SY0-701 Practice Test 31 — 15 Questions

Question 1

A security manager at a financial services company is evaluating the effectiveness of a newly deployed security awareness training program. The program included modules on recognizing phishing emails, password security, and tailgating. One month after the training, the manager wants to assess whether employees are applying the learned behaviors to reduce the risk of phishing attacks. Which of the following metrics would provide the most valid indication of the training's behavioral impact?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The reduction in the employee click-through rate on simulated phishing campaigns.. The reduction in the employee click-through rate on simulated phishing campaigns directly measures a change in behavior—specifically, whether employees are applying the training to avoid clicking malicious links. Unlike knowledge scores or completion rates, this metric captures real-world application of the learned behavior in a controlled, measurable environment.

Answer

The percentage of employees who completed the training modules.

Answer

The average score on the post-training knowledge quiz.

Answer

The number of reported phishing incidents to the security team.

Question 2

A user database is stolen from a SaaS portal. Investigators discover the password column contains the same value for every user who chose "Summer2026!", and an attacker could use precomputed tables to crack weak passwords quickly. Which change best addresses both the repeated-value issue and rainbow-table risk?

Accepted Answer

Store each password with a unique salt and an adaptive hash such as bcrypt or Argon2. Using a unique salt per password ensures that even if two users choose the same password (e.g., 'Summer2026!'), their stored hashes will differ, eliminating the repeated-value issue. Additionally, adaptive hash functions like bcrypt or Argon2 are computationally expensive, making precomputed rainbow tables infeasible even if the salts were known, as each guess requires re-hashing with the specific salt.

Answer

Encrypt all stored passwords with AES and keep one shared key

Answer

Use SHA-256 without a salt

Answer

Add a digital signature to each password record

Question 3

An online retailer is redesigning its public web application so the web server can receive internet traffic, the application server can only be reached by the web tier, and the database server can only be reached by the application tier. Which placement best supports this design?

Accepted Answer

Put the web server in a public zone, the application server in a private zone, and the database server in an isolated internal zone.. It implements a classic three-tier architecture with network segmentation. The web server in a public zone (DMZ) accepts internet traffic, the application server in a private zone is isolated from direct internet access and only reachable by the web tier, and the database server in an isolated internal zone is only reachable by the application tier. This design enforces the principle of least privilege and minimizes the attack surface by using firewalls or security groups to restrict traffic between tiers.

Answer

Place all three servers on the same private subnet and control access only with strong passwords.

Answer

Put the database in the public zone so the web tier can query it directly from the internet.

Answer

Use a single reverse proxy for all three servers and disable network segmentation to simplify management.

Question 4

Based on the exhibit, what network attack is most likely occurring on the office LAN?

Accepted Answer

ARP poisoning, because a rogue system is sending false layer 2 address mappings.. ARP poisoning is the correct answer because the exhibit shows a rogue system sending unsolicited ARP replies that map the gateway's IP address to the attacker's MAC address. This causes traffic destined for the gateway to be redirected to the attacker, enabling man-in-the-middle interception. The attack exploits the lack of authentication in ARP, allowing false layer 2 address mappings to corrupt the ARP cache of other hosts on the LAN.

Answer

Replay attack, because the same ARP reply appears multiple times.

Answer

Denial of service, because users notice certificate warnings.

Answer

DNS poisoning, because the users cannot reach internal sites cleanly.

Question 5

A software vendor distributes critical security updates for its application through a public download website. The vendor wants to allow customers to verify that each update originated from the vendor and has not been modified in transit. Which of the following cryptographic techniques should the vendor apply to the update files before posting them for download?

Accepted Answer

Digital signature. A digital signature provides both authentication (proving the update originated from the vendor) and integrity (detecting any modification in transit). The vendor signs the file with their private key, and customers verify the signature using the vendor's public key, ensuring the file has not been altered since signing.

Answer

Cryptographic hash

Answer

Antivirus scan report

Answer

TLS certificate

Question 6

A scan of a web server hosting an internal help-desk portal reports these findings: `/var/www/uploads` is world-writable by the application account, PHP files in that directory are executed by Apache, and the app allows users to upload images without content-type validation. Which issue should be remediated first to most reduce the chance of remote code execution?

