SY0-701 Practice Test 31 — 15 Questions

Question 1

A company uses four cloud applications and wants employees to sign in once with corporate credentials. The applications should trust the company’s identity platform, and disabling a user in the directory should remove access everywhere without separate password resets. Which architecture should the team implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use federation with single sign-on through the corporate identity provider, such as SAML or OpenID Connect.. Federation with single sign-on (SSO) using the corporate identity provider (IdP) via SAML or OpenID Connect allows users to authenticate once with their corporate credentials. The cloud applications trust the IdP, so disabling a user in the corporate directory immediately revokes access across all applications without requiring separate password resets. This architecture decouples authentication from the applications and centralizes identity management.

Answer

Create separate local accounts in each cloud application and synchronize passwords manually.

Answer

Configure RADIUS authentication directly on each cloud application so users can reuse one password.

Answer

Store one shared administrator password for all users in a password vault.

Question 2

A company wants employees to sign in once to several SaaS apps, while the security team also wants to require extra verification when users sign in from unmanaged devices or unusual locations. Which two architecture changes best satisfy both requirements? Select two.

Accepted Answer

Federate authentication to a central identity provider.. Federating authentication to a central identity provider (IdP) enables single sign-on (SSO) across multiple SaaS apps using standards like SAML 2.0 or OIDC. This allows employees to sign in once, while the IdP becomes a centralized point to enforce additional security controls.

Answer

Create separate passwords for each SaaS app so compromise is contained.

Answer

Turn off MFA because single sign-on already reduces logins.

Answer

Use shared generic accounts for contractors to simplify onboarding.

Question 3

A security analyst observes a critical server generating unusually high outbound traffic to an external IP address that is listed on a threat intelligence feed as a known command-and-control server. The analyst suspects the server is compromised. According to standard incident response procedures, what should the analyst do NEXT?

Accepted Answer

Isolate the server from the network to stop the communication. Isolating the server from the network immediately stops the outbound command-and-control (C2) communication, preventing data exfiltration and further compromise. This aligns with the first step in the NIST SP 800-61 incident response process—containment—before any eradication or recovery actions are taken. Rebooting or patching without isolation could destroy volatile evidence (e.g., memory-resident malware) and allow the attacker to persist or escalate.

Answer

Reboot the server to clear any malicious processes from memory

Answer

Apply the latest security patches to the server

Answer

Ignore the alert because the external IP might be a false positive

Question 4

A security analyst observes repeated outbound traffic from a single workstation to a known malicious IP address. The workstation's anti-malware software has reported no alerts, and the user claims to have only downloaded software from the company's approved application store. Which type of malware most likely explains this behavior?

Accepted Answer

Trojan horse. The Trojan horse is correct because it is a type of malware that disguises itself as legitimate software, often downloaded from trusted sources like an approved application store, to bypass security controls. Once installed, it can silently establish outbound connections to a command-and-control (C2) server, such as the known malicious IP address observed, without triggering anti-malware alerts if the Trojan is not yet in the signature database. This matches the scenario where the user downloaded from an approved store, the anti-malware reported no alerts, and the workstation is communicating with a malicious IP.

Answer

Ransomware

Answer

Rootkit

Answer

Polymorphic malware

Question 5

A DevOps team builds container images in a CI/CD pipeline. Security wants to reduce the chance of deploying vulnerable libraries and also wants the cluster to reject images that have not been approved. Which approach best meets both requirements?

Accepted Answer

Scan images in the pipeline and enforce signature verification or admission control before deployment.. It combines two essential security controls: scanning container images for known vulnerabilities (e.g., using Trivy or Clair) during the CI/CD pipeline, and enforcing signature verification (e.g., using Notary or Cosign) or admission control (e.g., using OPA/Gatekeeper or Kyverno) to ensure only signed or approved images are deployed. This directly reduces the risk of deploying vulnerable libraries and prevents unapproved images from running in the cluster.

Answer

Increase CPU and memory limits for the containers so they run more safely.

