SY0-701 Practice Test 29 — 15 Questions

Question 1

Based on the exhibit, which principle is most directly being violated by the current share permissions?

Accepted Answer

Need-to-know, because only the people working on valuation models should access them.. The exhibit shows share permissions granting 'Finance Dept' full control over a folder containing valuation models. The need-to-know principle restricts access to only those individuals who require the information to perform their job functions. Since not all Finance Dept members work on valuation models, granting the entire department access violates need-to-know, as only the specific users building those models should have access.

Answer

Least privilege, because the broad Finance Dept access exceeds what many users require.

Answer

Zero trust, because the share should refuse access until every file request is reauthenticated.

Answer

Defense in depth, because the folder should have several separate layers of encryption.

Question 2

Based on the exhibit, which logging capability should be enabled first to create an audit trail for cloud administration changes?

Exhibit:
2026-04-25 09:14:03  iam:AttachRolePolicy  user=alice
2026-04-25 09:15:10  ec2:AuthorizeSecurityGroupIngress  user=alice
2026-04-25 09:16:22  s3:PutBucketPolicy  user=alice

Requirement:
Security wants to track management-plane API calls and configuration changes across cloud resources.

Accepted Answer

Enable cloud control-plane audit logging such as CloudTrail or the provider equivalent.. Option A is correct because cloud control-plane audit logging (e.g., AWS CloudTrail, Azure Monitor, or GCP Cloud Audit Logs) captures all management-plane API calls—such as IAM role attachments, security group rule changes, and bucket policy modifications—as shown in the exhibit. This directly meets the requirement to track configuration changes across cloud resources, providing a tamper-proof audit trail for security and compliance.

Answer

Install a rootkit detector on each workload and ignore management-plane activity.

Answer

Capture only DNS traffic, because it reveals all admin changes indirectly.

Answer

Rely on manual change tickets in a spreadsheet because cloud platforms do not record useful logs.

Question 3

Based on the exhibit, which system should be restored first after a total site outage?

Accepted Answer

Payroll, because it has the shortest maximum tolerable downtime and the strongest compliance impact.. Payroll should be restored first because it has the shortest maximum tolerable downtime (MTD) and the strongest compliance impact. In disaster recovery, systems with the lowest MTD must be prioritized to avoid exceeding the recovery time objective (RTO), and compliance-driven systems like payroll often carry legal or regulatory penalties for extended outages.

Answer

Customer portal, because it produces the largest daily revenue loss and has the shortest RPO.

Answer

Email, because restoring communication always takes precedence over all other services.

Answer

Dev test lab, because lower business impact means it is easiest to restore first.

Question 4

Based on the exhibit, which security principle does the organization appear to be using most clearly?

Accepted Answer

Defense in depth, because several different controls stop or limit the attack at different stages.. The exhibit shows multiple security controls—an email filter blocking the attachment, a web filter blocking the download link, and an endpoint detection and response (EDR) tool blocking execution—each acting at a different stage of the attack chain. This layered approach, where no single control is relied upon to stop the threat, is the hallmark of defense in depth. The correct answer is B because the scenario clearly demonstrates overlapping controls that provide redundancy and mitigate risk at various points.

Answer

Zero trust, because all access is denied until a user proves identity again.

Answer

Least privilege, because the attachment was blocked from having administrator rights.

Answer

Need-to-know, because only the security team should be aware of the incident.

Question 5

During a conference, several employees connect to a wireless network named the same as the hotel's guest Wi-Fi. Shortly after connecting, they receive certificate warnings when accessing the company portal, and packet capture shows a nearby laptop advertising the same SSID and relaying traffic. What type of attack is most likely?

Accepted Answer

Rogue access point or evil twin attack, because a fake wireless network impersonates a legitimate one.. The attack described is an evil twin (a type of rogue access point) because the attacker sets up a laptop broadcasting the same SSID as the hotel's legitimate guest Wi-Fi. When employees connect to this fake network, the attacker can intercept traffic and present a fraudulent certificate for the company portal, triggering certificate warnings. The packet capture confirming the laptop is relaying traffic proves it is acting as a man-in-the-middle, not merely a passive listener.

