SY0-701 Practice Test 31 — 15 Questions

Question 1

Help desk staff must restart one Windows service and read its event logs on 150 servers, but they should not have local administrator rights or interactive logon to the systems. Which approach best supports this requirement?

Accepted Answer

Use a Just Enough Administration constrained endpoint for the allowed tasks.. Just Enough Administration (JEA) allows you to create constrained PowerShell endpoints that delegate specific administrative tasks—such as restarting a service and reading event logs—without granting full local administrator rights or interactive logon. By defining role capabilities that limit cmdlets and parameters, help desk staff can perform only the required operations on all 150 servers via a constrained endpoint, meeting the security requirement precisely.

Answer

Create one shared local administrator account for the entire help desk team.

Answer

Add the staff to the local Administrators group on every server.

Answer

Run the maintenance job under each technician's personal account on a schedule.

Question 2

Paper onboarding forms have reached the end of their retention period, and no legal hold applies. What should happen next?

Accepted Answer

Destroy them using an approved secure disposal method.. Once paper onboarding forms have reached the end of their retention period and no legal hold applies, the organization must destroy them using an approved secure disposal method (e.g., cross-cut shredding, pulping, or incineration) to prevent unauthorized access to personally identifiable information (PII) and comply with data protection regulations such as GDPR or HIPAA. Retaining data beyond its required lifecycle violates the data minimization principle and increases breach risk.

Answer

Store them indefinitely in case the company needs them later.

Answer

Scan them to a personal cloud account so they are not lost.

Answer

Mail copies to every manager for review before disposal.

Question 3

Several employees nearly entered credentials into a fake mailbox login page. The security team wants to reduce repeat mistakes quickly without overwhelming the whole company. What is the best communication approach?

Accepted Answer

Send a short targeted notice to the affected users with examples, warning signs, and reporting steps. A short targeted notice to the affected users is the best approach because it directly addresses the immediate threat without overwhelming the entire company. This method allows the security team to quickly reinforce specific warning signs (e.g., mismatched URLs, lack of HTTPS/TLS certificates) and reporting procedures, reducing the likelihood of repeat mistakes while maintaining operational efficiency.

Answer

Wait until the annual security training cycle to address the issue

Answer

Disable all external email until the next awareness campaign is completed

Answer

Send a company-wide message naming the affected employees to discourage mistakes

Question 4

Security receives a company-owned laptop connected to an insider theft investigation. Before the device is transported to the evidence locker, what is the BEST action to support chain of custody?

Accepted Answer

Seal the device in an evidence bag and record each handoff with signatures. Option B is correct because sealing the device in an evidence bag and recording each handoff with signatures establishes a documented, unbroken chain of custody. This ensures the integrity of the evidence by preventing tampering and providing a verifiable record of who handled the device and when, which is critical for admissibility in legal proceedings.

Answer

Factory reset the laptop so investigators can start from a clean system

Answer

Remove the hard drive and image it without any documentation

Answer

Leave the laptop unlocked so the next analyst can inspect it quickly

Question 5

System administrators need to manage internal switches from home. The solution must encrypt management traffic, strongly authenticate users, and avoid exposing management ports directly to the internet. What should be used?

Accepted Answer

A VPN into the internal network, then SSH or HTTPS for administration.. Option B is correct because a VPN creates an encrypted tunnel over the internet, protecting management traffic in transit. Once connected to the internal network, SSH (for CLI) or HTTPS (for web GUI) provides strong authentication and encryption for switch administration. This approach avoids exposing management ports directly to the internet, reducing the attack surface.

Answer

Telnet over port 23 with an allow list on the firewall.

Answer

RDP directly to the switch management interface from the public IP address.

Answer

Open the management port to the internet and rely on a long password.

Question 6

Which document tells all employees what they are allowed and not allowed to do when using company systems?

Accepted Answer

Policy. A policy is a high-level document that defines mandatory rules and expectations for employee behavior when using company systems. It specifies what is allowed and prohibited, such as acceptable use of email, internet browsing, and data handling, and is enforceable with consequences for non-compliance.

Answer

Procedure

Answer

Standard

Answer

Guideline

Question 7

The security team configures the badge system so employees must present both a badge and a PIN before entering the data center. The access logs are reviewed weekly for failed attempts. Which pair of control types best describes these measures?

Accepted Answer

Preventive and detective, because one measure blocks access and the other identifies suspicious activity.. Option A is correct because the badge and PIN requirement is a preventive control that blocks unauthorized access to the data center, while the weekly review of access logs is a detective control that identifies suspicious activity after the fact. Preventive controls stop incidents before they occur, and detective controls discover violations that have already happened, making this pair the best fit for the described measures.

Answer

Corrective and recovery, because the logs can restore access after a badge failure.

Answer

Deterrent and compensating, because the PIN discourages attackers and the logs replace the badge reader.

Answer

Administrative and physical, because the weekly review and the badge reader are both physical measures.

Question 8

Users on the same VLAN report that their browser occasionally reaches a fake internal portal, and packet captures show one host sending forged ARP replies that claim to be the default gateway. Traffic from nearby systems begins flowing through that host. Which attack is occurring?

