SY0-701 Practice Test 37 — 15 Questions

Question 1

A vulnerability scan finds an administrative SSH service listening on 0.0.0.0 on a server that should be managed only from the internal network. What is the main security issue?

Accepted Answer

Exposed management service. The SSH service binding to 0.0.0.0 means it is listening on all network interfaces, including external-facing ones. This exposes the administrative management interface to potentially untrusted networks, violating the principle of least privilege and increasing the attack surface. The main security issue is that a service intended for internal management only is accessible from outside the trusted internal network.

Answer

Default credentials

Answer

Outdated component

Answer

Weak permissions

Question 2

A payment processor stores full card numbers in its transaction database, but developers and analysts should never see the real numbers in nonproduction reports or troubleshooting tools. The business still needs to correlate the same card across multiple records. Which technique is the best fit?

Accepted Answer

Tokenization, because it replaces the real value with a surrogate token for business use.. Tokenization is the best fit because it replaces the full card number with a unique, non-reversible surrogate token that retains the ability to correlate records (the same card always produces the same token). This allows the business to perform analytics and troubleshooting without exposing the actual sensitive data, as the token has no mathematical relationship to the original PAN and cannot be reversed.

Answer

Hashing, because the output can always be reversed by the application later.

Answer

Data masking, because it permanently deletes the sensitive record from the database.

Answer

Compression, because reducing file size also hides the payment information from users.

Question 3

During a tabletop exercise, the team realizes no one has a list of who to notify if the online ordering system goes down. Which continuity planning element is missing?

Accepted Answer

Communication plan, because it defines who must be contacted and how.. A communication plan is the missing continuity planning element because it specifically defines the stakeholders who must be notified during an outage (e.g., internal teams, vendors, customers) and the methods of contact (e.g., email, SMS, phone tree). Without this plan, the team cannot execute the notification procedures required by the business continuity plan (BCP) to coordinate response and recovery efforts for the online ordering system.

Answer

Data retention schedule, because it defines how long records are kept.

Answer

Asset inventory, because it lists all hardware and software in use.

Answer

Network segmentation, because it separates sensitive systems from user networks.

Question 4

An ERP database is backed up nightly to a NAS that remains online and is managed with the same admin group as production servers. After a ransomware incident, management wants the most effective change to improve recovery assurance without redesigning the whole environment. What should be implemented?

Accepted Answer

Use an offline or immutable backup copy and perform regular restore tests.. An offline or immutable backup copy ensures that ransomware cannot encrypt or delete the backup data, and regular restore tests verify that the backups are actually recoverable. This directly addresses the core requirement of improving recovery assurance without redesigning the environment, as it protects the backup from the same attack vector that compromised the production servers and the NAS managed by the same admin group.

Answer

Increase the NAS capacity so more backup jobs can be stored.

Answer

Add another full backup each night to create more copies on the same NAS.

Answer

Compress the backup files to reduce network usage during the nightly job.

Question 5

Following a ransomware incident, management wants proof that the organization can actually recover from its backups before declaring the backups trustworthy. What should the security team do next?

Accepted Answer

Restore a backup into an isolated test environment and validate the result.. The only way to prove that backups are trustworthy after a ransomware incident is to perform a full restoration into an isolated test environment and validate the integrity, completeness, and functionality of the recovered data. Simply checking that backup jobs completed successfully (Option A) does not verify that the backup data is uncorrupted, free from ransomware, or restorable in a real scenario. A controlled restore test provides tangible evidence that the recovery process works and the data is usable, which is the core requirement of management’s request for proof of recoverability.

Answer

Check that the backup job completed successfully during the last seven days.

Answer

Increase the backup retention period to reduce the chance of future loss.

Answer

Compress the backup files further so they take up less storage.

Question 6

Based on the exhibit, which change would most improve the security of the stored password data?

