SY0-701 Practice Test 32 — 15 Questions

Question 1

A vulnerability scan reports a critical finding on a legacy application server. The security team verifies that the flagged package is installed, but the vulnerable code path is disabled by configuration and cannot be exploited in the current deployment. The vendor will not support a patch until next quarter. What is the best next step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Request a risk exception and document compensating controls until patching is possible. The vulnerability is real (the package is installed), but the risk is mitigated by a compensating control (the vulnerable code path is disabled). A risk exception formally documents this compensating control and the planned patch timeline, ensuring the finding is tracked and not forgotten. This aligns with the SY0-701 objective of managing risk through formal acceptance and compensating controls when immediate remediation is not possible.

Answer

Ignore the finding because the scanner produced a false positive

Answer

Disable the vulnerability scanner to prevent repeated alerts

Answer

Immediately retire the server even though the application is still business-critical

Question 2

A help desk manager wants sample customer tickets copied into a test environment so developers can reproduce support issues. The tickets include names, phone numbers, and account details. Which action best reduces privacy exposure while still supporting testing?

Accepted Answer

Mask or tokenize the personal data and restrict access to approved testers only.. Masking or tokenizing personal data (e.g., replacing names with pseudonyms, scrambling phone numbers) ensures that developers can work with realistic data structures without exposing personally identifiable information (PII). Restricting access to approved testers further enforces the principle of least privilege, which is a core security control for test environments. This approach balances the need for functional testing with compliance requirements like GDPR or HIPAA.

Answer

Export the full tickets because the developers need realistic records.

Answer

Copy the tickets to a shared cloud drive and protect it with a simple password.

Answer

Remove the account numbers only and leave the rest of the ticket untouched.

Question 3

A branch office has users, finance workstations, printers, and IP phones on one flat network. The security team wants to reduce lateral movement if one user PC is compromised, but printers still need to receive print jobs from users. What is the best design change?

Accepted Answer

Place finance systems and user devices in separate VLANs and allow only the necessary print and business application traffic through filtering rules.. Segmenting the flat network into separate VLANs for finance systems and user devices enforces network segmentation, which limits lateral movement. By using VLANs and firewall rules to allow only necessary traffic (e.g., print jobs via IPP or SMB, and business application traffic), the organization reduces the attack surface while maintaining required functionality. This aligns with the principle of least privilege and zero trust architecture.

Answer

Keep one flat network and increase endpoint antivirus scanning frequency.

Answer

Move all printers into the finance VLAN to avoid managing inter-VLAN rules.

Answer

Disable printing so user workstations cannot communicate with any other device.

Question 4

A security analyst is investigating a data integrity incident where an attacker exploited a vulnerability in a web application to alter customer account balance records in the database. The analyst identifies the exact records that were modified and restores those records from a verified read-only backup taken prior to the attack. Which security goal is the analyst primarily addressing by restoring the records from backup?

Accepted Answer

Integrity. Restoring the altered customer account balance records from a verified read-only backup directly addresses the integrity security goal. Integrity ensures that data is accurate and has not been modified by unauthorized parties. By reverting the records to their pre-attack state, the analyst is correcting the unauthorized modifications, thereby restoring the trustworthiness of the data.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 5

A security analyst at a manufacturing company notices multiple workstations generating high volumes of encrypted outbound traffic and displaying ransom notes. The analyst suspects a ransomware outbreak. According to the incident response process, which of the following should the analyst perform FIRST?

Accepted Answer

Isolate the affected workstations from the network by disconnecting their network cables and disabling Wi-Fi.. The first priority in a suspected ransomware outbreak is containment to prevent lateral spread and further encryption. Disconnecting network cables and disabling Wi-Fi immediately isolates the affected workstations from the network, stopping the ransomware from communicating with its command-and-control (C2) server or encrypting additional systems. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Answer

Immediately wipe the hard drives of all affected workstations and reinstall the operating system.

Answer

Contact local law enforcement to report the ransomware incident and request a forensic investigation.

Answer

Conduct a full forensic analysis of one affected workstation to determine the ransomware variant and entry vector.

Question 6

A Java-based internal portal accepts a serialized object during profile import. After a recent test upload, the server made outbound LDAP calls and created a new local account. What attack pattern best explains this behavior?

Accepted Answer

Insecure deserialization, because a crafted object triggered unexpected server-side actions.. The scenario describes a Java application accepting a serialized object during profile import, which is a classic vector for insecure deserialization attacks. By crafting a malicious serialized object, an attacker can trigger arbitrary code execution on the server, leading to outbound LDAP calls and local account creation—actions that are not part of normal profile import logic. This attack exploits the trust placed in serialized data without proper validation or integrity checks.

Answer

SQL injection, because the attacker likely altered a database query.

Answer

Cross-site scripting, because the attacker could have injected script into the portal.

Answer

CSRF, because the attacker may have forced an administrator to submit a form.

Question 7

Based on the exhibit, what type of malware is the most likely issue on the workstation?

Accepted Answer

Spyware, because the system appears to be collecting user data silently.. The exhibit shows a browser extension installed from an unofficial website that is silently collecting browsing data, including keystrokes and visited URLs, which is characteristic of spyware. Spyware operates by gathering user information without consent, often through seemingly legitimate software, and the absence of encryption or user notification confirms this classification.

Answer

Ransomware, because the browser settings changed after installation.

Answer

Rootkit, because the endpoint security console detected an unknown process.

Answer

Worm, because the software was installed from an unofficial website.

Question 8

Employees in a server room often prop the door open while carrying equipment. What control best helps detect and prevent this behavior?