Accepted Answer

World-writable executable upload path, because an attacker could upload or modify server-executable code in a web-accessible directory.. The combination of a world-writable upload directory, PHP execution in that directory, and no content-type validation allows an attacker to upload a malicious PHP file (e.g., a web shell) and execute it via the web server, achieving remote code execution. This directly exploits the server's trust in user-supplied files and the execution context of Apache, making it the most immediate and severe risk.

Answer

Outdated browser plug-in on an admin workstation, because it may expose users to drive-by attacks.

Answer

Default SNMP community string on a printer in a separate VLAN, because it weakens network monitoring.

Answer

Missing disk encryption on a help-desk laptop, because stolen devices are a common breach source.

Question 7

Based on the exhibit, which security issue should the analyst report first?

Accepted Answer

Exposed service, because VNC and the web admin interface are reachable from untrusted networks.. The scan reveals that VNC (port 5900) and a web admin interface (port 443 or 8080) are exposed to untrusted networks, such as the internet. This violates the principle of least exposure, as these services are known attack vectors for remote code execution and credential theft. The analyst should prioritize this issue because an exposed service directly increases the attack surface and risk of unauthorized access, whereas other findings may be less immediately critical.

Answer

Outdated component, because the scan did not list software version details.

Answer

Weak permissions, because SSH requires password login only.

Answer

Default credentials, because the server is in the DMZ.

Question 8

A customer portal must keep operating if one application server fails. Management wants the simplest and lowest-cost design that still improves availability. What should the team implement?

Accepted Answer

Deploy a hot standby application server with automatic failover.. A hot standby (active/passive) application server with automatic failover provides the simplest and lowest-cost improvement to availability. It eliminates the single point of failure by having a standby server ready to take over if the primary fails, without requiring complex load balancing or synchronous replication. This design directly addresses the requirement of keeping the portal operational during a single server failure while minimizing cost and complexity.

Answer

Add more backups and schedule them every hour.

Answer

Use a second data center with synchronous replication and active-active clustering.

Answer

Restart the failed server manually after the help desk is notified.

Question 9

A SaaS portal issues signed JWTs in a browser cookie. The help desk confirms a user logged out at 09:10, but SIEM logs show the same token was accepted from a different IP at 09:12 and continued working until the token expired. The application does not keep a server-side revocation list. What weakness is most likely being abused?

Accepted Answer

Session hijacking or session abuse, because the attacker can replay a valid token after logout without revocation.. The scenario describes a classic session hijacking or session abuse attack. The application issues signed JWTs in cookies and does not maintain a server-side revocation list, meaning once a token is issued, it remains valid until its expiration. Even after the legitimate user logs out at 09:10, the attacker can replay the same JWT from a different IP at 09:12, and the server will accept it because there is no mechanism to invalidate the token. This lack of revocation is the core weakness being exploited.

Answer

SQL injection, because the attacker must be manipulating backend database logic to reuse the token.

Answer

Insecure deserialization, because the token is being decoded and reconstructed on the server.

Answer

Cross-site request forgery, because the request is coming from a different IP address.

Question 10

An organization is retiring a batch of laptops with SSDs. All of the systems used full-disk encryption and stored sensitive internal documents. What is the best action before the devices leave the company?

Accepted Answer

Perform a cryptographic erase by destroying the encryption keys and document the sanitization process.. A cryptographic erase (also known as a crypto-scrub) renders the encrypted data permanently inaccessible by securely destroying the encryption keys. Since the SSDs used full-disk encryption (FDE), the data is already encrypted at rest, and without the keys, the ciphertext is effectively unrecoverable. This method is fast, reliable, and compliant with sanitization standards like NIST SP 800-88, making it the best action before the devices leave the organization.

Answer

Run a quick format and remove the asset tags after the files are deleted.

Answer

Degauss the SSDs and then store them in the disposal room until pickup.

