SY0-701 Practice Test 33 — 15 Questions

Question 1

Employees in a server room often prop the door open while carrying equipment. What control best helps detect and prevent this behavior?

Accepted Answer

Install a door-ajar alarm and use a self-closing door mechanism.. A door-ajar alarm provides immediate notification when the door is left open, while a self-closing door mechanism physically ensures the door closes automatically after each use. Together, they directly address the behavior of propping the door open by both detecting the violation and preventing it from remaining open, which is critical for maintaining physical security controls in a server room.

Answer

Add more desk chairs outside the server room for convenience.

Answer

Increase the screen brightness on the monitoring workstation.

Answer

Move backup tapes to a nearby shelf for easier access.

Question 2

Based on the exhibit, which access model best fits the business requirement without creating many custom roles?

Accepted Answer

ABAC, because access can be evaluated using user, resource, and environment attributes together.. B is correct because Attribute-Based Access Control (ABAC) evaluates multiple attributes (user, resource, environment) to dynamically determine access, which fits a business requirement that needs flexible, context-aware permissions without creating many custom roles. Unlike RBAC, ABAC avoids role explosion by using policies that combine attributes, making it ideal for environments where access decisions depend on factors like time, location, or data sensitivity.

Answer

RBAC, because every user can be placed into a fixed role that never changes.

Answer

DAC, because each file owner can decide access individually without any central rule engine.

Answer

MAC, because users should manually grant access to themselves when needed.

Question 3

Based on the exhibit, which control would most effectively reduce the remaining successful attacks?

Phishing awareness results:
Team A: click rate 8%, report rate 6%, median report time 52 min
Team B: click rate 7%, report rate 18%, median report time 14 min
Team C: click rate 12%, report rate 21%, median report time 10 min

Incident summary: Team C had one mailbox takeover after a user approved an MFA push while traveling.

Accepted Answer

Replace push-based MFA with phishing-resistant MFA and reinforce verification for unusual login prompts.. Team C's successful attack was a mailbox takeover resulting from a user approving an MFA push notification while traveling. This indicates that push-based MFA is vulnerable to MFA fatigue attacks, where an attacker bombards the user with prompts until they approve. Replacing push-based MFA with phishing-resistant MFA (e.g., FIDO2/WebAuthn or hardware tokens) eliminates the possibility of approving a prompt from an untrusted device, and reinforcing verification for unusual login prompts adds a critical user behavior layer to detect anomalies.

Answer

Continue generic awareness posters without changing technical controls.

Answer

Disable MFA on mobile devices so users can log in faster.

Answer

Allow employees to approve prompts from any device to reduce help desk calls.

Question 4

A manager can access the HR portal normally from a managed laptop, but if they sign in from an unmanaged tablet, the system should require extra verification before granting access. Which control best fits?

Accepted Answer

Conditional access based on device trust or risk.. Conditional access policies evaluate device trust (e.g., compliance with security baselines, domain membership) and risk signals (e.g., location, sign-in behavior) to enforce step-up authentication. This directly matches the requirement: allow normal access from a managed laptop, but require extra verification from an unmanaged tablet. Other options like password expiration, VLAN segmentation, or encryption do not dynamically adjust authentication requirements based on device trust.

Answer

A longer password expiration interval.

Answer

A separate VLAN for each manager.

Answer

Data encryption at rest on the HR database.

Question 5

A user downloads a company software update and wants to verify it really came from the vendor and was not changed in transit. Which cryptographic feature should they check?

Accepted Answer

A digital signature from the vendor. A digital signature from the vendor provides cryptographic proof of both authenticity (the file originated from the claimed vendor) and integrity (the file has not been altered in transit). The vendor signs the file with their private key, and the user verifies the signature using the vendor's public key; if the signature is valid, the file is genuine and unchanged.

