SY0-701 Practice Test 34 — 15 Questions

Question 1

A user forwards an email that says their payroll account will be disabled today unless they click a link and verify their password. The message uses the company logo, but the sender address is from a free webmail domain and the link goes to a look-alike login page. What type of attack is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Phishing, because the attacker is using a fraudulent message to steal credentials.. This is a classic phishing attack because the attacker uses a fraudulent email that mimics a legitimate company to trick the user into clicking a link to a look-alike login page, with the goal of stealing their payroll credentials. The key indicators are the spoofed company logo, the free webmail sender address, and the fake login page, all of which are hallmarks of credential harvesting via phishing.

Answer

Baiting, because the attacker is offering something attractive to lure the user.

Answer

Vishing, because the attacker is trying to trick the user into revealing information.

Answer

Impersonation, because the attacker is pretending to be someone from the company.

Question 2

A help desk technician receives an email that appears to come from the payroll provider. The message says the employee's direct deposit will be suspended unless they verify their account through a link. What type of attack is this?

Accepted Answer

Phishing. This is a classic phishing attack because the email impersonates a trusted entity (the payroll provider) and uses social engineering to trick the recipient into clicking a malicious link. Phishing specifically involves fraudulent electronic communications, such as email, to deceive victims into revealing sensitive information or installing malware. The attack vector here is email-based, which aligns directly with the definition of phishing in the SY0-701 domain of threats and vulnerabilities.

Answer

Baiting

Answer

Vishing

Answer

Pretexting

Question 3

A weekly scan reports three findings: a medium-severity missing patch on a lab VM with no network access, a high-severity default credential on a management interface reachable from the internet, and a low-severity outdated browser plug-in on a visitor kiosk. Which issue should be remediated first?

Accepted Answer

The high-severity default credential on the management interface exposed to the internet.. The high-severity default credential on a management interface reachable from the internet represents an immediate, exploitable risk. Default credentials are well-known and can be used by attackers to gain full administrative control over the device, often leading to a complete compromise of the network. In contrast, the other findings have compensating controls (no network access) or lower impact (outdated browser plug-in), making them lower priority in a risk-based remediation strategy.

Answer

The medium-severity missing patch on the isolated lab VM.

Answer

The low-severity outdated browser plug-in on the visitor kiosk.

Answer

All three issues have the same priority because they were found in the same scan cycle.

Question 4

A security analyst receives multiple alerts indicating that several users in the finance department clicked a malicious link in an email. The analyst has confirmed the email subject line and sender address. Which of the following is the BEST first step to contain the incident?

Accepted Answer

Block the sender's email address at the email gateway.. Blocking the sender's email address at the email gateway is the best first step because it immediately prevents further malicious emails from that sender from reaching any users, containing the incident at the perimeter. This action stops the spread of the attack without disrupting user productivity or requiring time-consuming analysis, aligning with the priority of containment in incident response.

Answer

Disable the users' accounts.

Answer

Perform a forensic analysis of the emails.

Answer

Delete the emails from the users' mailboxes.

Question 5

An EDR console alerts that powershell.exe launched with an encoded command on a finance workstation, and a minute later the host begins making repeated outbound connections to an unfamiliar IP address. What is the best initial response?

Accepted Answer

Isolate the workstation through the EDR platform and preserve logs and volatile evidence for investigation.. Isolating the workstation via the EDR platform stops the immediate threat (the malicious outbound connections) while preserving volatile evidence (e.g., running processes, network connections, memory contents) and logs for forensic analysis. This aligns with the incident response principle of containment before eradication, and EDR isolation typically uses a host-based firewall rule to block all traffic except to the EDR management server, ensuring the host remains accessible for investigation.

Answer

Run a full antivirus scan first and leave the workstation online so the user can keep working.

Answer

Power off the workstation immediately to ensure the malicious process stops.

Answer

Create a permanent firewall rule that allows the unfamiliar IP address so you can observe more traffic.

Question 6

An organization stores full payment card numbers, analysts need the last four digits for investigation, and the backup team is worried about ransomware and stolen backup media. Which three controls best address these requirements? Select three.

Accepted Answer

Tokenize primary account numbers before they reach analytics, reporting, or test systems.. Tokenization replaces the full primary account number (PAN) with a unique token that retains the last four digits for analytics, so analysts can perform investigations without exposing sensitive cardholder data. This directly satisfies PCI DSS requirements for minimizing the use of full PANs in non-production environments, while preserving the utility needed for fraud analysis or reporting.

Answer

Store backups on the same production storage array to simplify restore operations.

Answer

Use simple masking only in spreadsheets while leaving the source database unchanged.

Question 7

During routine checks, configuration management finds several branch firewalls drifted from the approved baseline because a contractor changed settings locally. An automation job now compares each device nightly and automatically reapplies the approved configuration without waiting for a human ticket. Which control type is the automation?

Accepted Answer

Corrective control. The automation job corrects a detected drift by automatically reapplying the approved configuration, which is a classic corrective control. Corrective controls are designed to remediate or reverse an unwanted change or security event after it has been detected. In this scenario, the nightly comparison is detective, but the automatic reapplication is the corrective action.

Answer

Directive control

Answer

Detective control

Answer

Deterrent control

Question 8

A SIEM alert shows 300 failed logins against the same VPN account from one source IP over 12 minutes, followed by a successful login from that same IP and a spike in mailbox access. The user says they did not initiate the session. What is the most likely cause?

Accepted Answer

A brute-force attack that eventually guessed the correct password. The sequence of 300 failed logins from a single source IP against one VPN account, followed by a successful login and abnormal mailbox access, is the classic pattern of a brute-force attack. The attacker systematically tried many passwords until they guessed the correct one, then used the compromised credentials to access the user's mailbox. The user's denial confirms the session was unauthorized, ruling out legitimate reconnection or synchronization.

