SY0-701 Practice Test 3 — 30 Questions

Question 1

A security analyst notices that a phishing campaign is targeting employees with emails that appear to be from the company's IT support team. The emails contain a link to a website that mimics the corporate password reset portal. Which of the following controls would be MOST effective in preventing users from reaching the malicious website, assuming the link uses HTTPS?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a URL filtering policy on the company's web proxy.. A URL filtering policy on the company's web proxy is the most effective control because it can block access to the malicious website based on its domain, category, or reputation, regardless of whether the link uses HTTPS. Since the proxy can perform SSL/TLS inspection (decrypting the HTTPS traffic) or use domain reputation lists, it prevents users from even reaching the phishing site. This directly addresses the core issue of users navigating to a known or suspicious URL.

Answer

Deploy an email security gateway that performs sandboxing of attachments.

Answer

Enable multi-factor authentication on all corporate accounts.

Answer

Conduct a security awareness training session on phishing.

Question 2

A security engineer writes a script that computes SHA-256 hashes of critical server configuration files every night and sends an alert if any hash value has changed since the previous night. Which security goal is this control primarily designed to protect?

Accepted Answer

Integrity. The script computes SHA-256 hashes of configuration files and compares them nightly to detect any unauthorized or accidental changes. This directly protects the integrity of the files by ensuring they have not been modified, which is the core security goal of integrity. Confidentiality and availability are not addressed by hash comparison.

Answer

Confidentiality

Answer

Availability

Answer

Authentication

Question 3

A team deploys an e-commerce application on an IaaS virtual machine. The cloud provider secures the datacenter, hardware, and hypervisor. The company wants to reduce the chance that attackers exploit outdated software on the VM itself. Which responsibility remains with the company?

Accepted Answer

Patch and harden the guest operating system and application running on the VM.. In an IaaS model, the cloud provider is responsible for the security of the cloud (datacenter, hardware, hypervisor), while the customer is responsible for security in the cloud. This includes patching and hardening the guest OS and application on the VM. The company must manage vulnerabilities in the software stack it controls to prevent exploitation of outdated components.

Answer

Replace the cloud provider’s physical security controls with on-site guards.

Answer

Install new firmware on the physical host server maintained by the provider.

Answer

Set the data center’s perimeter access badge policy.

Question 4

A company runs payroll and HR application servers on the same VLAN because a redesign is not possible this quarter. Security wants to reduce lateral movement if one workload is compromised, but the team cannot renumber the environment or add new physical firewalls. Which control best fits the requirement?

Accepted Answer

Implement microsegmentation with host-based or distributed firewall rules between workloads. Microsegmentation using host-based or distributed firewall rules (e.g., via a hypervisor firewall or host firewall policies) allows the security team to enforce zero-trust east-west traffic controls between the payroll and HR servers without changing the VLAN, subnet, or adding physical firewalls. This directly reduces lateral movement by restricting communication to only what is necessary, even though both workloads share the same Layer 2 broadcast domain.

Answer

Move the servers into a single larger subnet so internal routing is simplified

Answer

Place the servers behind a network address translation device to hide their IP addresses

Answer

Rely on password rotation and MFA for administrative logins only

Question 5

An operations team manages Linux servers over SSH. The security team wants to stop direct management access from employee laptops, reduce lateral movement if one admin endpoint is compromised, and keep a log of every administrative session. Which two design choices best fit? Select two.

Accepted Answer

Require administrators to connect to a bastion host or jump server before reaching the Linux servers.. A bastion host (jump server) acts as a single, hardened entry point that administrators must connect to before reaching internal Linux servers. This eliminates direct SSH access from employee laptops, reducing the attack surface and preventing lateral movement if an admin endpoint is compromised. The bastion host can also enforce centralized logging of all administrative sessions, meeting the security team's requirement for session recording.

Answer

Let all corporate laptops connect directly to SSH on the servers if MFA is enabled.

Answer

Expose SSH to the internet because key-based authentication is already strong.

Answer

Use split tunneling for admin traffic so management packets can bypass the VPN.

Question 6

Based on the exhibit, what best describes the additional measures applied to the legacy system?

