SY0-701 Practice Test 30 — 15 Questions

Question 1

After a suspected compromise, a server's local tools report sshd listening on port 22, but netstat and the EDR console fail to show the process that owns the socket. A reboot does not remove the issue, and firmware integrity checks pass. Which malware type is most likely installed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rootkit, because it is designed to hide processes, drivers, or sockets from normal security tools.. A rootkit is specifically designed to hide its presence from the operating system and security tools by intercepting system calls (e.g., those used by netstat and EDR) to conceal processes, drivers, and network sockets. The persistence after reboot and clean firmware integrity checks indicate the rootkit is installed at the kernel or boot level, bypassing user-mode detection.

Answer

Spyware, because hidden software is often used to collect credentials and data.

Answer

Ransomware, because the server remains operational while still hiding evidence.

Answer

Logic bomb, because the issue persists after reboot and could trigger later.

Question 2

A security team can patch only one system today. Which asset should be remediated first?

Accepted Answer

An internet-facing application server with a critical vulnerability and a known exploit. An internet-facing application server with a critical vulnerability and a known exploit represents the highest risk: it is exposed to external threats, the vulnerability is critical, and a known exploit means attackers can reliably compromise it. Patching this system first reduces the likelihood of a remote breach that could lead to data exfiltration or service disruption, aligning with the principle of prioritizing assets with the greatest attack surface and exploitability.

Answer

An internal print server with a high-severity finding and no direct user access

Answer

A lab workstation with a critical finding and no sensitive data

Answer

A user laptop with a medium-severity issue that requires local access

Question 3

A legacy finance application cannot yet support multifactor authentication. The security team still wants administrators to use separate privileged accounts, receive elevated access only when a ticket is approved, and have those privileges removed automatically after the maintenance window ends. Which solution best fits?

Accepted Answer

Use privileged access management with separate admin accounts and time-bound elevation approvals.. Privileged Access Management (PAM) solutions are specifically designed to enforce just-in-time (JIT) privileged access. They allow administrators to request time-bound elevation of rights for a specific maintenance window, with automatic revocation after the window expires. This directly meets the requirements of separate privileged accounts, ticket-based approval, and automatic removal of privileges, even when the legacy application itself cannot support MFA.

Answer

Create one shared administrator account and rotate its password every week.

Answer

Assign permanent administrator rights through role-based access control and rely on audit logs afterward.

Answer

Move the application behind a federation service so all users can sign in with a single password.

Question 4

A security analyst is responding to a potential ransomware incident on a Windows server that is still running. The analyst needs to preserve forensic evidence for analysis. Which of the following actions should the analyst perform first, based on the order of volatility?

Accepted Answer

Capture a full memory dump of the server. The order of volatility dictates that the most volatile data (memory) must be captured first because it contains critical evidence like running processes, network connections, and encryption keys that will be lost when the system is powered off. A full memory dump preserves this volatile data before any other actions that could alter the system state.

Answer

Shut down the server to prevent further damage

Answer

Create a forensic disk image of the hard drive

Answer

Run a full antivirus scan on the system

Question 5

A security team stores employee passwords in a database. Which method best protects the passwords if the database is stolen?

Accepted Answer

Hash the passwords with a unique salt for each account.. Hashing with a unique salt per account ensures that even if two users have the same password, their hashes will differ, and precomputed rainbow table attacks are rendered ineffective. The salt is stored alongside the hash, but the one-way nature of the hash function means an attacker cannot reverse the hash to recover the original password without performing an expensive brute-force search for each salted hash individually.

Answer

Store the passwords in plain text so users can recover them easily.

Answer

Encrypt the passwords and keep the decryption key in the same database.

Answer

Compress the passwords before storing them to make them smaller.

Question 6

A security analyst receives an alert that a user clicked a link in a phishing email and entered their corporate credentials on a fake login page. Which of the following should the analyst do FIRST to minimize further damage?

Accepted Answer

Disable the user's account and block the compromised system from the network. Immediately disabling the user's account and blocking the compromised system from the network stops the attacker from using the stolen credentials to authenticate to corporate resources, such as email, VPN, or file shares. This containment step is the highest priority in incident response to prevent lateral movement and further compromise, as the attacker already has valid credentials and could be actively using them.

Answer

Run a full antivirus scan on the user's workstation

Answer

Reset the user's password and force re-authentication

Answer

Contact law enforcement and report the phishing site

Question 7

A finance team receives emails that appear to come from the CEO's assistant and ask them to review a document. Several users entered their passwords on a fake login page, and the attackers then signed in from a new country using the same credentials. Which control most directly reduces successful account takeover if a password is stolen?

Accepted Answer

Use phishing-resistant MFA such as FIDO2 or WebAuthn.. Phishing-resistant MFA, such as FIDO2 or WebAuthn, directly prevents account takeover even when a password is stolen because these methods use public-key cryptography and origin-bound credentials. The fake login page cannot intercept the private key or replay the authentication, so the attacker cannot sign in from a new country despite having the password.

Answer

Require password changes every 30 days for all users.

Answer

Turn off all external email to eliminate the chance of future messages.

Answer

Use single sign-on without MFA so users authenticate only once.

Question 8

EDR reports that a workstation launched PowerShell from a word processor, created a scheduled task named WinUpdateSvc, and began making repeated HTTPS connections to a rare external domain. The user is still logged in to several cloud apps. Which two response actions are best to initiate from the EDR console? Select two.

