SY0-701 Practice Test 38 — 15 Questions

Question 1

Based on the exhibit, what is the best next step before onboarding the vendor?

Accepted Answer

Require a security addendum with breach-notification timing, subprocessor approval, and audit rights.. The exhibit indicates the vendor has not yet provided a security addendum, which is a critical contractual document that defines security obligations such as breach-notification timing, subprocessor approval, and audit rights. Without this addendum, the organization lacks enforceable guarantees for data protection and incident response, making onboarding premature. Option B directly addresses this gap by requiring the addendum before proceeding.

Answer

Approve the vendor because it already passed a penetration test.

Answer

Ask the vendor to provide source code so developers can review it.

Answer

Move the workload to an internal shared drive until the vendor is ready.

Question 2

Based on the exhibit, what is the most likely conclusion after correlating the logs?

A configuration-management task ran from a jump host and generated repeated login alerts on target servers. The SOC wants to determine whether this is malicious activity or approved automation.

Accepted Answer

This is a likely false positive caused by approved automation, so the alert should be correlated with the change window.. The logs show repeated login attempts from a jump host, which is a common pattern for configuration-management tools (e.g., Ansible, Puppet) that execute tasks across multiple servers. The SOC should correlate these events with the approved change window to confirm they are part of legitimate automation, not malicious activity. Failed logins alone do not indicate a brute-force attack, as automation scripts may retry connections or use cached credentials that occasionally fail due to network latency or credential rotation.

Answer

This is a true brute-force attack because any failed login must be malicious.

Answer

This indicates DNS poisoning because both servers were contacted from the same source IP.

Answer

This is proof of ransomware spreading laterally over SMB.

Question 3

A support portal searches customers by last name using a parameter called q. After one user enters a single quote, the app returns a SQL syntax error. A tester then submits `test' OR '1'='1` and sees every customer record. Which control most directly prevents this issue?

Accepted Answer

Parameterize the database queries with prepared statements. The vulnerability is SQL injection, which occurs when user input is directly concatenated into a SQL query. Parameterized queries (prepared statements) separate SQL logic from data by using placeholders, ensuring user input is treated as data only and never executed as code. This directly prevents the attacker from injecting malicious SQL fragments like `' OR '1'='1`.

Answer

Encode all output returned to the browser

Answer

Add CSRF tokens to the login form

Answer

Move the application to a separate VLAN

Question 4

A company moved an internal application to a cloud virtual machine. The security team wants operating system login events, process activity, and network flow metadata to be available in the SIEM for investigations. Which action best supports that goal?

Accepted Answer

Enable guest OS audit logging and cloud-native flow logs, then forward the data to the SIEM.. It directly addresses the requirement to collect operating system login events, process activity, and network flow metadata. Enabling guest OS audit logging (e.g., via Windows Event Log or syslog) captures login and process events, while cloud-native flow logs (e.g., AWS VPC Flow Logs or Azure NSG flow logs) provide network flow metadata. Forwarding both data streams to the SIEM ensures centralized visibility for investigations.

Answer

Rely only on the cloud provider's service health dashboard and billing alerts.

Answer

Encrypt the virtual machine disks and disable all logging to reduce exposure.

Answer

Install only a web application firewall because that covers server log collection.

Question 5

Based on the exhibit, what is the best next step before the hotfix is released?

Accepted Answer

Pause release until the change is formally approved, tested, and has a documented rollback path.. Releasing a hotfix without formal approval, testing, and a documented rollback path violates the change management policy required by security program management. Even for urgent customer-facing issues, skipping these steps risks introducing new vulnerabilities or breaking other systems, which could lead to a larger outage. The exhibit indicates a need for controlled change processes, so pausing until the change is properly vetted ensures stability and security.

Answer

Deploy immediately because the issue is customer-facing and urgent.

Answer

Close the ticket after deployment and create a postmortem if users complain.

Answer

Ask support to warn users that sign-in may fail during the next hour.

