SY0-701 Practice Test 32 — 15 Questions

Question 1

A customer portal must keep operating if one application server fails. Management wants the simplest and lowest-cost design that still improves availability. What should the team implement?

Accepted Answer

Deploy a hot standby application server with automatic failover.. A hot standby (active/passive) application server with automatic failover provides the simplest and lowest-cost improvement to availability. It eliminates the single point of failure by having a standby server ready to take over if the primary fails, without requiring complex load balancing or synchronous replication. This design directly addresses the requirement of keeping the portal operational during a single server failure while minimizing cost and complexity.

Answer

Add more backups and schedule them every hour.

Answer

Use a second data center with synchronous replication and active-active clustering.

Answer

Restart the failed server manually after the help desk is notified.

Question 2

A SaaS portal issues signed JWTs in a browser cookie. The help desk confirms a user logged out at 09:10, but SIEM logs show the same token was accepted from a different IP at 09:12 and continued working until the token expired. The application does not keep a server-side revocation list. What weakness is most likely being abused?

Accepted Answer

Session hijacking or session abuse, because the attacker can replay a valid token after logout without revocation.. The scenario describes a classic session hijacking or session abuse attack. The application issues signed JWTs in cookies and does not maintain a server-side revocation list, meaning once a token is issued, it remains valid until its expiration. Even after the legitimate user logs out at 09:10, the attacker can replay the same JWT from a different IP at 09:12, and the server will accept it because there is no mechanism to invalidate the token. This lack of revocation is the core weakness being exploited.

Answer

SQL injection, because the attacker must be manipulating backend database logic to reuse the token.

Answer

Insecure deserialization, because the token is being decoded and reconstructed on the server.

Answer

Cross-site request forgery, because the request is coming from a different IP address.

Question 3

An organization is retiring a batch of laptops with SSDs. All of the systems used full-disk encryption and stored sensitive internal documents. What is the best action before the devices leave the company?

Accepted Answer

Perform a cryptographic erase by destroying the encryption keys and document the sanitization process.. A cryptographic erase (also known as a crypto-scrub) renders the encrypted data permanently inaccessible by securely destroying the encryption keys. Since the SSDs used full-disk encryption (FDE), the data is already encrypted at rest, and without the keys, the ciphertext is effectively unrecoverable. This method is fast, reliable, and compliant with sanitization standards like NIST SP 800-88, making it the best action before the devices leave the organization.

Answer

Run a quick format and remove the asset tags after the files are deleted.

Answer

Degauss the SSDs and then store them in the disposal room until pickup.

Answer

Overwrite the drives once with random data and consider the devices ready for resale.

Question 4

A company uses MFA, endpoint protection, firewalls, and network segmentation together to protect a customer portal. Which security principle does this best illustrate?

Accepted Answer

Defense in depth, because multiple layers protect the same asset.. Defense in depth is the correct principle because the company is deploying multiple, overlapping security controls—MFA, endpoint protection, firewalls, and network segmentation—to protect the same customer portal. This layered approach ensures that if one control fails (e.g., a firewall rule is misconfigured), other controls (e.g., endpoint detection or segmentation) still provide protection, reducing the overall risk of a single point of compromise.

Answer

Need-to-know, because users only see the data assigned to them.

Answer

Separation of duties, because no single person performs every security task.

Answer

Zero trust, because the portal is hosted in the cloud.

Question 5

A web portal for customer refunds checks device health at sign-in, then re-checks the device and user context before each refund over a threshold. A session that started on a managed laptop is blocked when the laptop later fails posture checks, even though the password remains valid. Which principle is best illustrated?

Accepted Answer

Zero trust. The scenario describes a system that continuously verifies trust—checking device health at sign-in and re-evaluating both device and user context before each high-value action—and blocks access even when the password is valid. This is the core of Zero Trust: 'never trust, always verify,' where authentication and authorization are re-assessed at every transaction, not just at session start. The policy enforces access decisions based on real-time posture (e.g., device compliance, user behavior) rather than relying solely on a static credential.

