SY0-701 Practice Test 35 — 15 Questions

Question 1

A SIEM report shows this sequence over 25 minutes: the same public IP submitted one failed password attempt against 53 different accounts, then one account successfully authenticated, created an inbox forwarding rule, and downloaded hundreds of messages through the web portal. Which two conclusions are best supported? Select two.

Accepted Answer

The pattern is consistent with a password spraying attack.. Option A is correct because the SIEM shows a single public IP attempting one failed password against 53 different accounts over 25 minutes. This pattern—low-and-slow, one attempt per account—is the hallmark of a password spraying attack, which avoids account lockout thresholds by never hitting the same account repeatedly. The subsequent successful authentication and mailbox abuse confirm the attacker found a weak password for one account.

Answer

The attacker is performing a brute-force attack against one account.

Answer

The activity is most likely credential stuffing with multiple known password pairs.

Answer

The events primarily indicate a denial-of-service attack against the mail system.

Question 2

A SIEM reviews VPN authentication logs and sees 36 different usernames each receive one failed login attempt from the same source IP over 20 minutes, followed by one successful login to an unrelated account. Which attack is most likely?

Accepted Answer

Password spraying against many accounts with a low number of attempts per account.. The SIEM observed 36 different usernames each receiving one failed login attempt from the same source IP over 20 minutes, followed by one successful login to an unrelated account. This pattern is characteristic of a password spraying attack, where an attacker tries a small number of common passwords against many accounts to avoid account lockout thresholds, and then uses a successful credential to pivot to another account. The low number of attempts per account (one each) and the wide spread of usernames distinguish it from brute-force or targeted attacks.

Answer

A brute-force attack focused on a single locked account.

Answer

A replay attack using captured authentication data.

Answer

A port scan that accidentally triggered authentication failures.

Question 3

A small company is publishing an internal website to the internet. The security team wants the web server reachable from the internet while keeping the database and file share isolated from direct internet access. Which design is best?

Accepted Answer

Place the web server in a DMZ and keep the database and file share on a private internal subnet.. Option B is correct because it implements a DMZ architecture where the web server is placed in a publicly accessible network segment, while the database and file share reside on a private internal subnet. This design ensures that even if the web server is compromised, an attacker cannot directly access the internal resources because firewall rules restrict inbound traffic to only the DMZ and block any initiated connections from the DMZ to the internal network. This follows the principle of defense in depth and network segmentation as recommended by CompTIA for securing multi-tier applications.

Answer

Place the web server and database on the same flat internal network behind the firewall.

Answer

Place the database in the DMZ and keep the web server on the internal user VLAN.

Answer

Use a VPN for all users and keep every server on the same subnet.

Question 4

A small company is deploying a public web application with a front-end server, an API server, and a database. The web server must be reachable from the internet, the API must be reachable only from the web server, and the database must never be accessible from user subnets. Which design best meets the requirement?

Accepted Answer

Place the web server in a DMZ, the API server in an internal subnet, and the database in a separate restricted subnet.. Option B is correct because it implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) to be publicly accessible, the API server is placed in an internal subnet with firewall rules allowing only traffic from the web server, and the database is isolated in a restricted subnet with no access from user subnets. This design enforces the principle of least privilege and prevents direct internet exposure of the API and database, which is critical for protecting sensitive data.

Answer

Place all three servers on the same internal VLAN and use host firewalls only.

Answer

Place the database in the DMZ so the web server can connect to it with fewer firewall rules.

Answer

Use a single NAT gateway for all servers and rely on public IP filtering at the edge.

Question 5

A small company wants all employees to lock their screens after 10 minutes of inactivity, and the rule is included in the formal security policy. What type of control is this?

Accepted Answer

Directive control, because it tells users what behavior is required.. A directive control is designed to guide or mandate user behavior through policies or procedures. In this case, the security policy explicitly requires employees to lock their screens after 10 minutes of inactivity, which is a directive that tells users what they must do. This is a procedural control, not a technical enforcement mechanism, so it falls under directive controls.

