SY0-701 Practice Test 36 — 15 Questions

Question 1

Based on the exhibit, what is the best next step before the marketing SaaS platform goes live?

Accepted Answer

Proceed only after the business owner formally accepts the remaining risk in writing.. The exhibit shows a residual risk rating of 'Medium' after the vendor's SOC report was reviewed. In the SY0-701 risk management framework, the business owner is the risk owner who must formally accept any residual risk before a system goes live, as they are accountable for the business impact. Proceeding without documented acceptance violates the principle of risk acceptance and could lead to unapproved exposure.

Answer

Ignore the residual risk because the vendor has a current SOC report.

Answer

Require the security team to approve the launch verbally so the project does not slow down.

Answer

Cancel the contract immediately because any medium risk rating is unacceptable.

Question 2

Based on the exhibit, which malware type best explains the behavior?

Accepted Answer

Rootkit. A rootkit is designed to hide its presence and the presence of other malware by modifying the operating system's kernel or system calls, allowing it to evade detection by security tools. The exhibit likely shows behavior such as file hiding, process concealment, or system call interception, which are hallmarks of rootkit activity. This aligns with the SY0-701 objective on understanding malware types and their characteristics.

Answer

Trojan

Answer

Logic bomb

Answer

Spyware

Question 3

An operations manager is worried a single network administrator could quietly push an unauthorized firewall rule. The manager wants every rule change reviewed by a second person and documented before implementation. Which control best addresses this concern?

Accepted Answer

Require a documented change-management workflow with two approvers before any firewall rule is applied.. A documented change-management workflow with two approvers directly enforces separation of duties, ensuring that no single administrator can implement a firewall rule change without peer review and documented approval. This control addresses the manager's concern about unauthorized changes by requiring a second person to review and approve before the rule is applied, which is a fundamental principle of access control and change management.

Answer

Enable detailed firewall logging so each packet match is written to disk.

Answer

Move the firewall appliance into a locked equipment rack.

Answer

Encrypt the firewall configuration backup with a strong key.

Question 4

The executive team wants to know which payment services are most critical and how long each can be offline before the business is seriously harmed. Which activity should security support?

Accepted Answer

A business impact analysis, because it identifies critical functions and outage impact.. A business impact analysis (BIA) is the correct activity because it systematically identifies critical business functions—such as payment processing—and quantifies the maximum tolerable downtime (MTD) and recovery time objectives (RTO). This directly answers the executive team's question about which payment services are most critical and how long each can be offline before causing serious harm.

Answer

A tabletop exercise, because leaders are practicing response discussions.

Answer

Incident containment, because the goal is to stop an active breach.

Answer

Vulnerability scanning, because it finds weaknesses in systems.

Question 5

Employees in a lobby report that their phones automatically connected to a wireless network named "CorpWiFi." Soon after, they were prompted to sign in through a web page that did not look like the normal company portal. What attack is most likely?

Accepted Answer

Evil twin. The scenario describes an evil twin attack, where a rogue access point (AP) broadcasts a SSID identical to the legitimate corporate network ("CorpWiFi"). When employees' devices automatically connect to the stronger signal of the rogue AP, they are served a fake captive portal designed to capture credentials or other sensitive data. This attack exploits the lack of mutual authentication in standard 802.11 Wi-Fi associations.

Answer

Bluetooth pairing attack

Answer

NFC relay attack

Answer

MAC flooding

Question 6

Based on the exhibit, which change best moves the ERP recovery design toward meeting both recovery targets?

Accepted Answer

Add a warm standby database with 15-minute log shipping and scheduled failover tests.. Adding a warm standby database with 15-minute log shipping significantly reduces the recovery point objective (RPO) to near-zero and, combined with scheduled failover tests, ensures the recovery time objective (RTO) is met. This directly addresses the gap between the current backup-only approach and the required recovery targets, as log shipping provides near-continuous data protection and failover testing validates the recovery process.

Answer

Increase the full backup frequency to every night and keep the same recovery process.

Answer

Move backup media to the same server to reduce transfer time.

Answer

Eliminate differential backups and rely only on weekly full backups.

Question 7

An employee receives an email that appears to be from the CEO and asks for an urgent wire transfer. The sender address is slightly different from the real company address. What is the best first action?

Accepted Answer

Verify the request using a separate trusted method. The email exhibits classic signs of a business email compromise (BEC) attack, where the sender address is spoofed or slightly altered. Verifying the request through a separate, trusted method—such as calling the CEO directly or using a known internal communication channel—bypasses any compromised email system and confirms the legitimacy of the request. This aligns with the principle of out-of-band verification, which is a key defense against phishing and social engineering.

Answer

Complete the transfer because it came from an executive

Answer

Reply to the email asking if it is real

Answer

Forward it to the whole department for awareness

Question 8

Based on the exhibit, which indicator should defenders prioritize for detecting future activity from this campaign?

Accepted Answer

The TLS certificate fingerprint that remains constant across samples.. A TLS certificate fingerprint that remains constant across samples provides a stable, attacker-controlled indicator that is difficult for adversaries to change without incurring cost or operational friction. Unlike domain names or user agents, which can be rotated easily, TLS certificates require the attacker to generate or compromise a new private key and certificate, making the fingerprint a persistent and reliable detection signature for defenders.

Answer

The daily-changing domain names used by the campaign.

Answer

The executable file hash that remains constant across samples.

Answer

The changing user agent string seen on each host.

Question 9

A security team discovers that several laptops occasionally boot from a removable drive before Windows loads, allowing unapproved recovery tools to run. Management wants to prevent this with the least impact on normal users. Which control is the best fit?