Answer

Defense in depth

Answer

Least privilege

Answer

Need-to-know

Question 6

A CFO at a mid-sized company receives an urgent email that appears to come from the CEO's email address, requesting an immediate wire transfer of $50,000 to a new vendor for a time-sensitive project. The email address displayed is 'ceo@cornpany.com' instead of the legitimate 'ceo@company.com'. The CFO follows the instruction and initiates the transfer. Later, the real CEO denies sending such a request. Which of the following security controls would have been MOST effective in preventing this type of attack from succeeding?

Accepted Answer

Implementing a policy that all financial transfers over a certain threshold must be verbally verified via a known phone number before execution. The attack is a business email compromise (BEC) using a lookalike domain. A policy requiring verbal verification via a known phone number adds a human out-of-band check that bypasses the email channel entirely, preventing the fraudulent transfer even if the email appears legitimate. This control directly addresses the social engineering aspect of the attack, which technical controls alone cannot fully mitigate.

Answer

Deploying a stronger email spam filter that blocks all emails from unrecognized domains

Answer

Requiring multi-factor authentication (MFA) for all corporate email accounts

Answer

Enabling Transport Layer Security (TLS) encryption for all outgoing email communications

Question 7

Based on the exhibit, what vulnerability is the application most likely suffering from?

Accepted Answer

Stored cross-site scripting, because attacker-controlled script is saved and later rendered to other users.. The application stores user-supplied input in a review field and later renders it to other users without proper sanitization. The exhibit shows a script tag attempting to exfiltrate cookies to a remote host, which is a classic stored cross-site scripting (XSS) payload. Because the malicious script is persisted on the server and executed in the browsers of subsequent visitors, the vulnerability is stored XSS.

Answer

Command injection, because the script attempts to send cookies to a remote host.

Answer

Session fixation, because users saw the same review page after posting.

Answer

Insecure deserialization, because the payload is embedded in a review field.

Question 8

A security analyst receives a phone call from an individual claiming to be a member of the IT help desk. The caller states that an emergency security update requires the analyst's password immediately, and the request sounds urgent. The analyst notices the caller's voice is unfamiliar and the background noise is inconsistent with an office environment. Which type of social engineering attack is being attempted?

Accepted Answer

Vishing. This is a vishing (voice phishing) attack because the threat actor uses a phone call to impersonate IT help desk personnel and pressures the analyst into disclosing sensitive credentials. Vishing specifically leverages voice communication to bypass email-based security controls and exploit human trust through urgency and authority.

Answer

Phishing

Answer

Spear phishing

Answer

Pretexting

Question 9

A vulnerability scan reports a critical finding on a legacy application server. The security team verifies that the flagged package is installed, but the vulnerable code path is disabled by configuration and cannot be exploited in the current deployment. The vendor will not support a patch until next quarter. What is the best next step?

Accepted Answer

Request a risk exception and document compensating controls until patching is possible. The vulnerability is real (the package is installed), but the risk is mitigated by a compensating control (the vulnerable code path is disabled). A risk exception formally documents this compensating control and the planned patch timeline, ensuring the finding is tracked and not forgotten. This aligns with the SY0-701 objective of managing risk through formal acceptance and compensating controls when immediate remediation is not possible.

Answer

Ignore the finding because the scanner produced a false positive

Answer

Disable the vulnerability scanner to prevent repeated alerts

Answer

Immediately retire the server even though the application is still business-critical

Question 10

A help desk manager wants sample customer tickets copied into a test environment so developers can reproduce support issues. The tickets include names, phone numbers, and account details. Which action best reduces privacy exposure while still supporting testing?

Accepted Answer

Mask or tokenize the personal data and restrict access to approved testers only.. Masking or tokenizing personal data (e.g., replacing names with pseudonyms, scrambling phone numbers) ensures that developers can work with realistic data structures without exposing personally identifiable information (PII). Restricting access to approved testers further enforces the principle of least privilege, which is a core security control for test environments. This approach balances the need for functional testing with compliance requirements like GDPR or HIPAA.

