SY0-701 Practice Test 32 — 15 Questions

Question 1

A policy states that sensitive data must be encrypted, but it does not say which encryption strength to use. The security architect wants a document that lists the exact approved encryption settings for systems to follow. What document is needed?

Accepted Answer

A standard, because it specifies the required technical values and configurations.. A standard is the correct document because it mandates specific, measurable technical requirements—such as exact encryption algorithms (e.g., AES-256), key lengths, and cipher modes (e.g., GCM)—that systems must follow to comply with the policy. Unlike a policy, which states a goal (e.g., 'encrypt sensitive data'), a standard provides the enforceable configuration baseline that the security architect needs.

Answer

A procedure, because it explains the step-by-step order for handling every file.

Answer

A guideline, because it gives suggestions that teams may choose to adopt.

Answer

A memo, because it is the fastest way to tell teams about a new requirement.

Question 2

A project team must share a spreadsheet containing customer names, account numbers, and purchase history with an external auditor. The auditor only needs account numbers and totals. What is the best privacy control?

Accepted Answer

Redact unneeded personal data and transfer only the minimum necessary information through an approved encrypted channel. Option B is correct because it applies the principle of data minimization and secure transmission. Redacting unneeded personal data (customer names) ensures only the minimum necessary information (account numbers and totals) is shared, reducing exposure. Transferring via an approved encrypted channel (e.g., SFTP, HTTPS, or encrypted email) protects data in transit from interception, which is required for compliance with regulations like GDPR or PCI DSS.

Answer

Send the full spreadsheet through regular email to avoid delaying the audit

Answer

Upload the spreadsheet to a public file-sharing site and protect it with a password

Answer

Compress the file with a password and reuse the same password for all auditors

Question 3

A procurement clerk receives a text message from someone claiming to be a supplier account manager. The message says a recent payment failed and asks the clerk to update bank details through a link to a secure portal. What should the clerk do first?

Accepted Answer

Verify the request using a known supplier contact method before taking action. Option C is correct because the clerk should independently verify the request using a known supplier contact method (e.g., a phone number on file) before taking any action. This prevents falling victim to a social engineering attack, such as a phishing or business email compromise (BEC) attempt, where the attacker spoofs the sender's identity to redirect payments. Verifying through an out-of-band channel ensures the request is legitimate, as the link in the message could lead to a credential-harvesting site or malware download.

Answer

Open the link and compare it with the supplier's branding

Answer

Reply to the text and ask the sender to confirm the request

Answer

Forward the message to finance so they can decide whether it is legitimate

Question 4

A records manager confirms that paper onboarding forms containing government IDs are past retention, no legal hold exists, and the files are no longer needed. Which three actions should happen next? Select three.

Accepted Answer

Destroy the forms using approved secure disposal methods.. Option A is correct because once records are past their retention period, no legal hold exists, and they are no longer needed, the organization must destroy them using approved secure disposal methods (e.g., cross-cut shredding, incineration, or pulping) to prevent unauthorized access to sensitive PII. This aligns with the principle of data minimization and compliance with privacy regulations like GDPR or HIPAA.

Answer

Store the forms in a desk drawer for another quarter just in case.

Answer

Email scans of the forms to managers so they can keep a copy.

Question 5

A records clerk finds paper forms containing customer identifiers. The retention period has expired, and no legal hold applies. Which two actions are appropriate next? Select two.

Accepted Answer

Verify that the retention schedule has been satisfied and no hold exists. Option A is correct because before disposing of any records, the records clerk must confirm that the retention period has fully elapsed and that no legal hold (such as a litigation hold or regulatory hold) is active. This verification step ensures compliance with organizational data governance policies and avoids spoliation of evidence. Option B is correct because once verification is complete, the approved disposal method (e.g., cross-cut shredding, incineration, or secure shredding service) must be used to render the customer identifiers irrecoverable, aligning with data minimization and privacy requirements.