Accepted Answer

Isolate the endpoint from the network to stop further communication and lateral movement.. Isolating the endpoint from the network immediately stops the active HTTPS command-and-control (C2) communication and prevents lateral movement to other systems. Given the suspicious chain (word processor spawning PowerShell, creating a scheduled task, and connecting to a rare external domain), this is a strong indicator of a malware infection or unauthorized remote access. Isolation preserves the forensic state while cutting off the attacker's access.

Answer

Delete the scheduled task immediately so the host returns to normal operation.

Answer

Reimage the workstation from the golden image as the first response.

Answer

Ignore the alert because the PowerShell binary is built into Windows and therefore safe.

Question 9

Based on the exhibit, which additional control best reduces the risk of tailgating at the entrance while preserving normal employee flow?

Accepted Answer

Install a mantrap or anti-passback turnstile that admits one person per badge authorization.. A mantrap or anti-passback turnstile enforces one-person-per-badge authorization, physically preventing tailgating by only allowing a single individual to pass per valid credential. This preserves normal employee flow because authorized users can enter quickly without manual intervention, unlike guards or awareness campaigns that rely on human compliance.

Answer

Post a security guard at the entrance during business hours.

Answer

Add more CCTV cameras in the lobby and at the parking lot entrance.

Answer

Send quarterly emails reminding employees not to hold doors open.

Question 10

A security analyst reviews authentication logs and discovers hundreds of failed login attempts from a single external IP address within a five-minute window. All attempts target the same username 'jsmith' but use different passwords. Which type of password attack does this pattern most likely indicate?

Accepted Answer

Brute force. The pattern of hundreds of failed login attempts from a single external IP address targeting the same username 'jsmith' with different passwords is characteristic of a brute force attack. In a brute force attack, the attacker systematically tries many password guesses against a single account to eventually find the correct credential. This contrasts with password spraying, where a few common passwords are tried against many usernames, and credential stuffing, which uses previously compromised username/password pairs from other breaches.

Answer

Password spraying

Answer

Credential stuffing

Answer

Dictionary attack

Question 11

Based on the exhibit, what type of web attack is most likely taking place?

Accepted Answer

SQL injection, because the attacker is manipulating the database query with crafted input.. The exhibit shows a URL parameter (e.g., `id=1 OR 1=1`) that is being passed to a database query. The attacker is injecting SQL syntax to manipulate the query logic, which is the hallmark of SQL injection. The 500 error likely results from the database server crashing or returning an invalid result set, confirming that the injection is affecting the database.

Answer

Cross-site scripting, because the input is visible in the URL and causes an error.

Answer

Broken authentication, because the application returns a 500 error.

Answer

Insecure deserialization, because the application is parsing attacker-controlled data.

Question 12

Based on the exhibit, which malware type is most likely involved?

Accepted Answer

Ransomware, because files were encrypted and recovery options were intentionally removed.. The exhibit shows that files have been encrypted with a '.locked' extension and that recovery options like System Restore and Volume Shadow Copy have been removed or disabled. This is a classic indicator of ransomware, which encrypts user data and then demands payment for decryption, often deleting backup files to prevent recovery without the attacker's key.

Answer

Trojan, because the malware was likely disguised as a legitimate file.

Answer

Spyware, because the attacker is trying to monitor user activity quietly.

Answer

Rootkit, because the attacker is hiding from the operating system.

Question 13

A SIEM alert shows five failed logins to an administrator account, followed by a successful login from a new city three minutes later. The account owner says they did not sign in. What should the analyst do first?

Accepted Answer

Temporarily disable the account and open an incident for investigation.. The alert shows a classic indicator of account compromise: multiple failed logins followed by a successful authentication from an unusual location. The account owner's denial of the login confirms unauthorized access, so the immediate priority is to contain the threat by disabling the account and opening an incident for formal investigation. This aligns with the NIST SP 800-61 incident response process, specifically the containment phase before eradication or recovery.

Answer

Ignore the alert because the login eventually succeeded.

Answer

Reset the password only and close the alert.

Answer

Reboot the user's laptop to clear any malicious activity.

Question 14

Based on the exhibit, what is the best risk response for the security team to recommend before the customer portal goes live?

Accepted Answer

Mitigate the risk by remediating the vulnerability before production release.. The exhibit shows a critical SQL injection vulnerability in the customer portal that has been partially mitigated by a WAF rule. However, WAF rules can be bypassed (e.g., through encoding tricks or HTTP parameter pollution), so the residual risk remains high. The best response is to remediate the vulnerability in the application code before launch, which directly removes the root cause and aligns with the principle of defense in depth.

Answer

Accept the risk now, because the WAF rule lowers exposure enough for launch.

Answer

Transfer the risk to the hosting provider through a service-level agreement.

Answer

Avoid the risk by permanently canceling the customer portal project.

Question 15

A security analyst detects real-time data exfiltration from a critical production database that supports customer transactions. The exfiltration appears to be occurring via a compromised application service account. Which containment strategy should the analyst implement FIRST to minimize damage while preserving forensic data?

Accepted Answer

Disconnect the database server from the network.. Disconnecting the database server from the network (Option A) immediately stops the active data exfiltration by severing all network communication, including the compromised service account's outbound connections. This preserves the server's volatile memory, running processes, and disk state for forensic analysis, unlike a shutdown which would destroy critical evidence. It is the fastest containment action that minimizes data loss while maintaining the integrity of forensic artifacts.

Answer

Shut down the database server.

Answer

Implement network segmentation to isolate the server.

Answer

Block the IP address of the suspected attacker.