Answer

A password-spraying attempt against many different accounts

Answer

A normal VPN reconnect after a brief network outage

Answer

A false positive caused by email synchronization

Question 9

Based on the exhibit, which change would best reduce the attack surface of the public web server while preserving remote administration from the internal network?

Accepted Answer

Move WEB01 into a DMZ and allow only the reverse proxy or load balancer to reach it on HTTPS, with admin access limited to the jump host.. Moving WEB01 into a DMZ and restricting inbound HTTPS traffic to only the reverse proxy or load balancer minimizes the server's exposure to the internet while still allowing external users to access the web application. Admin access from the internal network is preserved by limiting it to a jump host, which provides a controlled, audited entry point. This architecture follows the principle of least privilege and network segmentation, reducing the attack surface without sacrificing necessary functionality.

Answer

Assign WEB01 a public IP address directly and remove the firewall rules.

Answer

Place WEB01 on the same VLAN as user workstations so the firewall can inspect traffic more easily.

Answer

Keep the server where it is and add outbound web filtering to stop exploitation attempts.

Question 10

An employee receives a phone call from someone claiming to be IT and asking for a one-time verification code to "fix" the employee's account. What is the best response?

Accepted Answer

Refuse to share the code and report the call through the company's security process.. It follows the principle of never sharing authentication factors, especially one-time verification codes, with anyone over the phone. This scenario is a classic social engineering attack (vishing) where the attacker attempts to bypass multi-factor authentication (MFA) by tricking the employee into revealing a time-based one-time password (TOTP) or similar code. Reporting the call through the company's security process allows the incident to be investigated and mitigates further risk.

Answer

Provide the code quickly so the support call can be completed without delay.

Answer

Reply to the caller by email with the code and ask them to confirm receipt.

Answer

Change the password immediately and then tell the caller the new password.

Question 11

The SOC is writing step-by-step instructions for responding to a suspected malware infection on a laptop. The document should tell analysts exactly what to do first, second, and third during triage and containment. Which governance artifact should they create?

Accepted Answer

Procedure, because it gives a repeatable sequence of actions for a specific task.. A procedure is the correct governance artifact because it provides a detailed, step-by-step sequence of actions for a specific task—in this case, triaging and containing a suspected malware infection on a laptop. Unlike policies or standards, which set high-level intent or goals, a procedure ensures repeatable and consistent execution by analysts during incident response.

Answer

Policy, because it states the organization's broad security intent.

Answer

Guideline, because it offers optional advice that analysts may choose to follow.

Answer

Standard, because it defines the organization's security goals at a high level.

Question 12

A small company wants all employees to lock their screens after 10 minutes of inactivity, and the rule is included in the formal security policy. What type of control is this?

Accepted Answer

Directive control, because it tells users what behavior is required.. A directive control is designed to guide or mandate user behavior through policies or procedures. In this case, the security policy explicitly requires employees to lock their screens after 10 minutes of inactivity, which is a directive that tells users what they must do. This is a procedural control, not a technical enforcement mechanism, so it falls under directive controls.

Answer

Detective control, because it discovers misuse after it happens.

Answer

Corrective control, because it repairs damage after an incident.

Answer

Compensating control, because it replaces a missing technical safeguard.

Question 13

A workstation starts failing security checks. The antivirus service no longer appears in the running process list, a known driver's hash does not match the vendor's value, and a task manager view shows fewer processes than expected. The user also reports that local admin tools behave inconsistently. What type of malware is most likely present?

Accepted Answer

Rootkit. The symptoms—antivirus service missing from the process list, a known driver's hash mismatch, fewer processes in Task Manager, and inconsistent admin tool behavior—are classic indicators of a rootkit. Rootkits operate at kernel or driver level, allowing them to hide processes, files, and registry keys from standard system tools, and they often tamper with driver hashes to evade integrity checks.

Answer

Spyware

Answer

Trojan

Answer

Logic bomb

Question 14

A manufacturer wants to give partner-company users access to a procurement portal. The partner wants to authenticate its own users, and the manufacturer does not want to create separate local passwords for them. What is the best solution?

Accepted Answer

Federate access with the partner's identity provider and map claims or attributes to portal roles.. Federation with the partner's identity provider (IdP) using standards like SAML 2.0 or OIDC allows the partner to authenticate their own users while the manufacturer's portal trusts those assertions. Claims or attributes from the IdP (e.g., group membership) are mapped to portal roles, eliminating the need for local passwords and enabling single sign-on (SSO). This is the best solution because it maintains security boundaries and offloads authentication management to the partner.

Answer

Create shared portal accounts and distribute credentials to the partner's staff.

Answer

Issue one VPN account for the partner organization and let them share it internally.

Answer

Require each partner user to create a password directly in the procurement portal.

Question 15

An HR department hires contractors for fixed 60-day engagements. Accounts should stop working automatically when the engagement ends, and any rehire should require fresh approval rather than restoring old access. What IAM control is the best fit?

Accepted Answer

Configure an account expiration date and automatic deprovisioning tied to the approved role.. Configuring an account expiration date and automatic deprovisioning tied to the approved role directly enforces the 60-day limit and ensures that when the engagement ends, the account is automatically disabled or removed. This approach also supports the requirement that rehire requires fresh approval, as the old account is deprovisioned and cannot be simply re-enabled without going through the provisioning process again.

Answer

Use one shared contractor account and rotate the password when people leave.

Answer

Disable the account after the contract ends but keep all group memberships unchanged.

Answer

Create a local workstation account so the contractor does not need centralized identity services.