Which two steps should the administrator take before declaring recovery complete? Select two.

Accepted Answer

Verify the restore point meets the required recovery point objective and the business expects the data loss window.. The Recovery Point Objective (RPO) defines the maximum acceptable data loss. If the restore point is from before the last day's edits, the administrator must confirm that this data loss window is acceptable to the business. Option B is correct because application-consistent backups often require replaying transaction logs (e.g., SQL Server VSS writer logs) to bring the database to the latest committed state; skipping this step leaves the data incomplete.

Answer

Rebuild the server from scratch without checking the backup timestamp.

Answer

Disable all backup jobs until the next maintenance window.

Answer

Change the DNS records so users point to a different server name.

Question 10

A company is implementing network segmentation to isolate the guest wireless network from the internal corporate network. Which of the following technologies is most appropriate to enforce this separation at Layer 2?

Accepted Answer

VLANs. VLANs (Virtual Local Area Networks) are the correct technology because they operate at Layer 2 (Data Link layer) of the OSI model, allowing network administrators to logically segment a physical switch into multiple isolated broadcast domains. By assigning the guest wireless network to a separate VLAN (e.g., VLAN 100) and the internal corporate network to another (e.g., VLAN 10), traffic between them is blocked at Layer 2 unless explicitly routed through a Layer 3 device with appropriate firewall rules. This directly enforces separation without requiring additional hardware, making VLANs the most appropriate and efficient choice for isolating guest traffic at Layer 2.

Answer

ACLs

Answer

DMZ

Answer

VPN

Question 11

Based on the exhibit, what is the most important next IR action?

Accepted Answer

Revoke active sessions and OAuth consent grants for the account.. The exhibit shows a compromised account with a suspicious inbox rule forwarding emails externally. The most critical next step is to revoke active sessions and OAuth consent grants to immediately terminate the attacker's access and prevent further data exfiltration, as changing the password alone does not invalidate existing OAuth tokens or active sessions.

Answer

Change the password again and monitor the mailbox for a few days.

Answer

Restore the deleted inbox rule from backup to preserve evidence.

Answer

Close the incident because the forwarding rule was removed.

Question 12

A customer service application shows the same session ID being used from two countries within five minutes. The legitimate user did not report a password change, but an order shipping address was modified successfully without reauthentication. What attack pattern is most likely?

Accepted Answer

Session abuse, because a stolen or replayed session token allowed unauthorized actions.. The simultaneous use of the same session ID from two different countries within five minutes, combined with a successful address change without reauthentication, indicates that an attacker has obtained and reused the legitimate user's session token. This is session abuse, where the attacker leverages a stolen or replayed session token to perform unauthorized actions, bypassing the need for credentials or reauthentication.

Answer

Broken authentication, because the application failed to verify the user again.

Answer

Cross-site request forgery, because the attacker may have tricked the browser into sending a request.

Answer

Credential stuffing, because the account was likely accessed using reused passwords.

Question 13

A Linux operations team has a standing need to restart services and edit protected configuration files on production servers, but administrators should not keep root privileges all day. Every elevation must be approved through a ticket and logged centrally. Which solution best meets this requirement?

Accepted Answer

Use privileged access management with just-in-time elevation and session logging. Privileged Access Management (PAM) with just-in-time (JIT) elevation and session logging meets the requirement because it grants temporary, request-based root privileges that are automatically revoked after the task, and it centrally logs all commands executed during the elevated session. This ensures every elevation is approved via a ticket and auditable, without administrators retaining permanent root access.

Answer

Create one shared root password and rotate it weekly

Answer

Assign each administrator the server local administrator role permanently

Answer

Use single sign-on so administrators only authenticate once each morning

Question 14

Based on the exhibit, what should the organization do before approving this SaaS vendor to process employee HR records?

Accepted Answer

Require a security addendum and evidence review before onboarding, including notification timelines, deletion terms, subprocessors, and independent testing.. Before processing sensitive employee HR records, the organization must ensure the SaaS vendor meets security and compliance requirements. This includes reviewing contractual terms like notification timelines, data deletion policies, subprocessor usage, and independent testing evidence (e.g., SOC 2 Type II or ISO 27001 certification). Without these, the organization cannot verify the vendor's security posture or contractual obligations, which is critical for protecting PII and meeting regulatory requirements like GDPR or HIPAA.

Answer

Approve the vendor now because admin MFA is enabled and the deadline is urgent.

Answer

Request a formal risk acceptance memo and sign the contract without additional review.

Answer

Move the HR data into the vendor environment first and complete the review after production cutover.

Question 15

Based on the exhibit, which cloud deployment choice best satisfies the workload requirements?

Exhibit:
Workload requirements:
- Processes regulated customer records
- Should not share underlying compute with other tenants if avoidable
- Team wants provider-managed hardware maintenance
- Application will run in a public cloud

Which deployment choice is the best fit?

Accepted Answer

Public cloud with a dedicated host or equivalent single-tenant compute placement.. A dedicated host or single-tenant compute placement in a public cloud ensures the workload does not share underlying physical hardware with other tenants, meeting the 'should not share underlying compute' requirement. It also provides provider-managed hardware maintenance and runs in a public cloud, aligning with all stated workload requirements for processing regulated customer records.

Answer

Shared public tenancy on standard virtual machines.

Answer

Community cloud shared with other regulated organizations.

Answer

On-premises private cloud with company-owned servers and full hardware management.