Answer

Keep the forms in a personal desk drawer until someone asks for them

Answer

Take the papers home for safe keeping before shredding later

Answer

Refile the forms in an archive cabinet because they are old records

Question 6

A records room has repeated tailgating after hours and occasional door propping during deliveries. Management wants one control that prevents follow-on entry and another that immediately alerts security if the door is forced open or left ajar. Which two controls best meet the need? Select two.

Accepted Answer

Install a mantrap at the room entrance.. A mantrap (option A) prevents tailgating by requiring one door to close before the next can open, effectively stopping follow-on entry. A door position sensor (option B) detects when the door is forced open or left ajar and triggers an immediate alert to security via an alarm or SIEM integration, meeting the requirement for real-time notification.

Answer

Place a larger warning sign on the wall beside the door.

Answer

Mount a visible camera over the door only.

Answer

Replace the mechanical lock with the same type of lock and no monitoring.

Question 7

A records manager finds paper onboarding forms and scanned copies that contain government ID numbers. The retention period has expired, no legal hold exists, and the forms are no longer needed. Which three actions should occur before disposal? Select three.

Accepted Answer

Verify the retention schedule and confirm that no legal hold or exception applies.. Option A is correct because before any disposal, the records manager must verify the retention schedule and confirm that no legal hold or exception applies. This ensures compliance with organizational policy and legal requirements, preventing premature destruction of records that may still be needed for litigation or audit purposes.

Answer

Move the forms to an unsecured archive so they can be retrieved later if needed.

Answer

Keep personal copies because auditors might ask informally later.

Question 8

A report generator accepts a user-supplied report name and then passes it into a shell command to convert a file. During testing, a malicious value causes the server to run an unexpected system command. Which two changes best mitigate this issue while keeping the feature usable? Select two.

Accepted Answer

Replace shell command concatenation with a parameterized API or safe library call.. Option A is correct because replacing shell command concatenation with a parameterized API or safe library call prevents command injection by ensuring user input is treated as data, not executable code. This is the most effective mitigation because it eliminates the injection vector entirely, rather than trying to sanitize or validate input that may still be passed to a shell interpreter.

Answer

HTML-encode the report name before inserting it into the shell command.

Answer

Switch the feature from POST to GET so the values are easier to inspect.

Answer

Hide the server error messages so attackers cannot see the failure details.

Question 9

A regulated analytics workload must run in a public cloud with the strongest practical tenant isolation while avoiding management of physical servers. The workload should also remain off the public internet. Which two deployment choices best fit? Select two.

Accepted Answer

Run the workload on a dedicated host or dedicated instance.. A dedicated host or dedicated instance provides the strongest practical tenant isolation in a public cloud by ensuring that the underlying physical server is not shared with any other customer. This meets the regulatory requirement for strong isolation while avoiding the need to manage physical servers, as the cloud provider still handles hardware maintenance. The dedicated instance model (e.g., AWS Dedicated Instances) offers hardware-level isolation at the instance level, while a dedicated host gives you visibility and control over the physical server, both without requiring you to manage the server itself.

Answer

Use shared tenancy with security groups only.

Answer

Assign an elastic IP so administrators can reach the workload directly from anywhere.

Answer

Expose the workload through a public load balancer to simplify connectivity.

Question 10

After a phishing campaign, several employees entered credentials on a fake login page. Management wants a control that both improves user behavior and gives the security team a way to measure whether click rates are going down. Which two actions best meet that goal? Select two.

Accepted Answer

Run role-based phishing awareness training. Role-based phishing awareness training (B) directly improves user behavior by tailoring content to specific job functions, making the training more relevant and effective. Simulated phishing exercises with reporting metrics (D) provide a measurable way for the security team to track click rates over time, enabling data-driven assessment of improvement. Together, they address both behavioral change and quantifiable measurement.

Answer

Send a reminder email once a year and stop there

Answer

Disable all external email for every employee

Answer

Tell users to ignore suspicious messages unless IT calls first

Question 11

After restoring a virtual file server from backup, users can log in and browse shares, but finance says the last day's edits are missing. Which two steps should the administrator take before declaring recovery complete? Select two.