Accepted Answer

Compensating controls, because they reduce risk when the preferred security controls are not possible.. The exhibit shows a legacy system that cannot support modern authentication protocols like Kerberos or NTLMv2. The additional measures—such as network segmentation, strict firewall rules, and an application-layer gateway—are compensating controls. They reduce risk by enforcing security in the network layer since the preferred control (upgrading the OS or application to support strong authentication) is not feasible.

Answer

Preventive controls, because they stop every possible compromise completely.

Answer

Corrective controls, because they repair the controller after an incident occurs.

Answer

Deterrent controls, because they mainly scare attackers away from trying.

Question 7

Based on the exhibit, which action should the incident response team take next to eradicate the threat?

Accepted Answer

Reimage the endpoint from a known-good build and reset potentially exposed credentials.. The exhibit indicates a confirmed compromise (e.g., a scheduled task establishing outbound C2 traffic). Eradication requires removing all traces of the attacker's foothold, which is best achieved by reimaging the endpoint from a known-good build. Additionally, any credentials that may have been exposed during the compromise must be reset to prevent lateral movement or re-entry.

Answer

Return the workstation to the user since the outbound connection was blocked.

Answer

Delete only the scheduled task and reconnect the host to monitor for more alerts.

Answer

Close the incident because memory capture has already preserved the evidence.

Question 8

A security analyst observes a pattern where an account exhibits multiple failed login attempts from an IP address in a foreign country, followed by a successful login from the same account but from a different IP address in another foreign country minutes later. The analyst wants to deploy a control that can automatically detect and alert on this type of anomalous user behavior, even if the individual login events are not blocked by existing rules. Which of the following security controls is BEST suited for this task?

Accepted Answer

User Behavior Analytics (UBA). User Behavior Analytics (UBA) is the best control because it uses machine learning to establish a baseline of normal user behavior (e.g., typical login locations, times, and IP ranges) and then detects anomalies such as a rapid sequence of failed logins from one foreign country followed by a successful login from another foreign country. Unlike static rules, UBA can identify this pattern as suspicious even if each individual login event is not blocked by existing rules, triggering an alert for further investigation.

Answer

Geofencing

Answer

Account lockout policy

Answer

SIEM correlation rules

Question 9

A security architect is designing the network security for a web application hosted in a public cloud environment such as AWS. The application uses an Application Load Balancer (ALB) that distributes traffic to a fleet of web servers. The web servers must only accept traffic from the ALB, and all other inbound traffic must be blocked. The ALB itself needs to accept HTTP/HTTPS traffic from anywhere on the internet. Which of the following cloud security controls should the architect configure on the web servers' network interface to best meet this requirement, assuming the cloud provider offers both stateful and stateless network filtering options?

Accepted Answer

A stateful security group that allows inbound traffic from the ALB's security group only.. A stateful security group in AWS can reference another security group as a source, allowing inbound traffic only from instances associated with the ALB's security group. This ensures that web servers accept traffic exclusively from the ALB, while the ALB itself can accept HTTP/HTTPS from the internet via its own security group rules. Stateful filtering automatically allows return traffic, simplifying rule management and meeting the requirement precisely.

Answer

A stateless network ACL that allows inbound traffic from the ALB's subnet only.

Answer

A web application firewall (WAF) that inspects all traffic for SQL injection.

Answer

A host-based firewall on each web server that allows traffic from the ALB's private IP address.

Question 10

Users on one VLAN report that their traffic to the default gateway is intermittently slow and sometimes reaches the wrong device. A packet capture shows unsolicited ARP replies claiming to be the gateway. Which two actions are the best mitigations on managed switches? Select two.

Accepted Answer

enable DHCP snooping so trusted IP-to-MAC bindings can be validated. DHCP snooping creates a trusted database of IP-to-MAC bindings by monitoring DHCP messages. This database is then used by Dynamic ARP Inspection (DAI) to validate ARP packets, ensuring that only legitimate gateway addresses are accepted. Without DHCP snooping, DAI has no reliable source of truth to compare against, making it ineffective against ARP spoofing attacks.

