SY0-701 Practice Test 35 — 15 Questions

Question 1

A small company is deploying a public web application with a front-end server, an API server, and a database. The web server must be reachable from the internet, the API must be reachable only from the web server, and the database must never be accessible from user subnets. Which design best meets the requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the web server in a DMZ, the API server in an internal subnet, and the database in a separate restricted subnet.. It implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) to be publicly accessible, the API server is placed in an internal subnet with firewall rules allowing only traffic from the web server, and the database is isolated in a restricted subnet with no access from user subnets. This design enforces the principle of least privilege and prevents direct internet exposure of the API and database, which is critical for protecting sensitive data.

Answer

Place all three servers on the same internal VLAN and use host firewalls only.

Answer

Place the database in the DMZ so the web server can connect to it with fewer firewall rules.

Answer

Use a single NAT gateway for all servers and rely on public IP filtering at the edge.

Question 2

A laptop user reports that many files now have strange extensions, a ransom note appears on the desktop, and the files cannot be opened. Which malware is most likely responsible?

Accepted Answer

Ransomware. Ransomware is the correct answer because it encrypts the user's files, appends a new extension (e.g., .encrypted or .locked), and displays a ransom note demanding payment for the decryption key. The symptoms of inaccessible files with altered extensions and a visible ransom note are the classic indicators of a ransomware infection, such as those caused by CryptoLocker or LockBit.

Answer

Spyware

Answer

Rootkit

Answer

Worm

Question 3

Based on the exhibit, what should the analyst do next to limit the impact of the suspected compromise?

Accepted Answer

Isolate FIN-LT-22 from the network to contain the suspected malware activity.. Isolating FIN-LT-22 from the network immediately stops the suspected malware from communicating with command-and-control servers or spreading laterally to other hosts. This containment step aligns with the NIST incident response framework's containment phase, which prioritizes limiting damage before eradication or recovery. In a suspected compromise, network isolation (e.g., disabling the switch port or using a host-based firewall rule) is the fastest way to cut off malicious traffic without destroying volatile evidence in memory.

Answer

Run a full antivirus scan first and wait for the results before taking any other action.

Answer

Reboot the laptop to clear the malicious process from memory.

Answer

Reset the user's password and close the ticket after confirming they can log in again.

Question 4

A scan reports a critical remote code execution vulnerability on an internet-facing VPN appliance with public proof-of-concept exploit code available. It also reports a critical local privilege escalation on an isolated lab workstation. Patch windows are limited this week. Which should be remediated first?

Accepted Answer

The internet-facing VPN appliance because it has higher exposure and exploitability.. The internet-facing VPN appliance presents a higher risk because it is exposed to the public internet and has a known remote code execution vulnerability with public exploit code. This combination of high exposure (attack surface) and high exploitability (availability of proof-of-concept code) significantly increases the likelihood of a successful attack, making it the priority for remediation despite limited patch windows.

Answer

The isolated lab workstation because all critical findings must be patched in numerical order.

Answer

The internal printer because peripheral devices are often overlooked and therefore most dangerous.

Answer

The lab workstation because local privilege escalation is always more dangerous than remote code execution.

Question 5

An IT manager wants a document that defines the mandatory minimum requirements for all company laptops, including full-disk encryption, password length, and screen-lock timing. The help desk also needs a separate document that shows exactly how to enroll a laptop in management software. Which document type should contain the mandatory laptop requirements?

Accepted Answer

Standard, because it defines the required technical settings that must be followed.. A standard defines mandatory, specific technical requirements that must be uniformly applied, such as full-disk encryption (e.g., AES-256), minimum password length (e.g., 14 characters), and screen-lock timeout (e.g., 5 minutes). Unlike a policy, which provides high-level direction, a standard enforces precise configuration baselines that all laptops must meet, ensuring compliance and security consistency.

Answer

Policy, because it gives broad direction without technical detail.

Answer

Procedure, because it gives step-by-step instructions for completing a task.

Answer

Guideline, because it offers flexible recommendations for administrators.

Question 6

A company is publishing an internet-facing customer portal that must also query an internal database containing order history. Security wants to reduce the chance that a compromise of the portal exposes the database directly. Which design is the best choice?

Accepted Answer

Place the portal in a DMZ and keep the database on an internal network with firewall rules allowing only required traffic.. Placing the portal in a DMZ and keeping the database on an internal network with firewall rules that permit only required traffic (e.g., specific ports like 1433/TCP for SQL Server or 3306/TCP for MySQL) creates a defense-in-depth architecture. This design ensures that even if the web server is compromised, the attacker cannot directly access the database from the internet, as the internal network is isolated by the firewall and only allows traffic from the DMZ to the database on necessary ports.

Answer

Place the database in the same subnet as the web server and rely on host-based antivirus.

Answer

Use NAT so the internal database does not have a public IP address.

Answer

Move both systems behind a VPN and require users to authenticate before visiting the portal.

Question 7

Based on the exhibit, which change best reduces the risk of lateral movement if a user workstation is compromised?

Accepted Answer

Require administrative access through a hardened bastion host and restrict direct management from user devices.. Requiring administrative access through a hardened bastion host enforces a jump-box architecture, which eliminates direct RDP, SSH, or WinRM from user workstations to servers. This segmentation prevents an attacker who compromises a user workstation from using stolen credentials or tools to laterally move to sensitive servers, as all management traffic must pass through a controlled, monitored, and often multi-factor-authenticated bastion host.

Answer

Add more workstations to VLAN 10 so authentication requests are faster.