Answer

Replay attack, because previously captured wireless frames are being resent to the network.

Answer

DNS poisoning, because users are being sent to the wrong website through altered name resolution.

Answer

Denial of service, because users are simply unable to connect reliably.

Question 6

During a workstation review, analysts find a process injecting into explorer.exe and reading keyboard and clipboard events. They also see repeated outbound HTTPS beacons to a domain registered two days ago. The host is not renaming files or displaying a ransom note. Which two findings are most consistent with spyware? Select two.

Accepted Answer

A process injects into explorer.exe and monitors keyboard and clipboard activity.. Option A is correct because process injection into a trusted system process like explorer.exe, combined with monitoring keyboard and clipboard events, is a classic spyware technique. Spyware aims to covertly capture sensitive user input (keystrokes and clipboard data) for exfiltration, without causing immediate system damage or displaying a ransom note.

Answer

User files are renamed with a new extension and a ransom note appears.

Answer

CPU usage spikes only during a scheduled operating system update.

Answer

The browser certificate store was refreshed after applying a patch.

Question 7

During malware containment, an analyst needs to preserve transient information from a compromised Windows workstation that is still running. Which action is MOST appropriate before shutdown or imaging?

Accepted Answer

Capture memory and live process information with approved response tools. Option A is correct because transient information such as running processes, network connections, and memory-resident malware is lost when the system is powered off. Capturing memory and live process data with approved forensic tools (e.g., FTK Imager, DumpIt, or WinPmem) preserves volatile evidence critical for incident analysis and attribution, in accordance with the order of volatility (RFC 3227).

Answer

Immediately unplug the workstation and carry it to the evidence room

Answer

Run a full antivirus scan to clean the machine before analysis

Answer

Clear the event logs so the malicious activity is easier to isolate

Question 8

EDR flags a word processor that launched encoded PowerShell and then made an outbound HTTPS connection to a rare domain. Which two actions should the analyst take first from the EDR console? Select two.

Accepted Answer

Isolate the endpoint from the network to stop further communication and lateral movement.. Option A is correct because isolating the endpoint from the network immediately stops the outbound HTTPS connection to the rare domain, preventing data exfiltration and blocking potential lateral movement. This is a critical first step in containment, as the encoded PowerShell and rare domain strongly suggest a malicious payload or C2 communication.

Answer

Uninstall the word processor immediately because it is the process that launched PowerShell.

Answer

Reboot the laptop right away to clear the encoded PowerShell process from memory.

Answer

Whitelist the rare domain temporarily to see whether the connection is business-related.

Question 9

During an incident, a server administrator needs elevated access to production logs for exactly two hours after manager approval. The organization does not want standing privileged accounts. Which solution is the best fit?

Accepted Answer

Use just-in-time privileged access through a privileged access management workflow.. Just-in-time (JIT) privileged access through a Privileged Access Management (PAM) workflow is the best fit because it grants the administrator elevated permissions for exactly two hours, then automatically revokes them. This aligns with the requirement for time-limited access without maintaining standing privileged accounts, reducing the attack surface and ensuring compliance with the principle of least privilege.

Answer

Add the administrator to a permanent domain admin group so access is always available.

Answer

Create a shared administrator account for the incident team and change the password afterward.

Answer

Grant access by sending the administrator a VPN profile with broader network reach.

Question 10

During a tabletop exercise, the team realizes no one has a list of who to notify if the online ordering system goes down. Which continuity planning element is missing?

Accepted Answer

Communication plan, because it defines who must be contacted and how.. A communication plan is the missing continuity planning element because it specifically defines the stakeholders who must be notified during an outage (e.g., internal teams, vendors, customers) and the methods of contact (e.g., email, SMS, phone tree). Without this plan, the team cannot execute the notification procedures required by the business continuity plan (BCP) to coordinate response and recovery efforts for the online ordering system.

