SY0-701 Practice Test 30 — 15 Questions

Question 1

Based on the exhibit, which additional control best reduces the risk of tailgating at the entrance while preserving normal employee flow?

Accepted Answer

Install a mantrap or anti-passback turnstile that admits one person per badge authorization.. A mantrap or anti-passback turnstile enforces one-person-per-badge authorization, physically preventing tailgating by only allowing a single individual to pass per valid credential. This preserves normal employee flow because authorized users can enter quickly without manual intervention, unlike guards or awareness campaigns that rely on human compliance.

Answer

Post a security guard at the entrance during business hours.

Answer

Add more CCTV cameras in the lobby and at the parking lot entrance.

Answer

Send quarterly emails reminding employees not to hold doors open.

Question 2

A security analyst reviews authentication logs and discovers hundreds of failed login attempts from a single external IP address within a five-minute window. All attempts target the same username 'jsmith' but use different passwords. Which type of password attack does this pattern most likely indicate?

Accepted Answer

Brute force. The pattern of hundreds of failed login attempts from a single external IP address targeting the same username 'jsmith' with different passwords is characteristic of a brute force attack. In a brute force attack, the attacker systematically tries many password guesses against a single account to eventually find the correct credential. This contrasts with password spraying, where a few common passwords are tried against many usernames, and credential stuffing, which uses previously compromised username/password pairs from other breaches.

Answer

Password spraying

Answer

Credential stuffing

Answer

Dictionary attack

Question 3

Based on the exhibit, what type of web attack is most likely taking place?

Accepted Answer

SQL injection, because the attacker is manipulating the database query with crafted input.. The exhibit shows a URL parameter (e.g., `id=1 OR 1=1`) that is being passed to a database query. The attacker is injecting SQL syntax to manipulate the query logic, which is the hallmark of SQL injection. The 500 error likely results from the database server crashing or returning an invalid result set, confirming that the injection is affecting the database.

Answer

Cross-site scripting, because the input is visible in the URL and causes an error.

Answer

Broken authentication, because the application returns a 500 error.

Answer

Insecure deserialization, because the application is parsing attacker-controlled data.

Question 4

Based on the exhibit, which malware type is most likely involved?

Accepted Answer

Ransomware, because files were encrypted and recovery options were intentionally removed.. The exhibit shows that files have been encrypted with a '.locked' extension and that recovery options like System Restore and Volume Shadow Copy have been removed or disabled. This is a classic indicator of ransomware, which encrypts user data and then demands payment for decryption, often deleting backup files to prevent recovery without the attacker's key.

Answer

Trojan, because the malware was likely disguised as a legitimate file.

Answer

Spyware, because the attacker is trying to monitor user activity quietly.

Answer

Rootkit, because the attacker is hiding from the operating system.

Question 5

A SIEM alert shows five failed logins to an administrator account, followed by a successful login from a new city three minutes later. The account owner says they did not sign in. What should the analyst do first?

Accepted Answer

Temporarily disable the account and open an incident for investigation.. The alert shows a classic indicator of account compromise: multiple failed logins followed by a successful authentication from an unusual location. The account owner's denial of the login confirms unauthorized access, so the immediate priority is to contain the threat by disabling the account and opening an incident for formal investigation. This aligns with the NIST SP 800-61 incident response process, specifically the containment phase before eradication or recovery.

Answer

Ignore the alert because the login eventually succeeded.

Answer

Reset the password only and close the alert.

Answer

Reboot the user's laptop to clear any malicious activity.

Question 6

Based on the exhibit, what is the best risk response for the security team to recommend before the customer portal goes live?

Accepted Answer

Mitigate the risk by remediating the vulnerability before production release.. The exhibit shows a critical SQL injection vulnerability in the customer portal that has been partially mitigated by a WAF rule. However, WAF rules can be bypassed (e.g., through encoding tricks or HTTP parameter pollution), so the residual risk remains high. The best response is to remediate the vulnerability in the application code before launch, which directly removes the root cause and aligns with the principle of defense in depth.

Answer

Accept the risk now, because the WAF rule lowers exposure enough for launch.

Answer

Transfer the risk to the hosting provider through a service-level agreement.

Answer

Avoid the risk by permanently canceling the customer portal project.

Question 7

A security analyst detects real-time data exfiltration from a critical production database that supports customer transactions. The exfiltration appears to be occurring via a compromised application service account. Which containment strategy should the analyst implement FIRST to minimize damage while preserving forensic data?

Accepted Answer

Disconnect the database server from the network.. Disconnecting the database server from the network (Option A) immediately stops the active data exfiltration by severing all network communication, including the compromised service account's outbound connections. This preserves the server's volatile memory, running processes, and disk state for forensic analysis, unlike a shutdown which would destroy critical evidence. It is the fastest containment action that minimizes data loss while maintaining the integrity of forensic artifacts.

Answer

Shut down the database server.

Answer

Implement network segmentation to isolate the server.

Answer

Block the IP address of the suspected attacker.

Question 8

A company uses four cloud applications and wants employees to sign in once with corporate credentials. The applications should trust the company’s identity platform, and disabling a user in the directory should remove access everywhere without separate password resets. Which architecture should the team implement?

Accepted Answer

Use federation with single sign-on through the corporate identity provider, such as SAML or OpenID Connect.. Federation with single sign-on (SSO) using the corporate identity provider (IdP) via SAML or OpenID Connect allows users to authenticate once with their corporate credentials. The cloud applications trust the IdP, so disabling a user in the corporate directory immediately revokes access across all applications without requiring separate password resets. This architecture decouples authentication from the applications and centralizes identity management.

Answer

Create separate local accounts in each cloud application and synchronize passwords manually.