Accepted Answer

Enable secure boot and restrict the firmware boot order so only the approved internal boot path is allowed.. Secure Boot ensures that only signed, trusted firmware and bootloaders execute during the startup process. By restricting the firmware boot order to the internal drive only, the laptop will ignore removable media during boot, preventing unapproved recovery tools from running before Windows loads. This has minimal impact on normal users because they can still use USB devices after the OS has booted.

Answer

Disable all USB ports permanently on every laptop.

Answer

Uninstall the endpoint protection agent and replace it with manual inspections.

Answer

Move user data to cloud storage so rogue boot media can no longer access it.

Question 10

A facilities manager receives an SMS from "FedEx Delivery" saying a shipment for the research lab cannot clear security until the recipient verifies the package by signing in. The message includes the manager's initials and the warehouse code, and the link opens a cloned sign-in page. Which attack is most likely?

Accepted Answer

Smishing, because the attacker is using a text message to deliver a targeted credential lure.. Smishing is a social engineering attack that uses SMS (Short Message Service) to deliver a fraudulent message designed to trick the recipient into revealing sensitive information. In this scenario, the attacker sends a text message impersonating FedEx, includes the manager's initials and warehouse code for personalization, and provides a link to a cloned sign-in page, which is the classic credential-harvesting mechanism of a smishing attack.

Answer

Vishing, because the attacker is pretending to be a delivery service representative.

Answer

Spear phishing, because the message is targeted using the recipient's role and location.

Answer

Baiting, because the message offers a shipment verification reward to encourage action.

Question 11

A company is evaluating a multi-tenant SaaS document platform. The security team wants to reduce the impact of another tenant’s breach and ensure employees who leave are removed from the app within minutes. Which two requirements should the team prioritize? Select two.

Accepted Answer

Require the provider to document logical tenant isolation and separate customer encryption keys.. Logical tenant isolation (e.g., separate databases or namespaces) and separate customer encryption keys ensure that a breach in one tenant cannot access another tenant's data, directly reducing the impact of cross-tenant attacks. This aligns with the shared responsibility model in SaaS, where the provider must enforce strong multi-tenant boundaries at the application and data layers.

Answer

Use a shared local administrator account for the app so offboarding is easier.

Answer

Allow anonymous public links as the default method for external collaboration.

Answer

Rely on manual quarterly cleanup tickets to disable former employees.

Question 12

A small company has two security issues and can fix only one this week. Which should be prioritized first? One issue is an internal lab server with a medium-severity flaw. The other is an internet-facing login portal using default administrator credentials.

Accepted Answer

Fix the internet-facing login portal first because default administrator credentials create a much higher risk.. The internet-facing login portal using default administrator credentials represents an immediate, high-impact risk because it allows unauthorized remote access with administrative privileges. Default credentials are well-known and actively targeted by automated scanners and attackers, making exploitation trivial. In contrast, the internal lab server with a medium-severity flaw is behind network segmentation and requires additional access, so its risk is lower and can be deferred.

Answer

Fix the internal lab server first because every vulnerability should be treated equally.

Answer

Wait until the monthly maintenance window so both issues can be fixed at the same time.

Answer

Ignore both issues until users report symptoms, then respond if something happens.

Question 13

A help desk team wants users to be unable to install unsanctioned browser extensions or freeware on corporate Windows laptops, while approved business apps still run. Which endpoint control is best?

Accepted Answer

Application allowlisting or application control.. Application allowlisting (or application control) is the correct endpoint control because it explicitly defines which software executables, scripts, and installers are permitted to run on the system. By default, all unapproved applications—including unsanctioned browser extensions and freeware—are blocked, while approved business apps are allowed to execute. This directly addresses the requirement to prevent unauthorized installations while maintaining normal operations for sanctioned software.

Answer

Full-disk encryption on every laptop.

Answer

A remote access VPN.

Answer

A desktop wallpaper policy.

Question 14

An employee reports a ransomware note on a finance laptop. The laptop is still powered on, connected to Wi-Fi, and the user says they were just working in a spreadsheet. Management wants the fastest safe response that also preserves evidence. What should the responder do first?

Accepted Answer

Isolate the laptop from the network while keeping it powered on for volatile evidence collection.. The immediate priority is to contain the ransomware while preserving volatile evidence (e.g., memory contents, running processes, network connections) that could be critical for forensic analysis. Powering off the laptop (Option A) would destroy volatile data and may allow the ransomware to persist or trigger additional encryption on reboot. Isolating the network connection stops the ransomware from communicating with its command-and-control server or spreading laterally, while keeping the system powered on allows a responder to capture memory with tools like FTK Imager or LiME before performing a controlled shutdown.

Answer

Shut the laptop down immediately to prevent further encryption activity.

Answer

Ask the user to close all open applications and log off normally.

Answer

Start deleting suspicious files to reduce the impact of the ransomware.

Question 15

Threat intelligence shows an attacker changes the domain name every day, but the malware file hash stays the same across incidents. What should defenders prioritize for blocking?

Accepted Answer

The malware file hash, because it remains consistent across incidents.. The malware file hash (e.g., MD5, SHA-1, or SHA-256) is a static, deterministic value derived from the malware's binary content. Since the attacker reuses the same malware across incidents, the hash remains consistent, making it a reliable indicator of compromise (IOC) for blocking via hash-based allow/deny lists in endpoint protection or network security controls. In contrast, domain names change daily (fast flux), so blocking them is less sustainable and requires constant updates.

Answer

The daily domain names, because they are the easiest indicator to find.

Answer

The color of the phishing email, because visual style is unique to the attacker.

Answer

The user's browser homepage, because attackers often change it after infection.