Answer

Data retention schedule, because it defines how long records are kept.

Answer

Asset inventory, because it lists all hardware and software in use.

Answer

Network segmentation, because it separates sensitive systems from user networks.

Question 11

Before approving a new payroll SaaS provider, the security team wants independent evidence that the vendor's controls operated effectively during the last year and wants the contract to clearly define security responsibilities. Which two items should they request or review? Select two.

Accepted Answer

A SOC 2 Type II report. A SOC 2 Type II report provides independent, audited evidence that a vendor's controls (e.g., security, availability, confidentiality) were operating effectively over a specified period (typically 6–12 months). This directly meets the requirement for independent evidence of control effectiveness over the last year, unlike a point-in-time assessment.

Answer

A sales presentation from the vendor account team

Answer

The vendor's public blog posts

Answer

A screenshot of the login page

Question 12

EDR alerts show a finance laptop spawning an unsigned executable from %AppData%, attempting to read LSASS memory, and making outbound HTTPS connections to a rare domain. The user says they only opened a spreadsheet attachment. What is the best immediate action?

Accepted Answer

Isolate the laptop from the network using the EDR platform.. Option B is correct because the EDR alerts indicate a likely credential theft attempt (LSASS read) and C2 communication (rare domain). Isolating the laptop immediately stops data exfiltration and lateral movement, which is the priority before any remediation. Reboot, scan, or password reset would not prevent the attacker from already having access to credentials or the network.

Answer

Reboot the laptop to clear any malicious process from memory.

Answer

Run a full antivirus scan and wait for the results before taking further action.

Answer

Reset the user's password and keep the laptop online for monitoring.

Question 13

EDR alerts on a remote laptop show a suspicious process attempting to dump browser credentials and then contacting a rare domain. The user is in another time zone and still needs the laptop online for a presentation later today. What containment action is best?

Accepted Answer

Remotely isolate the device through the EDR console while keeping it powered on.. Remotely isolating the device through the EDR console is the best containment action because it immediately blocks all network communication to and from the laptop while keeping it powered on and running. This prevents the suspicious process from exfiltrating browser credentials or communicating with the rare command-and-control domain, yet allows the user to continue using local applications for the presentation later today. EDR isolation typically works by applying a host-based firewall rule that drops all traffic except to the EDR management server, ensuring the threat is contained without disrupting local productivity.

Answer

Ask the user to uninstall the EDR agent and reboot the laptop.

Answer

Wait until after the presentation and then begin containment.

Answer

Email the user asking them to close the browser and log out of their accounts.

Question 14

Employees authenticate once to a corporate portal and then open the help desk, payroll, and documentation apps without logging in again. The apps rely on tokens from the company's identity provider instead of storing separate passwords. What is being implemented?

Accepted Answer

Federated single sign-on using the corporate identity provider.. The scenario describes single sign-on (SSO) where the corporate identity provider (IdP) issues tokens (e.g., SAML assertions, OIDC ID tokens) after initial authentication. The help desk, payroll, and documentation apps are configured as service providers that trust the IdP, so they accept the token instead of requiring separate credentials. This is federated SSO because the apps rely on a central identity provider rather than sharing password databases or synchronizing passwords.

Answer

Password synchronization between every application in the suite.

Answer

Shared guest accounts for all employees on the portal.

Answer

Split tunneling through a VPN to speed up application access.

Question 15

EDR flags a workstation because a word processor launched an unusual script and then contacted a rare external domain. What is the best immediate action?

Accepted Answer

Isolate the workstation from the network using the EDR tool.. Isolating the workstation with the EDR tool is the best immediate action because it contains the potential compromise by cutting off network communication, preventing lateral movement or data exfiltration while preserving forensic evidence. The combination of an unusual script execution from a word processor and a connection to a rare external domain strongly suggests a possible malware infection or remote access trojan (RAT) that requires immediate containment.

Answer

Wait for another alert before taking any action.

Answer

Delete the word processor immediately.

Answer

Reboot the workstation to see if the behavior happens again.