Accepted Answer

Install a door-ajar alarm and use a self-closing door mechanism.. A door-ajar alarm provides immediate notification when the door is left open, while a self-closing door mechanism physically ensures the door closes automatically after each use. Together, they directly address the behavior of propping the door open by both detecting the violation and preventing it from remaining open, which is critical for maintaining physical security controls in a server room.

Answer

Add more desk chairs outside the server room for convenience.

Answer

Increase the screen brightness on the monitoring workstation.

Answer

Move backup tapes to a nearby shelf for easier access.

Question 9

Based on the exhibit, which access model best fits the business requirement without creating many custom roles?

Accepted Answer

ABAC, because access can be evaluated using user, resource, and environment attributes together.. B is correct because Attribute-Based Access Control (ABAC) evaluates multiple attributes (user, resource, environment) to dynamically determine access, which fits a business requirement that needs flexible, context-aware permissions without creating many custom roles. Unlike RBAC, ABAC avoids role explosion by using policies that combine attributes, making it ideal for environments where access decisions depend on factors like time, location, or data sensitivity.

Answer

RBAC, because every user can be placed into a fixed role that never changes.

Answer

DAC, because each file owner can decide access individually without any central rule engine.

Answer

MAC, because users should manually grant access to themselves when needed.

Question 10

Based on the exhibit, which control would most effectively reduce the remaining successful attacks?

Phishing awareness results:
Team A: click rate 8%, report rate 6%, median report time 52 min
Team B: click rate 7%, report rate 18%, median report time 14 min
Team C: click rate 12%, report rate 21%, median report time 10 min

Incident summary: Team C had one mailbox takeover after a user approved an MFA push while traveling.

Accepted Answer

Replace push-based MFA with phishing-resistant MFA and reinforce verification for unusual login prompts.. Team C's successful attack was a mailbox takeover resulting from a user approving an MFA push notification while traveling. This indicates that push-based MFA is vulnerable to MFA fatigue attacks, where an attacker bombards the user with prompts until they approve. Replacing push-based MFA with phishing-resistant MFA (e.g., FIDO2/WebAuthn or hardware tokens) eliminates the possibility of approving a prompt from an untrusted device, and reinforcing verification for unusual login prompts adds a critical user behavior layer to detect anomalies.

Answer

Continue generic awareness posters without changing technical controls.

Answer

Disable MFA on mobile devices so users can log in faster.

Answer

Allow employees to approve prompts from any device to reduce help desk calls.

Question 11

A manager can access the HR portal normally from a managed laptop, but if they sign in from an unmanaged tablet, the system should require extra verification before granting access. Which control best fits?

Accepted Answer

Conditional access based on device trust or risk.. Conditional access policies evaluate device trust (e.g., compliance with security baselines, domain membership) and risk signals (e.g., location, sign-in behavior) to enforce step-up authentication. This directly matches the requirement: allow normal access from a managed laptop, but require extra verification from an unmanaged tablet. Other options like password expiration, VLAN segmentation, or encryption do not dynamically adjust authentication requirements based on device trust.

Answer

A longer password expiration interval.

Answer

A separate VLAN for each manager.

Answer

Data encryption at rest on the HR database.

Question 12

A user downloads a company software update and wants to verify it really came from the vendor and was not changed in transit. Which cryptographic feature should they check?

Accepted Answer

A digital signature from the vendor. A digital signature from the vendor provides cryptographic proof of both authenticity (the file originated from the claimed vendor) and integrity (the file has not been altered in transit). The vendor signs the file with their private key, and the user verifies the signature using the vendor's public key; if the signature is valid, the file is genuine and unchanged.

Answer

A longer filename with the vendor name in it

Answer

A larger file size than the previous update

Answer

A password protected ZIP file

Question 13

A developer reports that a search field returns all customer records when they enter a single quote followed by OR 1=1. Security confirms the web app concatenates user input directly into SQL statements. Which remediation is best?

Accepted Answer

Use parameterized queries or prepared statements in the application code.. Parameterized queries or prepared statements separate SQL logic from user input, preventing the concatenation that allows SQL injection. By using placeholders (e.g., `?` or `:param`) and binding user input as data, the database engine treats the single quote and `OR 1=1` as literal string values, not executable SQL code. This directly remediates the root cause—dynamic SQL construction—without relying on external filters or insecure workarounds.

Answer

Deploy only a web application firewall and keep the code unchanged.

Answer

Store the database password as a salted hash in the application configuration.

Answer

Disable HTTPS so the request body is easier to inspect by network tools.

Question 14

A support agent notices that changing `invoiceId=8842` to `invoiceId=8843` in a portal URL returns another customer's invoice PDF without any additional login prompt. The user is already authenticated to the application. Which vulnerability is most likely present?

Accepted Answer

Broken access control. The vulnerability is broken access control (B) because the application fails to verify that the authenticated user is authorized to access the resource identified by `invoiceId=8843`. By simply changing a numeric parameter in the URL, the user can view another customer's invoice PDF without any additional authentication or authorization check. This is a classic insecure direct object reference (IDOR) flaw, which falls under the broader category of broken access control.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Cross-site request forgery

Question 15

A legal team must send a confidential contract to a partner so only the intended recipient can read it, and the partner also needs assurance the file really came from your company. Which approach best meets both needs?

Accepted Answer

Encrypt the file with the recipient's public key and sign it with the sender's private key.. It uses asymmetric encryption to ensure confidentiality (encrypting with the recipient's public key ensures only the intended recipient can decrypt it with their private key) and digital signing (signing with the sender's private key provides non-repudiation and authenticity, proving the file came from the sender). This combination directly addresses both requirements: only the partner can read the contract, and the partner can verify the sender's identity.

Answer

Hash the contract and email the hash value separately.

Answer

Use a shared symmetric key and send the key in the same email message.

Answer

Compress the file and password-protect the archive with a simple passphrase.