Answer

A longer filename with the vendor name in it

Answer

A larger file size than the previous update

Answer

A password protected ZIP file

Question 6

A developer reports that a search field returns all customer records when they enter a single quote followed by OR 1=1. Security confirms the web app concatenates user input directly into SQL statements. Which remediation is best?

Accepted Answer

Use parameterized queries or prepared statements in the application code.. Parameterized queries or prepared statements separate SQL logic from user input, preventing the concatenation that allows SQL injection. By using placeholders (e.g., `?` or `:param`) and binding user input as data, the database engine treats the single quote and `OR 1=1` as literal string values, not executable SQL code. This directly remediates the root cause—dynamic SQL construction—without relying on external filters or insecure workarounds.

Answer

Deploy only a web application firewall and keep the code unchanged.

Answer

Store the database password as a salted hash in the application configuration.

Answer

Disable HTTPS so the request body is easier to inspect by network tools.

Question 7

A support agent notices that changing `invoiceId=8842` to `invoiceId=8843` in a portal URL returns another customer's invoice PDF without any additional login prompt. The user is already authenticated to the application. Which vulnerability is most likely present?

Accepted Answer

Broken access control. The vulnerability is broken access control (B) because the application fails to verify that the authenticated user is authorized to access the resource identified by `invoiceId=8843`. By simply changing a numeric parameter in the URL, the user can view another customer's invoice PDF without any additional authentication or authorization check. This is a classic insecure direct object reference (IDOR) flaw, which falls under the broader category of broken access control.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Cross-site request forgery

Question 8

A legal team must send a confidential contract to a partner so only the intended recipient can read it, and the partner also needs assurance the file really came from your company. Which approach best meets both needs?

Accepted Answer

Encrypt the file with the recipient's public key and sign it with the sender's private key.. It uses asymmetric encryption to ensure confidentiality (encrypting with the recipient's public key ensures only the intended recipient can decrypt it with their private key) and digital signing (signing with the sender's private key provides non-repudiation and authenticity, proving the file came from the sender). This combination directly addresses both requirements: only the partner can read the contract, and the partner can verify the sender's identity.

Answer

Hash the contract and email the hash value separately.

Answer

Use a shared symmetric key and send the key in the same email message.

Answer

Compress the file and password-protect the archive with a simple passphrase.

Question 9

Based on the exhibit, which finding should the security team remediate first?

Accepted Answer

WEB01 because it is internet-facing and has a critical exploitable vulnerability. WEB01 is internet-facing and has a critical exploitable vulnerability, meaning an attacker can directly compromise it from the public internet with minimal effort. This represents the highest risk because it combines high likelihood (exploit available) with high impact (full compromise of a public-facing server). Remediating this first aligns with the principle of prioritizing externally exposed systems with known critical flaws over internal or less severe issues.

Answer

LAP09 because user devices are always the easiest to patch

Answer

PRN01 because firmware issues can affect many users

Answer

FILE02 because internal servers are always more important than public ones

Question 10

A finance application has a known vulnerability in a third-party reporting component. The vendor says a patch will not be available for six months, but the business cannot stop using the application. What is the BEST risk treatment for the organization to pursue next?

Accepted Answer

Mitigate the risk by adding compensating controls and tracking residual risk until the patch is available.. When a known vulnerability exists in a third-party component and patching is delayed, the best risk treatment is to implement compensating controls (such as network segmentation, WAF rules, or input validation) to reduce the likelihood or impact of exploitation. This approach allows the business to continue operations while actively tracking residual risk until the vendor releases the patch. It aligns with the NIST risk management framework, which prioritizes mitigation when avoidance is not feasible.

Answer

Avoid the risk by shutting down the finance application immediately.

Answer

Transfer the risk by asking the vendor to guarantee that no incident will occur.

Answer

Accept the risk because any delay in patching is automatically low priority.

Question 11

A security analyst is investigating a phishing campaign that specifically targets senior executives in a company. The emails appear to come from the CEO and request urgent wire transfers to a fraudulent account. Which of the following best describes this type of attack?