Answer

Overwrite the drives once with random data and consider the devices ready for resale.

Question 11

A company uses MFA, endpoint protection, firewalls, and network segmentation together to protect a customer portal. Which security principle does this best illustrate?

Accepted Answer

Defense in depth, because multiple layers protect the same asset.. Defense in depth is the correct principle because the company is deploying multiple, overlapping security controls—MFA, endpoint protection, firewalls, and network segmentation—to protect the same customer portal. This layered approach ensures that if one control fails (e.g., a firewall rule is misconfigured), other controls (e.g., endpoint detection or segmentation) still provide protection, reducing the overall risk of a single point of compromise.

Answer

Need-to-know, because users only see the data assigned to them.

Answer

Separation of duties, because no single person performs every security task.

Answer

Zero trust, because the portal is hosted in the cloud.

Question 12

A web portal for customer refunds checks device health at sign-in, then re-checks the device and user context before each refund over a threshold. A session that started on a managed laptop is blocked when the laptop later fails posture checks, even though the password remains valid. Which principle is best illustrated?

Accepted Answer

Zero trust. The scenario describes a system that continuously verifies trust—checking device health at sign-in and re-evaluating both device and user context before each high-value action—and blocks access even when the password is valid. This is the core of Zero Trust: 'never trust, always verify,' where authentication and authorization are re-assessed at every transaction, not just at session start. The policy enforces access decisions based on real-time posture (e.g., device compliance, user behavior) rather than relying solely on a static credential.

Answer

Defense in depth

Answer

Least privilege

Answer

Need-to-know

Question 13

A CFO at a mid-sized company receives an urgent email that appears to come from the CEO's email address, requesting an immediate wire transfer of $50,000 to a new vendor for a time-sensitive project. The email address displayed is 'ceo@cornpany.com' instead of the legitimate 'ceo@company.com'. The CFO follows the instruction and initiates the transfer. Later, the real CEO denies sending such a request. Which of the following security controls would have been MOST effective in preventing this type of attack from succeeding?

Accepted Answer

Implementing a policy that all financial transfers over a certain threshold must be verbally verified via a known phone number before execution. The attack is a business email compromise (BEC) using a lookalike domain. A policy requiring verbal verification via a known phone number adds a human out-of-band check that bypasses the email channel entirely, preventing the fraudulent transfer even if the email appears legitimate. This control directly addresses the social engineering aspect of the attack, which technical controls alone cannot fully mitigate.

Answer

Deploying a stronger email spam filter that blocks all emails from unrecognized domains

Answer

Requiring multi-factor authentication (MFA) for all corporate email accounts

Answer

Enabling Transport Layer Security (TLS) encryption for all outgoing email communications

Question 14

Based on the exhibit, what vulnerability is the application most likely suffering from?

Accepted Answer

Stored cross-site scripting, because attacker-controlled script is saved and later rendered to other users.. The application stores user-supplied input in a review field and later renders it to other users without proper sanitization. The exhibit shows a script tag attempting to exfiltrate cookies to a remote host, which is a classic stored cross-site scripting (XSS) payload. Because the malicious script is persisted on the server and executed in the browsers of subsequent visitors, the vulnerability is stored XSS.

Answer

Command injection, because the script attempts to send cookies to a remote host.

Answer

Session fixation, because users saw the same review page after posting.

Answer

Insecure deserialization, because the payload is embedded in a review field.

Question 15

A security analyst receives a phone call from an individual claiming to be a member of the IT help desk. The caller states that an emergency security update requires the analyst's password immediately, and the request sounds urgent. The analyst notices the caller's voice is unfamiliar and the background noise is inconsistent with an office environment. Which type of social engineering attack is being attempted?

Accepted Answer

Vishing. This is a vishing (voice phishing) attack because the threat actor uses a phone call to impersonate IT help desk personnel and pressures the analyst into disclosing sensitive credentials. Vishing specifically leverages voice communication to bypass email-based security controls and exploit human trust through urgency and authority.

Answer

Phishing

Answer

Spear phishing

Answer

Pretexting