Answer

change the default gateway IP address on the subnet

Answer

disable spanning tree protocol to reduce switching delays

Answer

replace private addressing with NAT on every endpoint

Question 11

A security analyst detects repeated outbound traffic from a single workstation to an IP address listed on a public threat intelligence feed as a known command-and-control server. The user reports that the workstation is behaving slowly and that antivirus software is up to date. According to incident response best practices, what should the analyst do FIRST?

Accepted Answer

Disconnect the workstation from the network. The correct first step is to disconnect the workstation from the network to immediately contain the threat and prevent further command-and-control (C2) communication. Since the traffic is already confirmed to a known C2 server via a public threat intelligence feed, the priority is to stop data exfiltration and potential lateral movement, not to gather more evidence or notify the user. Incident response best practices emphasize containment before eradication or notification to minimize damage.

Answer

Run a full antivirus scan on the workstation

Answer

Notify the user that their workstation may be compromised

Answer

Check the firewall logs to confirm the destination IP

Question 12

EDR flags a workstation after a word processor launches encoded PowerShell and the host begins contacting a rare domain over HTTPS. The user is still active. What is the best containment action from the EDR console?

Accepted Answer

Isolate the endpoint from the network while keeping it powered on.. Isolating the endpoint from the network while keeping it powered on is the best containment action because it immediately cuts off the command-and-control (C2) communication over HTTPS to the rare domain, preventing further data exfiltration or lateral movement, while preserving volatile memory and running processes for forensic analysis. This aligns with incident response best practices where containment must prioritize stopping the threat without destroying evidence.

Answer

Delete the suspicious PowerShell process from the console and close the alert.

Answer

Reimage the workstation immediately to return it to a clean state.

Answer

Power the workstation off and disconnect the SSD to preserve data.

Question 13

Based on the exhibit, which awareness action should the security manager prioritize next?

Accepted Answer

Launch role-based phishing training and reporting reinforcement for the highest-risk groups.. The exhibit shows that the highest-risk groups (e.g., finance, executives) have the highest phishing click rates. Option B is correct because role-based phishing training targets these specific users with simulated phishing campaigns and reporting reinforcement, which directly reduces the likelihood of successful social engineering attacks. This aligns with the principle of prioritizing remediation based on risk assessment data rather than blanket training.

Answer

Send the same annual awareness slide deck to everyone again without changing the content.

Answer

Block all external email so users cannot click suspicious messages.

Answer

Take no action because IT already reports suspicious messages well.

Question 14

A security analyst receives reports that several employees are being redirected to a fraudulent login page after typing the correct URL for a company application into their browser. Further investigation reveals that the company's internal DNS server has been compromised. Which type of attack best describes this scenario?

Accepted Answer

Pharming. Pharming is correct because the attack redirects users from a legitimate website to a fraudulent one without their knowledge or interaction, typically by compromising the DNS resolution process. In this scenario, the internal DNS server has been compromised, so when employees type the correct URL, the DNS server returns the IP address of a fake login page instead of the real one. This is a classic example of DNS poisoning, a form of pharming.

Answer

Phishing

Answer

Spear phishing

Answer

Vishing

Question 15

A security architect is designing the wireless network for a new branch office. The branch will have two types of users: employees who need access to internal corporate resources, and guests who need internet-only access. The architect plans to use WPA3-Enterprise for the employee SSID and WPA3-SAE for the guest SSID. Which of the following additional configurations is MOST critical to prevent guests from accessing internal corporate resources?

Accepted Answer

Place the guest wireless network on a separate VLAN with a firewall rule blocking inbound traffic to the corporate VLAN.. The most critical configuration is to isolate the guest network from the corporate network. Placing the guest SSID on a separate VLAN and implementing a firewall rule that blocks inbound traffic from the guest VLAN to the corporate VLAN ensures that even if a guest device is compromised or malicious, it cannot initiate connections to internal corporate resources. This leverages network segmentation and access control lists (ACLs) to enforce the principle of least privilege.

Answer

Implement MAC address filtering on the guest SSID to allow only authorized guest devices.

