SY0-701 Practice Test 35 — 15 Questions

Question 1

A help desk technician receives a call from someone claiming to be a new contractor whose MFA app failed during travel. The caller knows the company org chart, names the technician's supervisor, and says the technician should use a callback number included in a text message they just sent. What is the safest first action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

End the call and verify the request through a published help desk number or ticketing system.. The safest first action when receiving an unsolicited call requesting privileged actions (like MFA reset) is to independently verify the request through official channels. The caller's knowledge of internal details (org chart, supervisor name) and the request to use a callback number from a text message are classic social engineering red flags, as the callback number could be attacker-controlled. Hanging up and calling back via a published help desk number ensures the request is legitimate and prevents MFA bypass or account takeover.

Answer

Reset MFA immediately, since the caller has provided enough internal details to seem credible.

Answer

Ask the caller to read a one-time code aloud so the technician can confirm their identity.

Answer

Approve the request if the caller can name the supervisor and the contractor's project team.

Question 2

A sysadmin is preparing a dedicated database server for production. The server will not host web services, print services, or file sharing. Which action best follows least privilege and secure defaults?

Accepted Answer

Disable unused services and run the database under a dedicated least-privilege service account.. Disabling unused services reduces the attack surface, and running the database under a dedicated least-privilege service account ensures the account has only the permissions necessary for the database to function. This aligns with the principles of least privilege and secure defaults, as the server is dedicated to database services and should not have extraneous services or overly permissive accounts.

Answer

Enable every management service so support can connect easily.

Answer

Use the domain admin account to run the database service.

Answer

Share the same account with backup software to simplify troubleshooting.

Question 3

Before applying a critical patch to a production application server, which action best reduces the risk of extended downtime if the patch fails?

Accepted Answer

Create a verified backup or rollback plan before making the change.. Creating a verified backup or rollback plan before applying a critical patch ensures that if the patch causes unexpected failures or incompatibilities, the system can be restored to its previous stable state quickly. This directly reduces the risk of extended downtime by providing a reliable recovery path, which is a fundamental principle of change management and risk mitigation in production environments.

Answer

Apply the patch immediately without testing so the system is protected sooner.

Answer

Disable logging so the patch process uses fewer resources.

Answer

Postpone the patch indefinitely until all business users request it.

Question 4

A new SIEM rule generates many alerts from a scheduled backup job that is known to be legitimate. What should the analyst do to improve alert quality?

Accepted Answer

Tune the rule to exclude the known backup activity pattern.. Tuning the SIEM rule to exclude the known backup activity pattern reduces false positives while preserving detection of actual threats. By creating an exception for the specific backup server's IP, schedule, or process hash, the analyst maintains visibility into anomalous behavior without being overwhelmed by noise.

Answer

Disable all logging for the backup server.

Answer

Ignore the alerts permanently because the job is approved.

Answer

Reimage the backup server to stop the alerts.

Question 5

A security analyst is reviewing authentication logs from a corporate web application. The logs show thousands of failed login attempts over the past hour. Each attempt uses a different username, but all attempts use the same password 'Spring2024!'. The source IP addresses are widely distributed across several different geographic regions. Which type of attack is the analyst most likely observing?

Accepted Answer

Password spraying attack. The attack uses a single common password ('Spring2024!') against many different usernames, which is the hallmark of a password spraying attack. Unlike brute-force attacks that target one account with many passwords, password spraying avoids account lockout by trying one password across many accounts. The wide distribution of source IPs is consistent with a distributed password spraying campaign, often using botnets or proxies.

Answer

Brute-force attack

Answer

Credential stuffing attack

Answer

Dictionary attack

Question 6

Several employees in a branch office report that their laptops automatically connected to a network named "CorpWiFi" even though they were away from the office. Shortly afterward, a few users saw a captive portal asking them to re-enter company credentials. Which threat best explains this situation?