Accepted Answer

Add a unique salt per password and use a slow password hashing algorithm.. Adding a unique salt per password prevents precomputed rainbow table attacks, and using a slow password hashing algorithm (like bcrypt, PBKDF2, or Argon2) increases the computational cost of brute-force attacks. This combination ensures that even if the password hashes are compromised, attackers cannot efficiently crack them. Salting also ensures that identical passwords produce different hashes, eliminating the ability to detect shared passwords across accounts.

Answer

Store the passwords in encrypted form so they can be recovered later if needed.

Answer

Replace the hash with a plain SHA-256 digest because it is modern and widely supported.

Answer

Append the application name to each password before hashing to make the hashes unique.

Question 7

EDR on a workstation shows winword.exe spawning powershell.exe with hidden, no-profile, and encoded arguments. No new executable is written to disk. Minutes later, a scheduled task creation is blocked, but the same host continues making HTTPS requests to a cloud IP address. Which malware category best fits this behavior?

Accepted Answer

Fileless attack, because the payload is executed in memory using legitimate scripting tools and leaves little on disk.. The attack uses legitimate tools (winword.exe spawning powershell.exe) with hidden, no-profile, and encoded arguments to execute a payload entirely in memory, never writing a new executable to disk. This is the hallmark of a fileless attack, which relies on in-memory execution and living-off-the-land binaries (LOLBins) to evade traditional antivirus and disk-based detection. The subsequent scheduled task creation block and persistent HTTPS connections to a cloud IP further indicate a fileless malware that establishes command-and-control (C2) without dropping files.

Answer

Trojan, because the malicious activity likely started from a user-opening event.

Answer

Worm, because the host is making repeated outbound network connections.

Answer

Rootkit, because the process is using hidden commands and network connections.

Question 8

Based on the exhibit, what is the best next step before onboarding the vendor?

Accepted Answer

Require a security addendum with breach-notification timing, subprocessor approval, and audit rights.. The exhibit indicates the vendor has not yet provided a security addendum, which is a critical contractual document that defines security obligations such as breach-notification timing, subprocessor approval, and audit rights. Without this addendum, the organization lacks enforceable guarantees for data protection and incident response, making onboarding premature. Option B directly addresses this gap by requiring the addendum before proceeding.

Answer

Approve the vendor because it already passed a penetration test.

Answer

Ask the vendor to provide source code so developers can review it.

Answer

Move the workload to an internal shared drive until the vendor is ready.

Question 9

Based on the exhibit, what is the most likely conclusion after correlating the logs?

A configuration-management task ran from a jump host and generated repeated login alerts on target servers. The SOC wants to determine whether this is malicious activity or approved automation.

Accepted Answer

This is a likely false positive caused by approved automation, so the alert should be correlated with the change window.. The logs show repeated login attempts from a jump host, which is a common pattern for configuration-management tools (e.g., Ansible, Puppet) that execute tasks across multiple servers. The SOC should correlate these events with the approved change window to confirm they are part of legitimate automation, not malicious activity. Failed logins alone do not indicate a brute-force attack, as automation scripts may retry connections or use cached credentials that occasionally fail due to network latency or credential rotation.

Answer

This is a true brute-force attack because any failed login must be malicious.

Answer

This indicates DNS poisoning because both servers were contacted from the same source IP.

Answer

This is proof of ransomware spreading laterally over SMB.

Question 10

A support portal searches customers by last name using a parameter called q. After one user enters a single quote, the app returns a SQL syntax error. A tester then submits `test' OR '1'='1` and sees every customer record. Which control most directly prevents this issue?

Accepted Answer

Parameterize the database queries with prepared statements. The vulnerability is SQL injection, which occurs when user input is directly concatenated into a SQL query. Parameterized queries (prepared statements) separate SQL logic from data by using placeholders, ensuring user input is treated as data only and never executed as code. This directly prevents the attacker from injecting malicious SQL fragments like `' OR '1'='1`.

Answer

Encode all output returned to the browser

Answer

Add CSRF tokens to the login form

Answer

Move the application to a separate VLAN

Question 11

A company moved an internal application to a cloud virtual machine. The security team wants operating system login events, process activity, and network flow metadata to be available in the SIEM for investigations. Which action best supports that goal?