Answer

Disable SSID broadcast for the guest network to make it less discoverable.

Answer

Require guests to accept a captive portal agreement before gaining internet access.

Question 16

After a merger, dozens of laptops arrive with inconsistent settings and a history of unsupported utilities installed by the previous owner. The security team wants to establish a known-good configuration, reduce future drift, and accelerate remediation of newly discovered vulnerabilities. Which three actions best support that goal? Select three.

Accepted Answer

Build and deploy a secure baseline or gold image for the laptops.. A is correct because building and deploying a secure baseline or gold image ensures all laptops start from a known-good configuration, eliminating inconsistencies and unsupported utilities from the previous owner. This directly supports the goal of establishing a trusted state and provides a reference point for detecting future drift.

Answer

Allow each user to customize local security settings for productivity.

Answer

Skip validation after patching because the baseline will always remain correct.

Question 17

A Windows file server was built from a gold image, but six months later a scan shows Remote Desktop enabled, SMBv1 re-enabled, and Print Spooler running. The same drift appears on several other servers after emergency troubleshooting. Security wants to return the environment to the approved baseline and prevent the changes from coming back. What is the best solution?

Accepted Answer

Deploy configuration management that enforces the hardened baseline continuously. Configuration management tools like Ansible, DSC, or Group Policy can continuously enforce a hardened baseline by reverting unauthorized changes (e.g., disabling SMBv1, stopping Print Spooler, disabling RDP) at a defined interval or on a trigger. This prevents configuration drift without relying on manual intervention or reactive scanning, directly addressing the root cause of the problem.

Answer

Document the deviations and rely on manual checks after each maintenance window

Answer

Run a vulnerability scan more often and close the findings in the ticketing system

Answer

Increase storage capacity so the image can be rebuilt faster next time

Question 18

Based on the exhibit, users report that the new payment portal opens only after they bypass a browser warning. Which remediation best restores secure access without weakening certificate validation?

Accepted Answer

Reissue the server certificate so the subject or SAN matches pay.example.net and chain it to the trusted CA.. The browser warning indicates a hostname mismatch or untrusted CA. Reissuing the server certificate with the correct subject or SAN (Subject Alternative Name) matching pay.example.net and chaining it to a trusted CA resolves the warning while maintaining full certificate validation. This ensures the browser can verify both the identity and trustworthiness of the server without weakening security.

Answer

Install the same certificate on every client so the browser warning is suppressed.

Answer

Disable certificate name checking in the browser until the certificate expires.

Answer

Replace TLS with a shared symmetric key configured on the web server and all users.

Question 19

A security analyst receives an alert about a user account attempting to access multiple network shares in rapid succession within a short time frame. The analyst reviews the logs and sees that the IP address originates from the internal network, but the user is currently on leave. Which type of attack is most likely occurring?

Accepted Answer

Internal reconnaissance. The behavior—an internal IP address rapidly querying multiple network shares—is characteristic of internal reconnaissance, where an attacker who has already gained a foothold maps out available resources. The user being on leave indicates the account is compromised, and the rapid succession of share access attempts is a classic sign of automated enumeration (e.g., using `net view` or SMB queries) rather than a direct credential attack.

Answer

Pass-the-hash attack

Answer

Brute-force attack

Answer

Credential stuffing attack

Question 20

A security analyst notices a sudden increase in outbound traffic from a database server that normally only communicates with internal application servers. The server is running a standard OS with no recent changes. Which of the following actions should the analyst take FIRST to determine if the server is compromised?

Accepted Answer

Check the server's running processes for unknown executables.. Checking the server's running processes for unknown executables is the first and most direct step to identify if an attacker has established a foothold. A sudden outbound traffic spike without recent configuration changes strongly suggests a malicious process (e.g., a reverse shell or data exfiltration tool) is running. Examining running processes allows the analyst to spot suspicious executables or command-line arguments before taking more disruptive actions like blocking traffic or running a scan.

Answer

Run a full antivirus scan on the server.

Answer

Block all outbound traffic from the server at the firewall.

Answer

Review the server's event logs for failed login attempts.