SY0-701 Practice Test 34 — 15 Questions

Question 1

A security analyst is reviewing the source code of a custom authentication service. The service uses a function that compares a user-supplied password to the stored password hash by iterating through each byte and returning false immediately upon the first mismatch. The analyst measures the function's execution time and discovers it varies measurably depending on how many initial bytes match. Which type of attack is this vulnerability most likely to facilitate?

Accepted Answer

Timing attack. The vulnerability is a timing attack because the comparison function returns false immediately upon the first mismatched byte, causing execution time to vary based on how many initial bytes match. An attacker can measure these timing differences to iteratively guess each byte of the password hash, effectively reducing the search space from exponential to linear. This is a classic side-channel attack that exploits observable timing variations in cryptographic or authentication operations.

Answer

Brute-force attack

Answer

Dictionary attack

Answer

Replay attack

Question 2

A security analyst is reviewing web server logs after a user reports that the company website displayed an error message containing raw database queries. The log shows repeated requests to the product search page with the following parameter: `?id=1 OR 1=1`. Which of the following should the analyst do FIRST to confirm the nature of the suspected attack?

Accepted Answer

Verify the request details against the web application firewall logs.. Option C is correct because the analyst should first verify the request details against the web application firewall (WAF) logs to confirm whether the WAF detected and blocked the SQL injection attempt. The parameter `?id=1 OR 1=1` is a classic SQL injection payload, and WAF logs provide immediate evidence of whether the request was flagged, allowed, or blocked, enabling the analyst to correlate the user's report with actual security controls before taking further action.

Answer

Run a vulnerability scan against the web server.

Answer

Block the source IP address in the firewall.

Answer

Isolate the web server from the network immediately.

Question 3

A security architect is designing the network security posture for a new branch office. The plan includes a next-generation firewall at the perimeter, an intrusion prevention system on the internal network, mandatory multi-factor authentication for all remote access, and quarterly security awareness training for employees. The architect explains that these controls are independent of each other so that a failure in any single control does not leave the entire network unprotected. Which security concept is the architect primarily implementing?

Accepted Answer

Defense in depth. The architect is implementing defense in depth by layering multiple independent security controls—a next-generation firewall (NGFW) at the perimeter, an intrusion prevention system (IPS) on the internal network, mandatory multi-factor authentication (MFA) for remote access, and quarterly security awareness training. The key phrase 'independent of each other so that a failure in any single control does not leave the entire network unprotected' directly describes the principle of layered defenses, where no single point of failure compromises overall security. This approach ensures that if an attacker bypasses the NGFW, the IPS or MFA may still prevent or detect the breach.

Answer

Least privilege

Answer

Zero trust

Answer

Separation of duties

Question 4

A security manager wants to require that all company laptops use at least a 14-character password and lock after 10 minutes of inactivity. Which document should define these mandatory settings?

Accepted Answer

Standard, because it defines specific required technical values the company must follow.. Option B is correct because a standard is the document type that defines mandatory, specific technical requirements, such as a minimum 14-character password length and a 10-minute inactivity lock. Policies are high-level statements of intent, while standards provide the enforceable, measurable parameters that implement that intent. In this scenario, the security manager needs a binding baseline, which is precisely the role of a standard.

Answer

Policy, because it is the broad statement of security intent only.

Answer

Guideline, because it gives optional recommendations for device security.

Answer

Memo, because it is the normal formal document for security baselines.

Question 5

A security manager at a hospital is reviewing the annual vendor risk assessment for a cloud-based electronic health record (EHR) provider. The provider's SOC 2 Type II report, issued six months ago, identifies a significant deficiency in logical access controls: the provider failed to revoke access for former employees in a timely manner. The provider's management has asserted that this deficiency has been fully remediated, but the next SOC 2 audit is not scheduled for another eight months. The hospital's data protection policy requires that any vendor handling protected health information (PHI) must have a current SOC 2 Type II report with no unresolved significant deficiencies. Which of the following is the most appropriate next step for the security manager?