Answer

Allow developers to pull images from any registry as long as the tags look familiar.

Answer

Disable pipeline scanning to speed releases and rely on runtime monitoring after deployment.

Question 6

Based on the exhibit, what is the best improvement to reduce the impact if one backup server is compromised?

Accepted Answer

Store encryption keys in a centralized KMS or HSM and use distinct keys with rotation.. Using a centralized Key Management System (KMS) or Hardware Security Module (HSM) with distinct, rotated keys ensures that compromising one backup server does not expose the encryption keys for all backups. This isolates the impact to only the data encrypted with that specific key, and key rotation further limits the window of exposure. In contrast, sharing a single key file across servers creates a single point of failure, as compromising one server reveals the key for all backups.

Answer

Keep the same key file but rename it so attackers cannot find it easily.

Answer

Replace AES with SHA-256 so the backups are harder to read.

Answer

Email the key file to backup operators so they can restore data quickly.

Question 7

An HR portal has three job functions: HR staff update employee records, managers approve leave requests, and payroll views salary data. The security team wants to prevent any one role from having all capabilities. Which access design is the best fit?

Accepted Answer

Create role-based access groups aligned to each job function and grant only the permissions needed for that role.. Role-based access control (RBAC) is the correct design because it enforces the principle of least privilege by granting each job function only the permissions necessary for its tasks. This prevents any single role from accumulating all capabilities (e.g., HR staff cannot approve leave or view salary data), directly addressing the security team's requirement to separate duties. RBAC aligns with NIST SP 800-53 AC-6 and is a standard access control model for multi-role enterprise applications.

Answer

Use a single superuser account for the entire department so tasks can be completed quickly.

Answer

Give every employee access to all portal features and depend on audit logs to catch mistakes later.

Answer

Require the payroll team to share one common password and use it only from the office network.

Question 8

Based on the exhibit, what type of malware behavior is most likely occurring?

Accepted Answer

Fileless attack, because PowerShell was launched in memory with no new payload written to disk.. The exhibit shows PowerShell being launched in memory with no new payload written to disk, which is the hallmark of a fileless attack. Fileless malware exploits legitimate system tools like PowerShell to execute malicious code directly in memory, evading traditional signature-based detection that relies on scanning files on disk.

Answer

Ransomware, because the endpoint made an outbound connection after opening a document.

Answer

Spyware, because the laptop made an encrypted outbound connection.

Answer

Worm activity, because the laptop communicated with an external IP address.

Question 9

A security manager at a financial services company is evaluating the effectiveness of a newly deployed security awareness training program. The program included modules on recognizing phishing emails, password security, and tailgating. One month after the training, the manager wants to assess whether employees are applying the learned behaviors to reduce the risk of phishing attacks. Which of the following metrics would provide the most valid indication of the training's behavioral impact?

Accepted Answer

The reduction in the employee click-through rate on simulated phishing campaigns.. The reduction in the employee click-through rate on simulated phishing campaigns directly measures a change in behavior—specifically, whether employees are applying the training to avoid clicking malicious links. Unlike knowledge scores or completion rates, this metric captures real-world application of the learned behavior in a controlled, measurable environment.

Answer

The percentage of employees who completed the training modules.

Answer

The average score on the post-training knowledge quiz.

Answer

The number of reported phishing incidents to the security team.

Question 10

A user database is stolen from a SaaS portal. Investigators discover the password column contains the same value for every user who chose "Summer2026!", and an attacker could use precomputed tables to crack weak passwords quickly. Which change best addresses both the repeated-value issue and rainbow-table risk?

Accepted Answer

Store each password with a unique salt and an adaptive hash such as bcrypt or Argon2. Using a unique salt per password ensures that even if two users choose the same password (e.g., 'Summer2026!'), their stored hashes will differ, eliminating the repeated-value issue. Additionally, adaptive hash functions like bcrypt or Argon2 are computationally expensive, making precomputed rainbow tables infeasible even if the salts were known, as each guess requires re-hashing with the specific salt.