Accepted Answer

ARP spoofing. B is correct because the scenario describes ARP spoofing (also known as ARP poisoning). The attacker sends forged ARP replies to associate their MAC address with the default gateway's IP address, causing traffic from other hosts on the same VLAN to be redirected through the attacker's machine. This allows the attacker to intercept, modify, or redirect traffic to a fake internal portal, which is a classic man-in-the-middle (MITM) attack leveraging the stateless nature of ARP.

Answer

DNS poisoning

Answer

MAC flooding

Answer

SYN flood

Question 9

Network engineers need to administer internal switches from home. The company wants encrypted management traffic, strong user verification, and no management ports exposed directly to the internet. Which approach is best?

Accepted Answer

Require a VPN or ZTNA connection with MFA, then allow SSH or HTTPS management only through that protected tunnel.. Option A is correct because it enforces encryption (via VPN or ZTNA tunnel), strong user verification (MFA), and network segmentation (no direct internet exposure). SSH or HTTPS management traffic is then allowed only through the protected tunnel, ensuring confidentiality, integrity, and access control. This aligns with the principle of defense in depth for remote network device administration.

Answer

Expose SSH on the internet and rely on key-based authentication alone.

Answer

Use RDP with port forwarding because it is simpler for remote support.

Answer

Allow split tunneling without MFA so engineers can reduce latency while working remotely.

Question 10

The help desk needs a document that describes the exact steps for verifying a caller and resetting a password. What type of document should they use?

Accepted Answer

Procedure. A procedure provides the exact, step-by-step instructions needed for a specific task, such as verifying a caller's identity and resetting a password. This is distinct from a policy, which states high-level rules, or a standard, which defines mandatory technical requirements. The help desk needs a documented sequence of actions, which is the definition of a procedure.

Answer

Policy

Answer

Standard

Answer

Guideline

Question 11

Threat intelligence shows an attacker changes domains every day, but the malware file itself stays the same across incidents. Which indicator would be the best to block immediately if you find it in your environment?

Accepted Answer

The malware file hash from the shared sample. The malware file hash (e.g., MD5, SHA-1, or SHA-256) is a unique fingerprint of the file's binary content. Since the malware file itself remains unchanged across incidents, its hash is a static, reliable indicator of compromise (IoC) that can be immediately blocked via file reputation or hash-based detection rules, regardless of domain changes.

Answer

The current weather in the city where the attack was observed

Answer

The logo used on the phishing email

Answer

The time zone used by the help desk

Question 12

To reduce fraud, a finance system requires one user to create a payment batch, a different user to approve it, and a third role to release it to the bank. An audit recommends adding a "super-user" who can perform all three steps to speed month-end close. Which principle would that recommendation most directly weaken?

Accepted Answer

Separation of duties. The recommendation to create a super-user who can create, approve, and release payment batches directly violates the separation of duties principle. This principle requires that critical tasks be divided among multiple individuals to prevent any single person from having the ability to commit fraud without collusion. By allowing one user to perform all three steps, the system loses the fraud-prevention control that requires independent actors for each stage of the payment lifecycle.

Answer

Least privilege

Answer

Need-to-know

Answer

Defense in depth

Question 13

NetFlow and authentication logs show one workstation opening SMB and WinRM sessions to many internal hosts within ten minutes. The same source also generates a sharp rise in Kerberos service-ticket requests and attempts to access administrative shares. Which three observations most strongly support lateral movement rather than normal admin activity? Select three.

Accepted Answer

A rapid burst of SMB and WinRM connections to many internal systems from one source host.. Option A is correct because a rapid burst of SMB and WinRM connections from a single workstation to many internal hosts is a classic indicator of lateral movement. Normal administrative activity typically involves targeted, sequential connections to specific systems for maintenance, not a broad, automated sweep. This pattern suggests an attacker using tools like PsExec or PowerShell remoting to propagate across the network.

Answer

Regular outbound DNS lookups for common internet services like time synchronization or content delivery.

Answer

A successful sign-in to the user's cloud email account from the employee's home network at lunchtime.

Question 14

The help desk can patch endpoints only after testing on a few pilot systems because one legacy app sometimes breaks after updates. What patching approach is most secure and least disruptive?

Accepted Answer

Apply updates to a small pilot group first, then roll them out in stages to the rest of the fleet.. Option A is correct because it follows a phased rollout strategy: testing on a small pilot group first validates compatibility with the legacy app, then staged deployment minimizes disruption while ensuring security patches are applied promptly. This balances the need for security updates with the operational requirement to avoid breaking critical legacy software.

Answer

Wait until all applications are fully modernized before installing any security updates.

Answer

Patch every endpoint immediately at the same time without testing to reduce management overhead.

Answer

Disable automatic updates permanently and patch only after a confirmed incident.

Question 15

Which two are common warning signs of phishing messages? Select two.

Accepted Answer

Urgent threat that the account will be locked in 15 minutes. Option A is correct because phishing messages often create a false sense of urgency, such as claiming an account will be locked in 15 minutes, to pressure the recipient into acting without verifying the source. This tactic exploits the human tendency to react quickly to threats, bypassing rational checks like inspecting the sender's email address or hovering over links.

Answer

Message sent from a trusted internal help desk portal

Answer

Correct spelling and matching domain name

Answer

Email signed with a known employee's regular signature block