Answer

Disable logging on the servers so attackers leave fewer traces if they connect.

Answer

Move all servers into the same VLAN as the workstations for easier access control.

Question 8

Based on the exhibit, what is the best next step before the marketing SaaS platform goes live?

Accepted Answer

Proceed only after the business owner formally accepts the remaining risk in writing.. The exhibit shows a residual risk rating of 'Medium' after the vendor's SOC report was reviewed. In the SY0-701 risk management framework, the business owner is the risk owner who must formally accept any residual risk before a system goes live, as they are accountable for the business impact. Proceeding without documented acceptance violates the principle of risk acceptance and could lead to unapproved exposure.

Answer

Ignore the residual risk because the vendor has a current SOC report.

Answer

Require the security team to approve the launch verbally so the project does not slow down.

Answer

Cancel the contract immediately because any medium risk rating is unacceptable.

Question 9

Based on the exhibit, which malware type best explains the behavior?

Accepted Answer

Rootkit. A rootkit is designed to hide its presence and the presence of other malware by modifying the operating system's kernel or system calls, allowing it to evade detection by security tools. The exhibit likely shows behavior such as file hiding, process concealment, or system call interception, which are hallmarks of rootkit activity. This aligns with the SY0-701 objective on understanding malware types and their characteristics.

Answer

Trojan

Answer

Logic bomb

Answer

Spyware

Question 10

An operations manager is worried a single network administrator could quietly push an unauthorized firewall rule. The manager wants every rule change reviewed by a second person and documented before implementation. Which control best addresses this concern?

Accepted Answer

Require a documented change-management workflow with two approvers before any firewall rule is applied.. A documented change-management workflow with two approvers directly enforces separation of duties, ensuring that no single administrator can implement a firewall rule change without peer review and documented approval. This control addresses the manager's concern about unauthorized changes by requiring a second person to review and approve before the rule is applied, which is a fundamental principle of access control and change management.

Answer

Enable detailed firewall logging so each packet match is written to disk.

Answer

Move the firewall appliance into a locked equipment rack.

Answer

Encrypt the firewall configuration backup with a strong key.

Question 11

The executive team wants to know which payment services are most critical and how long each can be offline before the business is seriously harmed. Which activity should security support?

Accepted Answer

A business impact analysis, because it identifies critical functions and outage impact.. A business impact analysis (BIA) is the correct activity because it systematically identifies critical business functions—such as payment processing—and quantifies the maximum tolerable downtime (MTD) and recovery time objectives (RTO). This directly answers the executive team's question about which payment services are most critical and how long each can be offline before causing serious harm.

Answer

A tabletop exercise, because leaders are practicing response discussions.

Answer

Incident containment, because the goal is to stop an active breach.

Answer

Vulnerability scanning, because it finds weaknesses in systems.

Question 12

Employees in a lobby report that their phones automatically connected to a wireless network named "CorpWiFi." Soon after, they were prompted to sign in through a web page that did not look like the normal company portal. What attack is most likely?

Accepted Answer

Evil twin. The scenario describes an evil twin attack, where a rogue access point (AP) broadcasts a SSID identical to the legitimate corporate network ("CorpWiFi"). When employees' devices automatically connect to the stronger signal of the rogue AP, they are served a fake captive portal designed to capture credentials or other sensitive data. This attack exploits the lack of mutual authentication in standard 802.11 Wi-Fi associations.

Answer

Bluetooth pairing attack

Answer

NFC relay attack

Answer

MAC flooding

Question 13

Based on the exhibit, which change best moves the ERP recovery design toward meeting both recovery targets?

Accepted Answer

Add a warm standby database with 15-minute log shipping and scheduled failover tests.. Adding a warm standby database with 15-minute log shipping significantly reduces the recovery point objective (RPO) to near-zero and, combined with scheduled failover tests, ensures the recovery time objective (RTO) is met. This directly addresses the gap between the current backup-only approach and the required recovery targets, as log shipping provides near-continuous data protection and failover testing validates the recovery process.

Answer

Increase the full backup frequency to every night and keep the same recovery process.

Answer

Move backup media to the same server to reduce transfer time.

Answer

Eliminate differential backups and rely only on weekly full backups.

Question 14

An employee receives an email that appears to be from the CEO and asks for an urgent wire transfer. The sender address is slightly different from the real company address. What is the best first action?

Accepted Answer

Verify the request using a separate trusted method. The email exhibits classic signs of a business email compromise (BEC) attack, where the sender address is spoofed or slightly altered. Verifying the request through a separate, trusted method—such as calling the CEO directly or using a known internal communication channel—bypasses any compromised email system and confirms the legitimacy of the request. This aligns with the principle of out-of-band verification, which is a key defense against phishing and social engineering.

Answer

Complete the transfer because it came from an executive

Answer

Reply to the email asking if it is real

Answer

Forward it to the whole department for awareness

Question 15

Based on the exhibit, which indicator should defenders prioritize for detecting future activity from this campaign?

Accepted Answer

The TLS certificate fingerprint that remains constant across samples.. A TLS certificate fingerprint that remains constant across samples provides a stable, attacker-controlled indicator that is difficult for adversaries to change without incurring cost or operational friction. Unlike domain names or user agents, which can be rotated easily, TLS certificates require the attacker to generate or compromise a new private key and certificate, making the fingerprint a persistent and reliable detection signature for defenders.

Answer

The daily-changing domain names used by the campaign.

Answer

The executable file hash that remains constant across samples.

Answer

The changing user agent string seen on each host.