Answer

Configure RADIUS authentication directly on each cloud application so users can reuse one password.

Answer

Store one shared administrator password for all users in a password vault.

Question 9

A company wants employees to sign in once to several SaaS apps, while the security team also wants to require extra verification when users sign in from unmanaged devices or unusual locations. Which two architecture changes best satisfy both requirements? Select two.

Accepted Answer

Federate authentication to a central identity provider.. Federating authentication to a central identity provider (IdP) enables single sign-on (SSO) across multiple SaaS apps using standards like SAML 2.0 or OIDC. This allows employees to sign in once, while the IdP becomes a centralized point to enforce additional security controls.

Answer

Create separate passwords for each SaaS app so compromise is contained.

Answer

Turn off MFA because single sign-on already reduces logins.

Answer

Use shared generic accounts for contractors to simplify onboarding.

Question 10

A security analyst observes a critical server generating unusually high outbound traffic to an external IP address that is listed on a threat intelligence feed as a known command-and-control server. The analyst suspects the server is compromised. According to standard incident response procedures, what should the analyst do NEXT?

Accepted Answer

Isolate the server from the network to stop the communication. Isolating the server from the network immediately stops the outbound command-and-control (C2) communication, preventing data exfiltration and further compromise. This aligns with the first step in the NIST SP 800-61 incident response process—containment—before any eradication or recovery actions are taken. Rebooting or patching without isolation could destroy volatile evidence (e.g., memory-resident malware) and allow the attacker to persist or escalate.

Answer

Reboot the server to clear any malicious processes from memory

Answer

Apply the latest security patches to the server

Answer

Ignore the alert because the external IP might be a false positive

Question 11

A security analyst observes repeated outbound traffic from a single workstation to a known malicious IP address. The workstation's anti-malware software has reported no alerts, and the user claims to have only downloaded software from the company's approved application store. Which type of malware most likely explains this behavior?

Accepted Answer

Trojan horse. The Trojan horse is correct because it is a type of malware that disguises itself as legitimate software, often downloaded from trusted sources like an approved application store, to bypass security controls. Once installed, it can silently establish outbound connections to a command-and-control (C2) server, such as the known malicious IP address observed, without triggering anti-malware alerts if the Trojan is not yet in the signature database. This matches the scenario where the user downloaded from an approved store, the anti-malware reported no alerts, and the workstation is communicating with a malicious IP.

Answer

Ransomware

Answer

Rootkit

Answer

Polymorphic malware

Question 12

A DevOps team builds container images in a CI/CD pipeline. Security wants to reduce the chance of deploying vulnerable libraries and also wants the cluster to reject images that have not been approved. Which approach best meets both requirements?

Accepted Answer

Scan images in the pipeline and enforce signature verification or admission control before deployment.. It combines two essential security controls: scanning container images for known vulnerabilities (e.g., using Trivy or Clair) during the CI/CD pipeline, and enforcing signature verification (e.g., using Notary or Cosign) or admission control (e.g., using OPA/Gatekeeper or Kyverno) to ensure only signed or approved images are deployed. This directly reduces the risk of deploying vulnerable libraries and prevents unapproved images from running in the cluster.

Answer

Increase CPU and memory limits for the containers so they run more safely.

Answer

Allow developers to pull images from any registry as long as the tags look familiar.

Answer

Disable pipeline scanning to speed releases and rely on runtime monitoring after deployment.

Question 13

Based on the exhibit, what is the best improvement to reduce the impact if one backup server is compromised?

Accepted Answer

Store encryption keys in a centralized KMS or HSM and use distinct keys with rotation.. Using a centralized Key Management System (KMS) or Hardware Security Module (HSM) with distinct, rotated keys ensures that compromising one backup server does not expose the encryption keys for all backups. This isolates the impact to only the data encrypted with that specific key, and key rotation further limits the window of exposure. In contrast, sharing a single key file across servers creates a single point of failure, as compromising one server reveals the key for all backups.

Answer

Keep the same key file but rename it so attackers cannot find it easily.

Answer

Replace AES with SHA-256 so the backups are harder to read.

Answer

Email the key file to backup operators so they can restore data quickly.

Question 14

An HR portal has three job functions: HR staff update employee records, managers approve leave requests, and payroll views salary data. The security team wants to prevent any one role from having all capabilities. Which access design is the best fit?

Accepted Answer

Create role-based access groups aligned to each job function and grant only the permissions needed for that role.. Role-based access control (RBAC) is the correct design because it enforces the principle of least privilege by granting each job function only the permissions necessary for its tasks. This prevents any single role from accumulating all capabilities (e.g., HR staff cannot approve leave or view salary data), directly addressing the security team's requirement to separate duties. RBAC aligns with NIST SP 800-53 AC-6 and is a standard access control model for multi-role enterprise applications.

Answer

Use a single superuser account for the entire department so tasks can be completed quickly.

Answer

Give every employee access to all portal features and depend on audit logs to catch mistakes later.

Answer

Require the payroll team to share one common password and use it only from the office network.

Question 15

Based on the exhibit, what type of malware behavior is most likely occurring?

Accepted Answer

Fileless attack, because PowerShell was launched in memory with no new payload written to disk.. The exhibit shows PowerShell being launched in memory with no new payload written to disk, which is the hallmark of a fileless attack. Fileless malware exploits legitimate system tools like PowerShell to execute malicious code directly in memory, evading traditional signature-based detection that relies on scanning files on disk.

Answer

Ransomware, because the endpoint made an outbound connection after opening a document.

Answer

Spyware, because the laptop made an encrypted outbound connection.

Answer

Worm activity, because the laptop communicated with an external IP address.