Accepted Answer

Require the vendor to provide a bridge letter from their external auditor confirming that the remediation has been implemented and is operating effectively.. The hospital's policy requires a current SOC 2 Type II report with no unresolved significant deficiencies. Since the deficiency was reported but is claimed to be fixed, a bridge letter from the external auditor provides independent assurance that the remediation is effective and operating as intended, bridging the gap until the next formal audit. This is the most appropriate step because it maintains compliance without prematurely terminating a critical vendor relationship.

Answer

Accept the vendor's assertion that the deficiency has been remediated and continue the relationship as is.

Answer

Immediately terminate the contract with the EHR provider and begin the process of selecting a new vendor.

Answer

Increase the frequency of manual access reviews performed by the hospital's internal IT staff on the vendor's systems.

Question 6

A security manager issues a mandatory document that requires all corporate laptops to use full-disk encryption, automatic screen lock after 10 minutes, and approved endpoint protection software. The document will be checked during compliance reviews. Which governance artifact is this?

Accepted Answer

Standard. The document is a mandatory requirement that must be followed and is enforced through compliance reviews, which aligns with the definition of a policy. Policies are high-level, mandatory directives that set the overall security stance of an organization, such as requiring full-disk encryption (e.g., AES-256) and automatic screen lock after 10 minutes. This document is not a standard because it does not provide specific technical configurations or baselines, nor is it a procedure or guideline, as it lacks step-by-step instructions or optional recommendations.

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 7

A security manager wants one document that states employees must protect company laptops and another that defines exact required settings such as disk encryption and a 10-minute screen lock. Which two document types are the best fit? Select two.

Accepted Answer

Policy. A policy is a high-level statement of management intent, such as requiring employees to protect company laptops. A standard defines mandatory, specific technical settings, like requiring disk encryption (e.g., AES-256) and a 10-minute screen lock timeout. Together, they provide the overarching directive (policy) and the enforceable configuration baseline (standard).

Answer

Guideline

Answer

Procedure

Answer

Exception

Question 8

A security team wants every company laptop to have the same screen-lock timeout, disk encryption setting, and local firewall configuration. Which type of document should define these mandatory settings?

Accepted Answer

A standard, because it specifies mandatory technical requirements.. A standard is the correct document type because it defines mandatory technical requirements that must be uniformly enforced across all company laptops. In this scenario, the screen-lock timeout, disk encryption setting (e.g., BitLocker or FileVault), and local firewall configuration (e.g., Windows Defender Firewall with Advanced Security) are non-negotiable controls that must be applied identically to every device to meet security policy. Standards are binding and often reference specific configuration baselines, such as CIS Benchmarks or NIST SP 800-53, ensuring consistent implementation.

Answer

A guideline, because employees can decide whether to follow it.

Answer

A risk register, because it tracks all security vulnerabilities on laptops.

Answer

A business impact analysis, because it identifies the most important laptop functions.

Question 9

A server is suspected of being used for lateral movement after the SOC notices dozens of failed SSH logons, then a successful login from a new source IP, followed by new outbound SMB connections to internal hosts. The system is still running. Which two items should be collected first before any reboot or remediation? Select two.

Accepted Answer

A current list of logged-in users and active sessions, because it shows who has access right now.. Option A is correct because capturing a current list of logged-in users and active sessions provides immediate visibility into which accounts are currently authenticated and potentially being used by an attacker for lateral movement. This data is volatile and would be lost upon reboot, making it critical to collect before any remediation. In this scenario, the successful SSH login from a new source IP suggests an attacker may have established a foothold, and knowing active sessions helps identify compromised accounts and ongoing access.

Answer

The server’s warranty status, because hardware replacement may be needed later.

Answer

A fresh operating system patch, because updating quickly reduces all risk.

Answer

A user satisfaction survey, because affected staff can describe what they noticed.

Question 10

A server room uses raised flooring and sits below a chilled-water pipe. Facilities wants the earliest warning if water starts accumulating under the floor tiles. Which control should be added?