Answer

Detective control, because it discovers misuse after it happens.

Answer

Corrective control, because it repairs damage after an incident.

Answer

Compensating control, because it replaces a missing technical safeguard.

Question 6

A user reports a ransomware note on one department file share, but other departments are still working normally. What is the best first containment action?

Accepted Answer

Disconnect the affected file share or server from the network.. Option B is correct because the immediate priority in a ransomware incident is to contain the threat by isolating the affected system to prevent lateral movement. Disconnecting the file share or server from the network stops the ransomware from encrypting additional files or spreading to other departments via SMB or other protocols. This aligns with the NIST SP 800-61 containment strategy, which emphasizes rapid isolation without disrupting unaffected systems.

Answer

Shut down the entire company network immediately.

Answer

Delete the ransom note and wait to see whether the problem returns.

Answer

Restore the share immediately before checking what caused the incident.

Question 7

A SOC analyst receives an alert from the VPN appliance and identity platform. In the last 10 minutes, a user account had 14 failed VPN logons from one country, then one successful login from a different country. The user calls the help desk and says they have not used their account today. What should the analyst do first?

Accepted Answer

Disable the user account and revoke active sessions or tokens while escalating the event as a suspected account compromise.. Option B is correct because the combination of multiple failed logins from one country followed by a successful login from a different country, combined with the user's denial of activity, is a classic indicator of account compromise (e.g., credential stuffing or token theft). Disabling the account and revoking active sessions/tokens immediately stops the attacker's access, preventing further lateral movement or data exfiltration, while escalation ensures proper incident response. This aligns with the CompTIA incident response process: identification, containment, eradication, and recovery.

Answer

Block the foreign IP address at the firewall and wait for more alerts before acting.

Answer

Reset the user password and close the alert because the new password will stop the attack.

Answer

Reimage the user’s laptop immediately to remove any possible malware before taking other steps.

Question 8

A SOC analyst receives an alert that a domain admin account authenticated to a file server at 02:14 from a jump host that is normally used only by the infrastructure team. The Windows logs also show a scheduled task launching a backup script at the same time, and the backup team says the task was created during yesterday's change window. What is the best next step to determine whether this is a false positive?

Accepted Answer

Correlate the authentication event with the change ticket and the scheduled task details.. Option B is correct because the alert involves a domain admin authentication from a jump host at an unusual time, but the scheduled task was created during a change window. Correlating the authentication event with the change ticket and the scheduled task details allows the SOC analyst to verify if the activity was authorized, preventing unnecessary incident response. This step aligns with the incident response process of validating alerts before taking action.

Answer

Disable the domain admin account immediately and wait for the backup team to respond.

Answer

Escalate the alert as confirmed compromise because the login occurred after hours.

Answer

Delete the scheduled task so it cannot be used again.

Question 9

A SOC analyst reviews an EDR alert on a finance workstation. The alert shows powershell.exe launched with an encoded command, downloaded a payload into memory, and then spawned rundll32.exe. No new executable was written to disk, but the process later created a scheduled task for persistence. Which two findings most strongly support a fileless attack? Select two.

Accepted Answer

powershell.exe launched with an encoded command and executed the payload in memory. Option A is correct because executing a PowerShell encoded command that downloads and runs a payload entirely in memory, without writing to disk, is a hallmark of fileless malware. This technique avoids traditional file-based detection by leveraging PowerShell's ability to load and execute scripts directly in memory, bypassing disk-based antivirus scans.

Answer

a new portable executable was written to the user's temporary folder before being run

Answer

the endpoint antivirus quarantined the payload after a signature match

Answer

a USB storage device was inserted shortly before the alert fired

Question 10

A SOC analyst reviews an alert on a workstation where PowerShell launched from a scheduled task, downloaded an encoded command from a remote server, and then spawned rundll32.exe. Traditional antivirus did not flag any files on disk, and the activity stops after rebooting the host. Which type of malware behavior best fits this event?