Accepted Answer

Evil twin access point impersonating the legitimate wireless network. The scenario describes an evil twin attack where a rogue access point broadcasts the SSID "CorpWiFi" to trick laptops into automatically connecting. Once connected, the attacker presents a fake captive portal to harvest credentials. This exploits the fact that client devices often prioritize known SSIDs without verifying the authenticity of the access point, relying solely on the network name.

Answer

Bluetooth pairing abuse from a nearby device

Answer

DNS poisoning caused by a compromised resolver

Answer

NFC relay attack against the laptops' login process

Question 7

A company is redesigning a customer portal. Internet users must reach only the web tier, the application tier must be reachable only from the web tier, and the database must be reachable only from the application tier. Administrators should manage servers from a dedicated jump host. Which design best meets these requirements?

Accepted Answer

Place web servers in a DMZ, application servers in an internal server subnet, databases in a restricted trust zone, and allow administration only through ACLs from a jump host.. Ly implements a layered security architecture by placing web servers in a DMZ (accessible from the internet), application servers in an internal subnet (accessible only from the DMZ), and databases in a restricted trust zone (accessible only from the application tier). Administration is restricted to a dedicated jump host, enforcing strict network segmentation and least-privilege access control via ACLs.

Answer

Place all servers on one VLAN and use host firewalls on each system.

Answer

Place the database servers in the DMZ so the web tier can query them directly from the internet-facing network.

Answer

Use NAT for all servers and keep every system on the same internal subnet to simplify routing.

Question 8

A supplier tells your company it wants to use a new subcontractor to process customer data. What is the BEST contract control to reduce this risk?

Accepted Answer

Require the vendor to notify the company before adding subcontractors. Requiring the vendor to notify the company before adding subcontractors is the best contract control because it ensures the company retains visibility and approval authority over any third party that will process customer data. This aligns with the principle of due diligence and third-party risk management, as the company can assess the subcontractor's security posture before data is shared. Without such a clause, the vendor could unilaterally introduce a subcontractor with inadequate security controls, increasing the risk of a data breach or compliance violation.

Answer

Allow subcontractors without review if the vendor remains responsible

Answer

Only require a verbal promise that the subcontractor is secure

Answer

Remove all contract language related to third parties

Question 9

A small company is deploying a public web application with a front-end server, an API server, and a database. The web server must be reachable from the internet, the API must be reachable only from the web server, and the database must never be accessible from user subnets. Which design best meets the requirement?

Accepted Answer

Place the web server in a DMZ, the API server in an internal subnet, and the database in a separate restricted subnet.. It implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) to be publicly accessible, the API server is placed in an internal subnet with firewall rules allowing only traffic from the web server, and the database is isolated in a restricted subnet with no access from user subnets. This design enforces the principle of least privilege and prevents direct internet exposure of the API and database, which is critical for protecting sensitive data.

Answer

Place all three servers on the same internal VLAN and use host firewalls only.

Answer

Place the database in the DMZ so the web server can connect to it with fewer firewall rules.

Answer

Use a single NAT gateway for all servers and rely on public IP filtering at the edge.

Question 10

A laptop user reports that many files now have strange extensions, a ransom note appears on the desktop, and the files cannot be opened. Which malware is most likely responsible?

Accepted Answer

Ransomware. Ransomware is the correct answer because it encrypts the user's files, appends a new extension (e.g., .encrypted or .locked), and displays a ransom note demanding payment for the decryption key. The symptoms of inaccessible files with altered extensions and a visible ransom note are the classic indicators of a ransomware infection, such as those caused by CryptoLocker or LockBit.

Answer

Spyware

Answer

Rootkit

Answer

Worm

Question 11

Based on the exhibit, what should the analyst do next to limit the impact of the suspected compromise?

