SY0-701 Practice Test 34 — 15 Questions

Question 1

Based on the exhibit, which change would best reduce the attack surface of the public web server while preserving remote administration from the internal network?

Accepted Answer

Move WEB01 into a DMZ and allow only the reverse proxy or load balancer to reach it on HTTPS, with admin access limited to the jump host.. Moving WEB01 into a DMZ and restricting inbound HTTPS traffic to only the reverse proxy or load balancer minimizes the server's exposure to the internet while still allowing external users to access the web application. Admin access from the internal network is preserved by limiting it to a jump host, which provides a controlled, audited entry point. This architecture follows the principle of least privilege and network segmentation, reducing the attack surface without sacrificing necessary functionality.

Answer

Assign WEB01 a public IP address directly and remove the firewall rules.

Answer

Place WEB01 on the same VLAN as user workstations so the firewall can inspect traffic more easily.

Answer

Keep the server where it is and add outbound web filtering to stop exploitation attempts.

Question 2

An employee receives a phone call from someone claiming to be IT and asking for a one-time verification code to "fix" the employee's account. What is the best response?

Accepted Answer

Refuse to share the code and report the call through the company's security process.. It follows the principle of never sharing authentication factors, especially one-time verification codes, with anyone over the phone. This scenario is a classic social engineering attack (vishing) where the attacker attempts to bypass multi-factor authentication (MFA) by tricking the employee into revealing a time-based one-time password (TOTP) or similar code. Reporting the call through the company's security process allows the incident to be investigated and mitigates further risk.

Answer

Provide the code quickly so the support call can be completed without delay.

Answer

Reply to the caller by email with the code and ask them to confirm receipt.

Answer

Change the password immediately and then tell the caller the new password.

Question 3

The SOC is writing step-by-step instructions for responding to a suspected malware infection on a laptop. The document should tell analysts exactly what to do first, second, and third during triage and containment. Which governance artifact should they create?

Accepted Answer

Procedure, because it gives a repeatable sequence of actions for a specific task.. A procedure is the correct governance artifact because it provides a detailed, step-by-step sequence of actions for a specific task—in this case, triaging and containing a suspected malware infection on a laptop. Unlike policies or standards, which set high-level intent or goals, a procedure ensures repeatable and consistent execution by analysts during incident response.

Answer

Policy, because it states the organization's broad security intent.

Answer

Guideline, because it offers optional advice that analysts may choose to follow.

Answer

Standard, because it defines the organization's security goals at a high level.

Question 4

A small company wants all employees to lock their screens after 10 minutes of inactivity, and the rule is included in the formal security policy. What type of control is this?

Accepted Answer

Directive control, because it tells users what behavior is required.. A directive control is designed to guide or mandate user behavior through policies or procedures. In this case, the security policy explicitly requires employees to lock their screens after 10 minutes of inactivity, which is a directive that tells users what they must do. This is a procedural control, not a technical enforcement mechanism, so it falls under directive controls.

Answer

Detective control, because it discovers misuse after it happens.

Answer

Corrective control, because it repairs damage after an incident.

Answer

Compensating control, because it replaces a missing technical safeguard.

Question 5

A workstation starts failing security checks. The antivirus service no longer appears in the running process list, a known driver's hash does not match the vendor's value, and a task manager view shows fewer processes than expected. The user also reports that local admin tools behave inconsistently. What type of malware is most likely present?

Accepted Answer

Rootkit. The symptoms—antivirus service missing from the process list, a known driver's hash mismatch, fewer processes in Task Manager, and inconsistent admin tool behavior—are classic indicators of a rootkit. Rootkits operate at kernel or driver level, allowing them to hide processes, files, and registry keys from standard system tools, and they often tamper with driver hashes to evade integrity checks.

Answer

Spyware

Answer

Trojan

Answer

Logic bomb

Question 6

A manufacturer wants to give partner-company users access to a procurement portal. The partner wants to authenticate its own users, and the manufacturer does not want to create separate local passwords for them. What is the best solution?

Accepted Answer

Federate access with the partner's identity provider and map claims or attributes to portal roles.. Federation with the partner's identity provider (IdP) using standards like SAML 2.0 or OIDC allows the partner to authenticate their own users while the manufacturer's portal trusts those assertions. Claims or attributes from the IdP (e.g., group membership) are mapped to portal roles, eliminating the need for local passwords and enabling single sign-on (SSO). This is the best solution because it maintains security boundaries and offloads authentication management to the partner.

Answer

Create shared portal accounts and distribute credentials to the partner's staff.

Answer

Issue one VPN account for the partner organization and let them share it internally.

Answer

Require each partner user to create a password directly in the procurement portal.

Question 7

An HR department hires contractors for fixed 60-day engagements. Accounts should stop working automatically when the engagement ends, and any rehire should require fresh approval rather than restoring old access. What IAM control is the best fit?

Accepted Answer

Configure an account expiration date and automatic deprovisioning tied to the approved role.. Configuring an account expiration date and automatic deprovisioning tied to the approved role directly enforces the 60-day limit and ensures that when the engagement ends, the account is automatically disabled or removed. This approach also supports the requirement that rehire requires fresh approval, as the old account is deprovisioned and cannot be simply re-enabled without going through the provisioning process again.

Answer

Use one shared contractor account and rotate the password when people leave.

Answer

Disable the account after the contract ends but keep all group memberships unchanged.

Answer

Create a local workstation account so the contractor does not need centralized identity services.

Question 8

A help desk technician receives a call from someone claiming to be a new contractor whose MFA app failed during travel. The caller knows the company org chart, names the technician's supervisor, and says the technician should use a callback number included in a text message they just sent. What is the safest first action?