Answer

Encrypt all stored passwords with AES and keep one shared key

Answer

Use SHA-256 without a salt

Answer

Add a digital signature to each password record

Question 11

An online retailer is redesigning its public web application so the web server can receive internet traffic, the application server can only be reached by the web tier, and the database server can only be reached by the application tier. Which placement best supports this design?

Accepted Answer

Put the web server in a public zone, the application server in a private zone, and the database server in an isolated internal zone.. It implements a classic three-tier architecture with network segmentation. The web server in a public zone (DMZ) accepts internet traffic, the application server in a private zone is isolated from direct internet access and only reachable by the web tier, and the database server in an isolated internal zone is only reachable by the application tier. This design enforces the principle of least privilege and minimizes the attack surface by using firewalls or security groups to restrict traffic between tiers.

Answer

Place all three servers on the same private subnet and control access only with strong passwords.

Answer

Put the database in the public zone so the web tier can query it directly from the internet.

Answer

Use a single reverse proxy for all three servers and disable network segmentation to simplify management.

Question 12

Based on the exhibit, what network attack is most likely occurring on the office LAN?

Accepted Answer

ARP poisoning, because a rogue system is sending false layer 2 address mappings.. ARP poisoning is the correct answer because the exhibit shows a rogue system sending unsolicited ARP replies that map the gateway's IP address to the attacker's MAC address. This causes traffic destined for the gateway to be redirected to the attacker, enabling man-in-the-middle interception. The attack exploits the lack of authentication in ARP, allowing false layer 2 address mappings to corrupt the ARP cache of other hosts on the LAN.

Answer

Replay attack, because the same ARP reply appears multiple times.

Answer

Denial of service, because users notice certificate warnings.

Answer

DNS poisoning, because the users cannot reach internal sites cleanly.

Question 13

A software vendor distributes critical security updates for its application through a public download website. The vendor wants to allow customers to verify that each update originated from the vendor and has not been modified in transit. Which of the following cryptographic techniques should the vendor apply to the update files before posting them for download?

Accepted Answer

Digital signature. A digital signature provides both authentication (proving the update originated from the vendor) and integrity (detecting any modification in transit). The vendor signs the file with their private key, and customers verify the signature using the vendor's public key, ensuring the file has not been altered since signing.

Answer

Cryptographic hash

Answer

Antivirus scan report

Answer

TLS certificate

Question 14

A scan of a web server hosting an internal help-desk portal reports these findings: `/var/www/uploads` is world-writable by the application account, PHP files in that directory are executed by Apache, and the app allows users to upload images without content-type validation. Which issue should be remediated first to most reduce the chance of remote code execution?

Accepted Answer

World-writable executable upload path, because an attacker could upload or modify server-executable code in a web-accessible directory.. The combination of a world-writable upload directory, PHP execution in that directory, and no content-type validation allows an attacker to upload a malicious PHP file (e.g., a web shell) and execute it via the web server, achieving remote code execution. This directly exploits the server's trust in user-supplied files and the execution context of Apache, making it the most immediate and severe risk.

Answer

Outdated browser plug-in on an admin workstation, because it may expose users to drive-by attacks.

Answer

Default SNMP community string on a printer in a separate VLAN, because it weakens network monitoring.

Answer

Missing disk encryption on a help-desk laptop, because stolen devices are a common breach source.

Question 15

Based on the exhibit, which security issue should the analyst report first?

Accepted Answer

Exposed service, because VNC and the web admin interface are reachable from untrusted networks.. The scan reveals that VNC (port 5900) and a web admin interface (port 443 or 8080) are exposed to untrusted networks, such as the internet. This violates the principle of least exposure, as these services are known attack vectors for remote code execution and credential theft. The analyst should prioritize this issue because an exposed service directly increases the attack surface and risk of unauthorized access, whereas other findings may be less immediately critical.

Answer

Outdated component, because the scan did not list software version details.

Answer

Weak permissions, because SSH requires password login only.

Answer

Default credentials, because the server is in the DMZ.