SY0-701 Practice Test 3 — 10 Questions

Question 1

Based on the exhibit, which integration best lets the SaaS application trust the company's existing identity provider so users can sign in with their corporate credentials?

Accepted Answer

Establish SAML federation so the SaaS app trusts the corporate identity provider.. SAML (Security Assertion Markup Language) federation allows the SaaS application to trust the corporate identity provider (IdP) by exchanging signed XML assertions. This enables users to authenticate against their corporate credentials without the SaaS app ever storing or managing those credentials, providing single sign-on (SSO) across domains.

Answer

Enable password synchronization so the SaaS app stores the same password as the directory.

Answer

Create a shared local administrator account for all subsidiary users.

Answer

Configure MAC address filtering on company laptops to allow portal access.

Question 2

Based on the exhibit, what should the analyst do next to limit the impact of the suspected compromise?

Accepted Answer

Isolate FIN-LT-22 from the network to contain the suspected malware activity.. Option B is correct because isolating FIN-LT-22 from the network immediately stops the suspected malware from communicating with command-and-control servers or spreading laterally to other hosts. This containment step aligns with the NIST incident response framework's containment phase, which prioritizes limiting damage before eradication or recovery. In a suspected compromise, network isolation (e.g., disabling the switch port or using a host-based firewall rule) is the fastest way to cut off malicious traffic without destroying volatile evidence in memory.

Answer

Run a full antivirus scan first and wait for the results before taking any other action.

Answer

Reboot the laptop to clear the malicious process from memory.

Answer

Reset the user's password and close the ticket after confirming they can log in again.

Question 3

Based on the exhibit, which change would most improve the security of the stored password data?

Accepted Answer

Add a unique salt per password and use a slow password hashing algorithm.. Option B is correct because adding a unique salt per password prevents precomputed rainbow table attacks, and using a slow password hashing algorithm (like bcrypt, PBKDF2, or Argon2) increases the computational cost of brute-force attacks. This combination ensures that even if the password hashes are compromised, attackers cannot efficiently crack them. Salting also ensures that identical passwords produce different hashes, eliminating the ability to detect shared passwords across accounts.

Answer

Store the passwords in encrypted form so they can be recovered later if needed.

Answer

Replace the hash with a plain SHA-256 digest because it is modern and widely supported.

Answer

Append the application name to each password before hashing to make the hashes unique.

Question 4

Based on the exhibit, what is the BEST remediation for the application flaw shown?

A user-controlled parameter is being passed to a shell command on the server. The application is intended to test connectivity to approved internal hosts only.

Accepted Answer

Replace the shell call with a safe library function and strictly allowlist approved host values.. Option B is correct because the application flaw is command injection: a user-controlled parameter is passed directly to a shell command (e.g., `ping`). The best remediation is to replace the shell call with a safe library function (e.g., `InetAddress.isReachable()` in Java or a dedicated ICMP library) and strictly allowlist approved internal host values, eliminating the possibility of injecting arbitrary commands like `; rm -rf /`.

Answer

Keep the current shell command, but add HTML encoding to the response page.

Answer

Increase the web server timeout so the ping utility has more time to complete.

Answer

Require users to authenticate before they can access the page.

Question 5

Based on the exhibit, what type of malware is the most likely issue on the workstation?

Accepted Answer

Spyware, because the system appears to be collecting user data silently.. The exhibit shows a browser extension installed from an unofficial website that is silently collecting browsing data, including keystrokes and visited URLs, which is characteristic of spyware. Spyware operates by gathering user information without consent, often through seemingly legitimate software, and the absence of encryption or user notification confirms this classification.

Answer

Ransomware, because the browser settings changed after installation.

Answer

Rootkit, because the endpoint security console detected an unknown process.

Answer

Worm, because the software was installed from an unofficial website.

Question 6

Based on the exhibit, which control should be enabled to mitigate this issue?