Accepted Answer

Fileless attack using trusted system tools to run malicious code in memory. The attack uses PowerShell to download and execute an encoded command directly in memory, then spawns rundll32.exe—both are trusted Microsoft binaries. No files are written to disk, and the activity ceases after reboot, which are hallmarks of a fileless malware attack that operates entirely in volatile memory.

Answer

Worm behavior that is spreading through SMB shares

Answer

Rootkit that is hiding itself by modifying kernel drivers

Answer

Trojan that can only run after a user manually opens a malicious attachment

Question 11

A SOC analyst sees repeated encoded PowerShell launched by mshta.exe. No new executable is written to disk, but the host makes periodic outbound connections to the same IP. Which malware characteristic is most likely?

Accepted Answer

Fileless attack, because the malicious activity lives in memory and uses built-in tools.. The scenario describes encoded PowerShell commands executed by mshta.exe without writing a new executable to disk, which is a classic fileless attack technique. Fileless malware operates entirely in memory, leveraging legitimate system tools (like PowerShell and mshta) to evade traditional antivirus detection, and the outbound connections are for command-and-control (C2) communication, not for self-propagation or data theft.

Answer

Worm, because the host is making outbound connections to a remote system.

Answer

Spyware, because the host is communicating with an external IP address.

Answer

Rootkit, because the system tools are being hidden from the user.

Question 12

A software vendor distributes critical security updates for its application through a public download website. The vendor wants to allow customers to verify that each update originated from the vendor and has not been modified in transit. Which of the following cryptographic techniques should the vendor apply to the update files before posting them for download?

Accepted Answer

Digital signature. A digital signature provides both authentication (proving the update originated from the vendor) and integrity (detecting any modification in transit). The vendor signs the file with their private key, and customers verify the signature using the vendor's public key, ensuring the file has not been altered since signing.

Answer

Cryptographic hash

Answer

Antivirus scan report

Answer

TLS certificate

Question 13

A file server in the accounting department begins renaming documents and dropping ransom notes. The SOC confirms encryption is still in progress, and the server hosts a share used by several finance teams. What should the incident response team do first?

Accepted Answer

Disconnect the server from the network to contain the spread.. Disconnecting the server from the network is the immediate containment step to prevent the ransomware from encrypting additional files on the share or spreading laterally to other systems. Since encryption is still in progress, isolating the server stops the attacker's process from accessing more files and blocks any command-and-control (C2) communication. This aligns with the NIST incident response framework's containment phase, prioritizing stopping the spread over recovery or notification.

Answer

Restore the file share from backup immediately while the server is still connected.

Answer

Power off the server immediately without any other action.

Answer

Notify users to change their passwords before any technical action is taken.

Question 14

A sysadmin is preparing a dedicated database server for production. The server will not host web services, print services, or file sharing. Which action best follows least privilege and secure defaults?

Accepted Answer

Disable unused services and run the database under a dedicated least-privilege service account.. Option C is correct because disabling unused services reduces the attack surface, and running the database under a dedicated least-privilege service account ensures the account has only the permissions necessary for the database to function. This aligns with the principles of least privilege and secure defaults, as the server is dedicated to database services and should not have extraneous services or overly permissive accounts.

Answer

Enable every management service so support can connect easily.

Answer

Use the domain admin account to run the database service.

Answer

Share the same account with backup software to simplify troubleshooting.

Question 15

A security manager publishes a document that tells help desk staff exactly how to verify identity, reset an admin password, record the ticket number, and close out the request during a maintenance window. What type of governance artifact is this?

Accepted Answer

Procedure. Option C is correct because a procedure is a step-by-step, ordered list of tasks required to perform a specific operational activity. The document describes exactly how to verify identity, reset an admin password, record the ticket number, and close out the request, which matches the definition of a procedure in governance frameworks.

Answer

Policy

Answer

Standard

Answer

Guideline