Accepted Answer

Whaling. This attack is whaling because it specifically targets senior executives (the 'big fish') with a fraudulent email impersonating the CEO to request urgent wire transfers. Whaling is a form of phishing that focuses on high-profile individuals within an organization, leveraging their authority and access to sensitive financial operations. The attack exploits the trust and urgency associated with executive communications to bypass standard security controls.

Answer

Spear phishing

Answer

Vishing

Answer

Pharming

Question 12

A development team needs to release an urgent fix for a customer portal on Friday evening. The business wants the change to be reversible if something breaks, and security does not want the team to skip release controls. Which requirement should be part of the change process?

Accepted Answer

Require a documented test in a lower environment and a rollback plan before production approval.. It enforces a documented test in a lower environment and a rollback plan, which satisfies both the business requirement for reversibility and the security requirement to maintain release controls. This aligns with the change management process in the SY0-701 domain of Security Program Management and Oversight, ensuring that changes are validated before production deployment and can be undone if issues arise.

Answer

Deploy directly to production as soon as the patch compiles successfully.

Answer

Turn off logging during deployment to avoid filling the disk with change records.

Answer

Allow the release only if the developer verbally confirms the code is safe.

Question 13

Users on a branch VLAN intermittently reach a fake login page even though DNS records have not changed. A packet capture shows the default gateway MAC address changing every 60 seconds, and the switch logs list repeated unsolicited ARP replies from one workstation. Which attack is most likely?

Accepted Answer

ARP poisoning, because forged ARP replies are associating the gateway IP with the attacker's MAC address.. The repeated unsolicited ARP replies from one workstation, combined with the default gateway MAC address changing every 60 seconds, directly indicate an ARP poisoning attack. The attacker is sending forged ARP replies to associate the gateway IP with its own MAC address, causing traffic destined for the gateway to be intercepted. This allows the attacker to redirect users to a fake login page without altering DNS records.

Answer

DNS poisoning, because name resolution is directing users to the wrong server.

Answer

Replay attack, because previously captured traffic is being resent to the network.

Answer

Denial of service, because the branch users cannot reliably reach websites.

Question 14

A SIEM alert flags an interactive logon to a Windows file server from a service account that normally only runs scheduled tasks. The alert occurred at 01:12, but the maintenance window for that server is every Sunday at 02:00. The account also accessed a different server five minutes later. What should the analyst do first?

Accepted Answer

Correlate the activity with the change calendar, scheduled-task logs, and ticketing records before escalating.. The analyst must first gather context to determine if the alert is a false positive or a genuine security incident. The interactive logon at 01:12 is outside the scheduled maintenance window (Sunday 02:00), and the account’s subsequent access to another server warrants correlation with change calendars, scheduled-task logs, and ticketing records to verify if the activity was authorized. This step prevents unnecessary disruption while ensuring that any anomalous behavior is properly investigated before escalation.

Answer

Ignore the alert because service accounts often authenticate outside normal business hours.

Answer

Immediately disable the service account to stop any potential attacker activity.

Answer

Reimage the file server to remove any possible compromise.

Question 15

Based on the exhibit, which change best helps the company meet its recovery objectives after a ransomware event?

Accepted Answer

Move backups to an immutable, offline or logically isolated repository and test restores regularly.. Ransomware often encrypts or deletes accessible backups. An immutable, offline, or logically isolated repository prevents attackers from modifying or deleting backup data, ensuring a clean recovery point. Regularly testing restores validates that the backups are functional and meet recovery objectives (RTO/RPO). This aligns with the 3-2-1 backup rule and NIST SP 800-184 guidance for ransomware recovery.

Answer

Increase the retention period on the existing NAS backups to one year.

Answer

Store the backup administrator password in a shared team spreadsheet so more staff can restore data quickly.

Answer

Replace the nightly full backup with a longer full backup window to capture more data each day.