Question 6

A scanner reports a critical vulnerability on an internal Linux server. The administrator verifies the package is installed, but the vulnerable code path is only present in a plugin that has been disabled and removed from the service startup. The server cannot be patched until a vendor maintenance window next month. What is the best next step?

Accepted Answer

Create a time-limited exception and apply compensating controls until patching is possible. The vulnerability exists in a disabled plugin, meaning the attack surface is reduced but not eliminated; residual risk remains if the plugin is re-enabled or if other dependencies are affected. Creating a time-limited exception with compensating controls (e.g., firewall rules, file permissions, SELinux policies) allows the organization to formally accept the risk until the vendor patch is applied, which aligns with standard vulnerability management processes.

Answer

Ignore the finding because the scanner is clearly wrong

Answer

Reinstall the disabled plugin so the scanner output matches the running configuration

Answer

Expose the server to the internet for faster monitoring and patch testing

Question 7

A finance clerk reports a call from a person who claimed to be from the bank's fraud department. The caller knew the employee's name, referenced a recent invoice, and asked the employee to read back a one-time MFA code to stop a supposed payment block. Which attack is most likely?

Accepted Answer

Vishing, because the attacker is using a voice call to manipulate the target in real time.. The attack is vishing (voice phishing) because the attacker uses a telephone call to socially engineer the target into divulging a one-time MFA code. The real-time voice interaction and the specific request for an authentication code are hallmarks of vishing, which exploits human trust rather than technical vulnerabilities.

Answer

Smishing, because the attacker requested a code and mentioned a financial problem.

Answer

Baiting, because the caller offered to fix the payment issue for the employee.

Answer

Tailgating, because the attacker used a trusted identity to gain access.

Question 8

A monthly scan finds a critical remote-code-execution issue on an internet-facing VPN appliance. The vendor has released a fix, but the appliance can only be rebooted during the weekend maintenance window in five days. What is the BEST immediate action to lower risk until patching can occur?

Accepted Answer

Apply a compensating control such as restricting access to trusted source IPs and disabling nonessential remote access features. Applying a compensating control—such as restricting access to trusted source IPs via an ACL and disabling nonessential remote access features like unused VPN protocols or administrative interfaces—immediately reduces the attack surface. This mitigates the risk of exploitation of the remote-code-execution vulnerability on the internet-facing VPN appliance until the vendor patch can be applied during the scheduled maintenance window. The key is to implement network-layer controls that block untrusted sources from reaching the vulnerable service, buying time without requiring a reboot.

Answer

Wait for the weekend because the exploit is not confirmed

Answer

Remove logging from the appliance to improve performance during the wait

Answer

Run another scan every hour and do nothing else

Question 9

During a restore test, a technician brings back a file server successfully, but the application team discovers that the database is missing the last 12 hours of transactions. Management says the business can tolerate only one hour of data loss. What should be changed first?

Accepted Answer

Implement application-consistent backups or transaction log backups more frequently.. The core issue is that the database is missing 12 hours of transactions, which exceeds the business's tolerance of one hour of data loss. This indicates that the Recovery Point Objective (RPO) is not being met. Implementing application-consistent backups or more frequent transaction log backups ensures that the database state can be recovered to a point within the acceptable loss window, directly addressing the RPO gap.

Answer

Reduce the restore point objective by storing more copies of the same backup.

Answer

Extend the retention period so the full backup is kept for 90 days.

Answer

Shorten the recovery time objective by using faster storage for the server.

Question 10

Based on the exhibit, which governance artifact is the security team reviewing?

Accepted Answer

Baseline, because it defines the approved minimum configuration for a system type.. The exhibit shows a list of approved operating systems, software versions, and patches for a specific system type (e.g., Windows 10 22H2 with specific security updates). This is a baseline, which defines the minimum acceptable configuration for a system type. Option C is correct because a baseline establishes a known good state that systems must meet, not just intent (policy), mandatory technical requirements (standard), or step-by-step instructions (procedure).

Answer

Policy, because it describes the organization's overall intent and direction.