Accepted Answer

Verify the restore point meets the required recovery point objective and the business expects the data loss window.. Option A is correct because the Recovery Point Objective (RPO) defines the maximum acceptable data loss. If the restore point is from before the last day's edits, the administrator must confirm that this data loss window is acceptable to the business. Option B is correct because application-consistent backups often require replaying transaction logs (e.g., SQL Server VSS writer logs) to bring the database to the latest committed state; skipping this step leaves the data incomplete.

Answer

Rebuild the server from scratch without checking the backup timestamp.

Answer

Disable all backup jobs until the next maintenance window.

Answer

Change the DNS records so users point to a different server name.

Question 12

An administrator pushed a firewall rule change to allow a new vendor IP range during business hours. Minutes later, payroll users lost access to an internal service. Which change management practice would have best reduced the impact?

Accepted Answer

Test the change in a staging environment and include a rollback plan in the request.. Option B is correct because testing the change in a staging environment first would have revealed any unintended side effects, such as ACL conflicts that blocked payroll traffic. Including a rollback plan ensures that if the change causes issues in production, the administrator can quickly revert the firewall rule to restore service. This aligns with the change management process of minimizing impact through controlled testing and contingency planning.

Answer

Apply changes directly in production so they take effect as quickly as possible.

Answer

Avoid documenting the change until after the maintenance window ends.

Answer

Use verbal approval from the payroll manager instead of the normal ticket process.

Question 13

An EDR console reports possible beaconing from a workstation because it makes outbound HTTPS connections to the same cloud IP every 15 minutes. The workstation belongs to the patch-management team, and the destination resolves to a vendor update service. Which evidence best supports closing the alert as a false positive?

Accepted Answer

Process lineage and signed agent logs show the patch client initiated the traffic on schedule.. Option C is correct because it provides verifiable evidence that the outbound HTTPS connections are legitimate: the process lineage and signed agent logs confirm the patch-management client initiated the traffic on its scheduled update cycle. This aligns with the expected behavior of a patch-management tool, which often uses HTTPS to a vendor update service at regular intervals. The EDR's beaconing detection is a false positive because the traffic is not malicious but rather a routine, authorized activity.

Answer

The workstation user says the activity looks normal and no files were encrypted.

Answer

The source IP appears on a blocklist, so the alert must be malicious.

Answer

The workstation has antivirus installed, which means outbound beaconing is impossible.

Question 14

A responder has imaged a suspect laptop and needs to preserve the evidence for possible legal action. Which three actions best support chain of custody and admissibility? Select three.

Accepted Answer

Document the evidence identifier, collector, date, time, and location on the chain-of-custody form.. Option A is correct because documenting the evidence identifier, collector, date, time, and location on the chain-of-custody form establishes a clear, auditable record of who handled the evidence and when. This documentation is essential for proving the evidence has not been tampered with and is admissible in court. Without this detailed logging, the chain of custody is broken, and the evidence may be challenged.

Answer

Mount the original drive read/write so investigators can search it faster.

Answer

Rename the image file to match the case number before hashing it.

Question 15

A SaaS vendor hosts a customer relationship platform for multiple organizations. Your company wants to know which two responsibilities typically remain with the customer rather than the SaaS provider. Select two.

Accepted Answer

Assigning user roles and approving access within the tenant.. Option A is correct because in a SaaS model, the customer retains administrative control over user identities, roles, and access permissions within their own tenant. The SaaS provider manages the underlying application and infrastructure, but the customer must configure role-based access control (RBAC) to enforce least privilege and approve access requests. This aligns with the shared responsibility model where identity and access management (IAM) at the application layer falls to the customer.

Answer

Patching the provider's underlying database engine.

Answer

Maintaining the vendor's physical data center power and cooling.

Answer

Replacing the provider's hypervisors during maintenance windows.