Accepted Answer

Dynamic ARP inspection with DHCP snooping, because it validates ARP replies against trusted bindings.. Dynamic ARP inspection (DAI) with DHCP snooping validates ARP packets against a trusted binding database, preventing man-in-the-middle attacks where an attacker spoofs the MAC address of a legitimate host (e.g., the default gateway) to intercept traffic. The exhibit likely shows a scenario of ARP spoofing or cache poisoning, which DAI directly mitigates by dropping invalid ARP replies. DHCP snooping builds the trusted binding table by recording which IP address is assigned to which MAC address on which port.

Answer

DNSSEC, because it validates DNS records and would stop local address-to-MAC spoofing.

Answer

Port forwarding, because it can direct traffic to the correct internal host more reliably.

Answer

Load balancing, because it would distribute traffic and reduce the impact of connectivity issues.

Question 7

Based on the exhibit, which document type should be updated to make the approval and retention requirements mandatory across the organization?

Accepted Answer

Policy, because it sets mandatory rules that apply organization-wide.. A policy document is the correct choice because it establishes mandatory rules that apply organization-wide, making approval and retention requirements enforceable across all departments. Unlike guidelines or procedures, policies are authoritative and require compliance, which is essential for standardizing security controls like data retention periods.

Answer

Guideline, because it provides flexible advice without requiring enforcement.

Answer

Procedure, because it lists the exact steps the help desk follows.

Answer

Architecture diagram, because it shows where documents are stored.

Question 8

Based on the exhibit, what is the best next step before the hotfix is released?

Accepted Answer

Pause release until the change is formally approved, tested, and has a documented rollback path.. Option D is correct because releasing a hotfix without formal approval, testing, and a documented rollback path violates the change management policy required by security program management. Even for urgent customer-facing issues, skipping these steps risks introducing new vulnerabilities or breaking other systems, which could lead to a larger outage. The exhibit indicates a need for controlled change processes, so pausing until the change is properly vetted ensures stability and security.

Answer

Deploy immediately because the issue is customer-facing and urgent.

Answer

Close the ticket after deployment and create a postmortem if users complain.

Answer

Ask support to warn users that sign-in may fail during the next hour.

Question 9

Based on the exhibit, which access change best follows least privilege while still allowing the help desk to complete the task?

Accepted Answer

Grant helpdesk_27 the Helpdesk_Admin role for the ticket and remove it after completion.. Option C is correct because it implements Role-Based Access Control (RBAC) by granting the help desk technician a temporary, ticket-specific role (Helpdesk_Admin) that provides just enough privileges to perform the password reset without granting broader administrative rights. This follows the principle of least privilege by limiting the elevated access to the exact scope and duration needed, and the role can be automatically revoked after the ticket is closed, minimizing the attack surface.

Answer

Add helpdesk_27 to Domain_Admin for seven days, since the request is urgent and time-limited.

Answer

Use a shared administrator password so the technician can finish the ticket without changing group memberships.

Answer

Ask the user's manager to perform the reset manually so the help desk does not need additional access.

Question 10

Based on the exhibit, which change best helps the company meet its recovery objectives after a ransomware event?

Accepted Answer

Move backups to an immutable, offline or logically isolated repository and test restores regularly.. Option B is correct because ransomware often encrypts or deletes accessible backups. An immutable, offline, or logically isolated repository prevents attackers from modifying or deleting backup data, ensuring a clean recovery point. Regularly testing restores validates that the backups are functional and meet recovery objectives (RTO/RPO). This aligns with the 3-2-1 backup rule and NIST SP 800-184 guidance for ransomware recovery.

Answer

Increase the retention period on the existing NAS backups to one year.

Answer

Store the backup administrator password in a shared team spreadsheet so more staff can restore data quickly.

Answer

Replace the nightly full backup with a longer full backup window to capture more data each day.

SY0-701 Practice Test 3 — 10 Questions

Exhibit

SY0-701 Practice Test 3 — 10 Questions

Exhibit