Answer

Export the full tickets because the developers need realistic records.

Answer

Copy the tickets to a shared cloud drive and protect it with a simple password.

Answer

Remove the account numbers only and leave the rest of the ticket untouched.

Question 11

A branch office has users, finance workstations, printers, and IP phones on one flat network. The security team wants to reduce lateral movement if one user PC is compromised, but printers still need to receive print jobs from users. What is the best design change?

Accepted Answer

Place finance systems and user devices in separate VLANs and allow only the necessary print and business application traffic through filtering rules.. Segmenting the flat network into separate VLANs for finance systems and user devices enforces network segmentation, which limits lateral movement. By using VLANs and firewall rules to allow only necessary traffic (e.g., print jobs via IPP or SMB, and business application traffic), the organization reduces the attack surface while maintaining required functionality. This aligns with the principle of least privilege and zero trust architecture.

Answer

Keep one flat network and increase endpoint antivirus scanning frequency.

Answer

Move all printers into the finance VLAN to avoid managing inter-VLAN rules.

Answer

Disable printing so user workstations cannot communicate with any other device.

Question 12

A security analyst is investigating a data integrity incident where an attacker exploited a vulnerability in a web application to alter customer account balance records in the database. The analyst identifies the exact records that were modified and restores those records from a verified read-only backup taken prior to the attack. Which security goal is the analyst primarily addressing by restoring the records from backup?

Accepted Answer

Integrity. Restoring the altered customer account balance records from a verified read-only backup directly addresses the integrity security goal. Integrity ensures that data is accurate and has not been modified by unauthorized parties. By reverting the records to their pre-attack state, the analyst is correcting the unauthorized modifications, thereby restoring the trustworthiness of the data.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 13

A security analyst at a manufacturing company notices multiple workstations generating high volumes of encrypted outbound traffic and displaying ransom notes. The analyst suspects a ransomware outbreak. According to the incident response process, which of the following should the analyst perform FIRST?

Accepted Answer

Isolate the affected workstations from the network by disconnecting their network cables and disabling Wi-Fi.. The first priority in a suspected ransomware outbreak is containment to prevent lateral spread and further encryption. Disconnecting network cables and disabling Wi-Fi immediately isolates the affected workstations from the network, stopping the ransomware from communicating with its command-and-control (C2) server or encrypting additional systems. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Answer

Immediately wipe the hard drives of all affected workstations and reinstall the operating system.

Answer

Contact local law enforcement to report the ransomware incident and request a forensic investigation.

Answer

Conduct a full forensic analysis of one affected workstation to determine the ransomware variant and entry vector.

Question 14

A Java-based internal portal accepts a serialized object during profile import. After a recent test upload, the server made outbound LDAP calls and created a new local account. What attack pattern best explains this behavior?

Accepted Answer

Insecure deserialization, because a crafted object triggered unexpected server-side actions.. The scenario describes a Java application accepting a serialized object during profile import, which is a classic vector for insecure deserialization attacks. By crafting a malicious serialized object, an attacker can trigger arbitrary code execution on the server, leading to outbound LDAP calls and local account creation—actions that are not part of normal profile import logic. This attack exploits the trust placed in serialized data without proper validation or integrity checks.

Answer

SQL injection, because the attacker likely altered a database query.

Answer

Cross-site scripting, because the attacker could have injected script into the portal.

Answer

CSRF, because the attacker may have forced an administrator to submit a form.

Question 15

Based on the exhibit, what type of malware is the most likely issue on the workstation?

Accepted Answer

Spyware, because the system appears to be collecting user data silently.. The exhibit shows a browser extension installed from an unofficial website that is silently collecting browsing data, including keystrokes and visited URLs, which is characteristic of spyware. Spyware operates by gathering user information without consent, often through seemingly legitimate software, and the absence of encryption or user notification confirms this classification.

Answer

Ransomware, because the browser settings changed after installation.

Answer

Rootkit, because the endpoint security console detected an unknown process.

Answer

Worm, because the software was installed from an unofficial website.