Accepted Answer

Isolate FIN-LT-22 from the network to contain the suspected malware activity.. Isolating FIN-LT-22 from the network immediately stops the suspected malware from communicating with command-and-control servers or spreading laterally to other hosts. This containment step aligns with the NIST incident response framework's containment phase, which prioritizes limiting damage before eradication or recovery. In a suspected compromise, network isolation (e.g., disabling the switch port or using a host-based firewall rule) is the fastest way to cut off malicious traffic without destroying volatile evidence in memory.

Answer

Run a full antivirus scan first and wait for the results before taking any other action.

Answer

Reboot the laptop to clear the malicious process from memory.

Answer

Reset the user's password and close the ticket after confirming they can log in again.

Question 12

A scan reports a critical remote code execution vulnerability on an internet-facing VPN appliance with public proof-of-concept exploit code available. It also reports a critical local privilege escalation on an isolated lab workstation. Patch windows are limited this week. Which should be remediated first?

Accepted Answer

The internet-facing VPN appliance because it has higher exposure and exploitability.. The internet-facing VPN appliance presents a higher risk because it is exposed to the public internet and has a known remote code execution vulnerability with public exploit code. This combination of high exposure (attack surface) and high exploitability (availability of proof-of-concept code) significantly increases the likelihood of a successful attack, making it the priority for remediation despite limited patch windows.

Answer

The isolated lab workstation because all critical findings must be patched in numerical order.

Answer

The internal printer because peripheral devices are often overlooked and therefore most dangerous.

Answer

The lab workstation because local privilege escalation is always more dangerous than remote code execution.

Question 13

An IT manager wants a document that defines the mandatory minimum requirements for all company laptops, including full-disk encryption, password length, and screen-lock timing. The help desk also needs a separate document that shows exactly how to enroll a laptop in management software. Which document type should contain the mandatory laptop requirements?

Accepted Answer

Standard, because it defines the required technical settings that must be followed.. A standard defines mandatory, specific technical requirements that must be uniformly applied, such as full-disk encryption (e.g., AES-256), minimum password length (e.g., 14 characters), and screen-lock timeout (e.g., 5 minutes). Unlike a policy, which provides high-level direction, a standard enforces precise configuration baselines that all laptops must meet, ensuring compliance and security consistency.

Answer

Policy, because it gives broad direction without technical detail.

Answer

Procedure, because it gives step-by-step instructions for completing a task.

Answer

Guideline, because it offers flexible recommendations for administrators.

Question 14

A company is publishing an internet-facing customer portal that must also query an internal database containing order history. Security wants to reduce the chance that a compromise of the portal exposes the database directly. Which design is the best choice?

Accepted Answer

Place the portal in a DMZ and keep the database on an internal network with firewall rules allowing only required traffic.. Placing the portal in a DMZ and keeping the database on an internal network with firewall rules that permit only required traffic (e.g., specific ports like 1433/TCP for SQL Server or 3306/TCP for MySQL) creates a defense-in-depth architecture. This design ensures that even if the web server is compromised, the attacker cannot directly access the database from the internet, as the internal network is isolated by the firewall and only allows traffic from the DMZ to the database on necessary ports.

Answer

Place the database in the same subnet as the web server and rely on host-based antivirus.

Answer

Use NAT so the internal database does not have a public IP address.

Answer

Move both systems behind a VPN and require users to authenticate before visiting the portal.

Question 15

Based on the exhibit, which change best reduces the risk of lateral movement if a user workstation is compromised?

Accepted Answer

Require administrative access through a hardened bastion host and restrict direct management from user devices.. Requiring administrative access through a hardened bastion host enforces a jump-box architecture, which eliminates direct RDP, SSH, or WinRM from user workstations to servers. This segmentation prevents an attacker who compromises a user workstation from using stolen credentials or tools to laterally move to sensitive servers, as all management traffic must pass through a controlled, monitored, and often multi-factor-authenticated bastion host.

Answer

Add more workstations to VLAN 10 so authentication requests are faster.

Answer

Disable logging on the servers so attackers leave fewer traces if they connect.

Answer

Move all servers into the same VLAN as the workstations for easier access control.