Accepted Answer

Install leak-detection sensors or a moisture detection cable tied to alerts.. Option D is correct because leak-detection sensors or moisture-detection cables are specifically designed to detect water accumulation under raised floors, providing the earliest possible warning. These sensors trigger alerts when moisture is present, allowing facilities to respond before water damages equipment or causes downtime. This directly addresses the risk of a chilled-water pipe leak in a server room environment.

Answer

Add more motion detectors near the racks.

Answer

Use badge readers on the server room door.

Answer

Install smoke detectors only.

Question 11

A server room sits below a chilled-water line, and occasional condensation is forming on the pipe during humid afternoons. Facilities wants the earliest warning before water reaches equipment and a way to get an alert even if no one is onsite. Which two controls should be implemented? Select two.

Accepted Answer

Install a networked water-leak detection cable beneath the raised floor near the chilled-water line.. A networked water-leak detection cable is the correct choice because it provides continuous, real-time monitoring for moisture along the length of the cable. When condensation drips onto the cable, it completes a circuit between two conductors, triggering an immediate alert. This gives the earliest possible warning before water reaches server equipment, even in an unattended facility.

Answer

Replace standard doors with mantraps to prevent tailgating at the room entrance.

Answer

Increase firewall logging on the server VLAN to spot moisture-related outages.

Answer

Use temperature-only sensors because condensation always raises heat first.

Question 12

A small company can only remediate two findings this week. Which two should be fixed first based on risk to the business? Select two.

Accepted Answer

An internet-facing VPN appliance with a critical vulnerability and a public exploit. Option A is correct because an internet-facing VPN appliance with a critical vulnerability and a public exploit represents an immediate, high-impact risk. Attackers can leverage the public exploit to gain unauthorized remote access to the internal network, potentially compromising all connected systems and data. The combination of internet exposure and known exploit makes this the highest priority for remediation.

Answer

An internal training VM used by one student with a medium vulnerability and no sensitive data

Answer

A discontinued server already removed from the network but still listed in inventory

Answer

A low-severity cosmetic issue on a noncritical dashboard page

Question 13

A SIEM alert shows a payroll administrator account signed in at 02:10 from a country the employee has never visited. The employee says they are on vacation at home and did not travel. What should the analyst do first?

Accepted Answer

Verify the login context with the user or manager and review recent authentication history.. Option B is correct because the first step in incident response is to verify the alert's validity and gather context before taking action. The analyst should review the SIEM logs for authentication details (e.g., source IP, geolocation, timestamp) and confirm with the user or manager whether the login was expected. This aligns with the NIST SP 800-61 incident response process, which emphasizes triage and validation before containment.

Answer

Immediately disable the account and wait for the employee to return.

Answer

Close the alert as a false positive because the user is on vacation.

Answer

Reimage the user’s workstation before checking any logs.

Question 14

A user downloads a company software update and wants to verify it really came from the vendor and was not changed in transit. Which cryptographic feature should they check?

Accepted Answer

A digital signature from the vendor. A digital signature from the vendor provides cryptographic proof of both authenticity (the file originated from the claimed vendor) and integrity (the file has not been altered in transit). The vendor signs the file with their private key, and the user verifies the signature using the vendor's public key; if the signature is valid, the file is genuine and unchanged.

Answer

A longer filename with the vendor name in it

Answer

A larger file size than the previous update

Answer

A password protected ZIP file

Question 15

A SIEM correlates VPN authentication logs and sees 14 different user accounts receive one failed login attempt each from the same source IP during a 5-minute window. A few minutes later, one of those accounts successfully authenticates from that same IP. Which attack is most likely?

Accepted Answer

Password spraying using a common password against many accounts.. The SIEM observed 14 different user accounts each receiving a single failed login attempt from the same source IP within a 5-minute window, followed by one account successfully authenticating. This pattern is characteristic of password spraying, where an attacker tries a common password (e.g., 'Password123') against many accounts to avoid triggering account lockouts, then leverages a successful guess. The single failure per account avoids the threshold for brute-force detection, and the eventual success confirms a guessed credential.

Answer

Brute-force attack against a single account using many passwords.

Answer

Replay attack using previously captured authentication traffic.

Answer

ARP poisoning used to intercept local network traffic.