Answer

Standard, because it sets mandatory technical requirements for systems.

Answer

Procedure, because it gives step-by-step instructions for completing a task.

Question 11

A company portal lets employees save a short profile bio. One employee enters a string containing script code, and later other users who view that profile are redirected to a fake sign-in page. What vulnerability best explains this behavior?

Accepted Answer

Stored cross-site scripting, because the malicious script is saved and served to other users later.. The employee's profile bio is saved to the server and later served to other users who view the profile. This is the defining characteristic of stored (persistent) cross-site scripting (XSS): the malicious script is permanently stored on the target server and executed in the browsers of other users when they retrieve the stored data.

Answer

Reflected cross-site scripting, because the payload only appears in the current request response.

Answer

Command injection, because the script runs inside the web server process.

Answer

Session fixation, because the attacker wants the victim to use an old session ID.

Question 12

A company runs a Linux virtual machine in an IaaS cloud service. The provider secures the physical datacenter and hypervisor. Which task remains the company's responsibility?

Accepted Answer

Patching the guest operating system on the virtual machine.. In an IaaS cloud model, the provider is responsible for the physical infrastructure, including the datacenter, network, storage, and hypervisor. The customer retains responsibility for securing the guest operating system, including applying patches and updates. Patching the guest OS is a shared responsibility that falls squarely on the company operating the virtual machine.

Answer

Replacing failed physical storage drives in the provider's data center.

Answer

Hardening the hypervisor that hosts the cloud tenant.

Answer

Controlling badge access to the cloud vendor's server room.

Question 13

Based on the exhibit, what is the best eradication decision after containment?

A quarantined endpoint was found to have a malicious startup item and a scheduled task. The team has already isolated it from the network and preserved memory for analysis.

Accepted Answer

Remove persistence artifacts and rebuild the endpoint from a known-good image before returning it to service.. After containment (network isolation and memory preservation), the best eradication step is to remove all persistence mechanisms (startup item and scheduled task) and rebuild the endpoint from a known-good image. This ensures that any undetected malware remnants, rootkits, or hidden artifacts are eliminated, preventing reinfection. Simply deleting files or changing DNS does not guarantee the system is clean, and reconnecting without a full rebuild risks lateral movement or data exfiltration.

Answer

Delete only the update.exe file and reconnect the host once the user confirms it is working.

Answer

Restore network connectivity now because no encryption was observed.

Answer

Change the DNS servers for the entire enterprise to block the malware domain.

Question 14

A help desk analyst receives a ticket stating that an employee got an urgent text message from someone claiming to be the CEO. The message asked the employee to buy gift cards and send the redemption codes immediately. What attack is most likely taking place?

Accepted Answer

Smishing, because the attacker is using SMS or text messaging to trick the employee into taking an action.. The attack uses SMS/text messaging as the delivery vector, which is the defining characteristic of smishing. The urgent request to buy gift cards and send redemption codes is a classic social engineering tactic designed to exploit the employee's trust in the CEO's authority, not to steal credentials or install malware directly.

Answer

Phishing, because the attacker is trying to steal information through a deceptive message sent to a user.

Answer

Vishing, because the attacker is using a phone call to pressure the employee into complying.

Answer

Baiting, because the attacker is tempting the user with a reward in exchange for cooperation.

Question 15

Several users on the same subnet report intermittent inability to reach the default gateway. A packet capture shows ARP replies mapping the gateway IP to a different MAC address, and the same host keeps sending those replies every few seconds. What attack is most likely?

Accepted Answer

ARP spoofing. ARP spoofing. The symptoms—intermittent gateway unreachability, ARP replies mapping the gateway IP to a different MAC address, and repeated unsolicited ARP replies—are classic indicators of an ARP spoofing (also called ARP poisoning) attack. The attacker sends forged ARP replies to associate their own MAC address with the gateway IP, causing traffic destined for the gateway to be sent to the attacker instead, disrupting connectivity.

Answer

Replay attack

Answer

DNS amplification

Answer

Man-in-the-middle via TLS downgrade