Accepted Answer

End the call and verify the request through a published help desk number or ticketing system.. The safest first action when receiving an unsolicited call requesting privileged actions (like MFA reset) is to independently verify the request through official channels. The caller's knowledge of internal details (org chart, supervisor name) and the request to use a callback number from a text message are classic social engineering red flags, as the callback number could be attacker-controlled. Hanging up and calling back via a published help desk number ensures the request is legitimate and prevents MFA bypass or account takeover.

Answer

Reset MFA immediately, since the caller has provided enough internal details to seem credible.

Answer

Ask the caller to read a one-time code aloud so the technician can confirm their identity.

Answer

Approve the request if the caller can name the supervisor and the contractor's project team.

Question 9

A sysadmin is preparing a dedicated database server for production. The server will not host web services, print services, or file sharing. Which action best follows least privilege and secure defaults?

Accepted Answer

Disable unused services and run the database under a dedicated least-privilege service account.. Disabling unused services reduces the attack surface, and running the database under a dedicated least-privilege service account ensures the account has only the permissions necessary for the database to function. This aligns with the principles of least privilege and secure defaults, as the server is dedicated to database services and should not have extraneous services or overly permissive accounts.

Answer

Enable every management service so support can connect easily.

Answer

Use the domain admin account to run the database service.

Answer

Share the same account with backup software to simplify troubleshooting.

Question 10

Before applying a critical patch to a production application server, which action best reduces the risk of extended downtime if the patch fails?

Accepted Answer

Create a verified backup or rollback plan before making the change.. Creating a verified backup or rollback plan before applying a critical patch ensures that if the patch causes unexpected failures or incompatibilities, the system can be restored to its previous stable state quickly. This directly reduces the risk of extended downtime by providing a reliable recovery path, which is a fundamental principle of change management and risk mitigation in production environments.

Answer

Apply the patch immediately without testing so the system is protected sooner.

Answer

Disable logging so the patch process uses fewer resources.

Answer

Postpone the patch indefinitely until all business users request it.

Question 11

A new SIEM rule generates many alerts from a scheduled backup job that is known to be legitimate. What should the analyst do to improve alert quality?

Accepted Answer

Tune the rule to exclude the known backup activity pattern.. Tuning the SIEM rule to exclude the known backup activity pattern reduces false positives while preserving detection of actual threats. By creating an exception for the specific backup server's IP, schedule, or process hash, the analyst maintains visibility into anomalous behavior without being overwhelmed by noise.

Answer

Disable all logging for the backup server.

Answer

Ignore the alerts permanently because the job is approved.

Answer

Reimage the backup server to stop the alerts.

Question 12

A security analyst is reviewing authentication logs from a corporate web application. The logs show thousands of failed login attempts over the past hour. Each attempt uses a different username, but all attempts use the same password 'Spring2024!'. The source IP addresses are widely distributed across several different geographic regions. Which type of attack is the analyst most likely observing?

Accepted Answer

Password spraying attack. The attack uses a single common password ('Spring2024!') against many different usernames, which is the hallmark of a password spraying attack. Unlike brute-force attacks that target one account with many passwords, password spraying avoids account lockout by trying one password across many accounts. The wide distribution of source IPs is consistent with a distributed password spraying campaign, often using botnets or proxies.

Answer

Brute-force attack

Answer

Credential stuffing attack

Answer

Dictionary attack

Question 13

Several employees in a branch office report that their laptops automatically connected to a network named "CorpWiFi" even though they were away from the office. Shortly afterward, a few users saw a captive portal asking them to re-enter company credentials. Which threat best explains this situation?

Accepted Answer

Evil twin access point impersonating the legitimate wireless network. The scenario describes an evil twin attack where a rogue access point broadcasts the SSID "CorpWiFi" to trick laptops into automatically connecting. Once connected, the attacker presents a fake captive portal to harvest credentials. This exploits the fact that client devices often prioritize known SSIDs without verifying the authenticity of the access point, relying solely on the network name.

Answer

Bluetooth pairing abuse from a nearby device

Answer

DNS poisoning caused by a compromised resolver

Answer

NFC relay attack against the laptops' login process

Question 14

A company is redesigning a customer portal. Internet users must reach only the web tier, the application tier must be reachable only from the web tier, and the database must be reachable only from the application tier. Administrators should manage servers from a dedicated jump host. Which design best meets these requirements?

Accepted Answer

Place web servers in a DMZ, application servers in an internal server subnet, databases in a restricted trust zone, and allow administration only through ACLs from a jump host.. Ly implements a layered security architecture by placing web servers in a DMZ (accessible from the internet), application servers in an internal subnet (accessible only from the DMZ), and databases in a restricted trust zone (accessible only from the application tier). Administration is restricted to a dedicated jump host, enforcing strict network segmentation and least-privilege access control via ACLs.

Answer

Place all servers on one VLAN and use host firewalls on each system.

Answer

Place the database servers in the DMZ so the web tier can query them directly from the internet-facing network.

Answer

Use NAT for all servers and keep every system on the same internal subnet to simplify routing.

Question 15

A supplier tells your company it wants to use a new subcontractor to process customer data. What is the BEST contract control to reduce this risk?

Accepted Answer

Require the vendor to notify the company before adding subcontractors. Requiring the vendor to notify the company before adding subcontractors is the best contract control because it ensures the company retains visibility and approval authority over any third party that will process customer data. This aligns with the principle of due diligence and third-party risk management, as the company can assess the subcontractor's security posture before data is shared. Without such a clause, the vendor could unilaterally introduce a subcontractor with inadequate security controls, increasing the risk of a data breach or compliance violation.

Answer

Allow subcontractors without review if the vendor remains responsible

Answer

Only require a verbal promise that the subcontractor is secure

Answer

Remove all contract language related to third parties