Accepted Answer

Enable guest OS audit logging and cloud-native flow logs, then forward the data to the SIEM.. It directly addresses the requirement to collect operating system login events, process activity, and network flow metadata. Enabling guest OS audit logging (e.g., via Windows Event Log or syslog) captures login and process events, while cloud-native flow logs (e.g., AWS VPC Flow Logs or Azure NSG flow logs) provide network flow metadata. Forwarding both data streams to the SIEM ensures centralized visibility for investigations.

Answer

Rely only on the cloud provider's service health dashboard and billing alerts.

Answer

Encrypt the virtual machine disks and disable all logging to reduce exposure.

Answer

Install only a web application firewall because that covers server log collection.

Question 12

Based on the exhibit, what is the best next step before the hotfix is released?

Accepted Answer

Pause release until the change is formally approved, tested, and has a documented rollback path.. Releasing a hotfix without formal approval, testing, and a documented rollback path violates the change management policy required by security program management. Even for urgent customer-facing issues, skipping these steps risks introducing new vulnerabilities or breaking other systems, which could lead to a larger outage. The exhibit indicates a need for controlled change processes, so pausing until the change is properly vetted ensures stability and security.

Answer

Deploy immediately because the issue is customer-facing and urgent.

Answer

Close the ticket after deployment and create a postmortem if users complain.

Answer

Ask support to warn users that sign-in may fail during the next hour.

Question 13

A scanner reports a critical vulnerability on an internal Linux server. The administrator verifies the package is installed, but the vulnerable code path is only present in a plugin that has been disabled and removed from the service startup. The server cannot be patched until a vendor maintenance window next month. What is the best next step?

Accepted Answer

Create a time-limited exception and apply compensating controls until patching is possible. The vulnerability exists in a disabled plugin, meaning the attack surface is reduced but not eliminated; residual risk remains if the plugin is re-enabled or if other dependencies are affected. Creating a time-limited exception with compensating controls (e.g., firewall rules, file permissions, SELinux policies) allows the organization to formally accept the risk until the vendor patch is applied, which aligns with standard vulnerability management processes.

Answer

Ignore the finding because the scanner is clearly wrong

Answer

Reinstall the disabled plugin so the scanner output matches the running configuration

Answer

Expose the server to the internet for faster monitoring and patch testing

Question 14

A finance clerk reports a call from a person who claimed to be from the bank's fraud department. The caller knew the employee's name, referenced a recent invoice, and asked the employee to read back a one-time MFA code to stop a supposed payment block. Which attack is most likely?

Accepted Answer

Vishing, because the attacker is using a voice call to manipulate the target in real time.. The attack is vishing (voice phishing) because the attacker uses a telephone call to socially engineer the target into divulging a one-time MFA code. The real-time voice interaction and the specific request for an authentication code are hallmarks of vishing, which exploits human trust rather than technical vulnerabilities.

Answer

Smishing, because the attacker requested a code and mentioned a financial problem.

Answer

Baiting, because the caller offered to fix the payment issue for the employee.

Answer

Tailgating, because the attacker used a trusted identity to gain access.

Question 15

During a restore test, a technician brings back a file server successfully, but the application team discovers that the database is missing the last 12 hours of transactions. Management says the business can tolerate only one hour of data loss. What should be changed first?

Accepted Answer

Implement application-consistent backups or transaction log backups more frequently.. The core issue is that the database is missing 12 hours of transactions, which exceeds the business's tolerance of one hour of data loss. This indicates that the Recovery Point Objective (RPO) is not being met. Implementing application-consistent backups or more frequent transaction log backups ensures that the database state can be recovered to a point within the acceptable loss window, directly addressing the RPO gap.

Answer

Reduce the restore point objective by storing more copies of the same backup.

Answer

Extend the retention period so the full backup is kept for 90 days.

Answer

Shorten the recovery time objective by using faster storage for the server.