SY0-701 Practice Test 38 — 15 Questions

Question 1

After several password-reset incidents, the security team wants one document that sets mandatory minimum controls for privileged accounts and another that tells the help desk the exact steps to verify identity and reset access. Which two document types should they use? Select two.

Accepted Answer

Standard, because it defines the mandatory minimum requirements that everyone must follow.. Option B is correct because a standard defines mandatory minimum requirements that must be followed, such as password length, complexity, and MFA enforcement for privileged accounts. This ensures consistent security controls across the organization without ambiguity, unlike a policy which is high-level intent.

Answer

Policy, because it explains the organization's overall security intent in broad terms.

Answer

Guideline, because it provides recommended practices that staff may ignore if needed.

Answer

Baseline, because it is mainly used as a casual reference document for analysts.

Question 2

Drag and drop the steps to implement a new firewall rule in an iptables-based Linux firewall into the correct order.

Question 3

Drag and drop the steps to perform a password reset for a user in Active Directory into the correct order.

Question 4

An access point connected to a switch suddenly lets guest Wi-Fi users reach an internal printer VLAN, but only on the new wiring closet. The AP uplink is configured as a trunk with dynamic negotiation enabled, native VLAN 1, and allowed VLANs 10, 20, and 30. Guest traffic should be VLAN 40 and must not transit to internal segments. Which change best fixes the issue?

Accepted Answer

Disable dynamic trunk negotiation, configure a static trunk, allow only VLANs 40 and 99, and move the native VLAN to an unused value.. The issue is that guest traffic (VLAN 40) is not in the allowed list, so the trunk is dropping it; however, the native VLAN 1 is being used for management and may leak traffic. By disabling dynamic trunk negotiation (DTP), configuring a static trunk, allowing only VLANs 40 and 99 (a management VLAN), and changing the native VLAN to an unused value, you ensure guest traffic is properly tagged and isolated from internal VLANs. This prevents the guest VLAN from being inadvertently trunked to internal segments and eliminates the risk of VLAN hopping via the native VLAN.

Answer

Convert the AP uplink to an access port in VLAN 40 and leave the AP to handle all traffic untagged.

Answer

Add the internal printer VLAN to the allowed list so the AP can filter client traffic itself.

Answer

Keep the trunk settings and add a layer 3 ACL between the guest and internal networks.

Question 5

Drag and drop the steps for the RADIUS authentication process into the correct order.

Question 6

An accounts payable specialist receives an email inside an existing vendor thread that asks for a last-minute bank-account change before a payment run. The wording is professional, the signature matches, and the request is urgent. Which three actions should the specialist take? Select three.

Accepted Answer

Verify the request through a known out-of-band contact method for the vendor.. Option A is correct because verifying the request through a known out-of-band contact method (e.g., a phone call to a previously documented vendor number) directly mitigates the risk of business email compromise (BEC). Attackers often hijack or spoof legitimate email threads, so in-band verification (replying within the thread) is unreliable. This aligns with the principle of dual control and independent verification for sensitive financial changes.

Answer

Reply in the same thread because the address and signature look legitimate.

Answer

Process the change immediately to avoid delaying the vendor relationship.

Question 7

An API log shows repeated requests such as `GET /api/orders?orderId=105%20OR%201=1--` followed by responses containing many customers' order records instead of one record. Which attack is most likely?

Accepted Answer

SQL injection, because the attacker is altering the database query through crafted input.. The request includes `%20OR%201=1--`, which URL-decodes to ` OR 1=1--`. This is a classic SQL injection payload that appends a tautology (`OR 1=1`) and comments out the rest of the query (`--`). The API log shows that instead of returning a single order record, the response contains many customers' order records, confirming that the injected condition bypassed the intended WHERE clause and returned all rows from the orders table.

Answer

Cross-site scripting, because malicious code is being reflected in the browser.

Answer

Cross-site request forgery, because the request appears to be an unauthorized action.

Answer

Broken access control, because the API is not validating the user role correctly.

Question 8

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Question 9

Drag and drop the steps for the SSH key exchange process in the correct order.

Question 10

An architect reviews a design where an internet-facing reverse proxy in a DMZ forwards HTTPS to a web application tier, and the web tier queries a database on a protected internal subnet. The current firewall plan allows the DMZ subnet to reach the database subnet on any TCP port, and the admins want to manage the proxy without exposing it to the user VLAN. Which two changes best improve the design? Select two.

Accepted Answer

Place the public reverse proxy in a DMZ separated from the internal network by a firewall.. Option B is correct because placing the public reverse proxy in a DMZ separated from the internal network by a firewall enforces a layered security model. The DMZ acts as a buffer zone, ensuring that even if the proxy is compromised, the attacker cannot directly access the internal web or database tiers without traversing another firewall. This aligns with defense-in-depth principles for internet-facing services.

Answer

Collapse the DMZ and internal database into the same VLAN so firewall rules are simpler.

Answer

Allow the database subnet to accept inbound connections from the internet for easier scaling.

Answer

Disable stateful inspection on the firewall so return traffic is automatically trusted.

Question 11

An analyst receives a disk image and the original hash from a response team member. Before any examination begins, the analyst must be able to show the image is unchanged and that the evidence handling process is defensible. Which two actions are most important? Select two.

Accepted Answer

Recompute the SHA-256 hash of the received image and compare it to the acquisition record.. Recomputing the SHA-256 hash of the received image and comparing it to the original acquisition record is essential to verify data integrity. SHA-256 is a cryptographic hash function that produces a unique fixed-size output; if even one bit of the image changes, the hash will differ. This comparison proves the image has not been altered during transit or storage, which is a foundational requirement for maintaining forensic soundness.

Answer

Mount the original disk read/write so the file system can repair itself before analysis.

Answer

Convert the image to another format before hashing so the tool can open it.

Answer

Rename evidence files to match the case number and avoid confusion.

Question 12

Drag and drop the steps to implement a backup strategy following the 3-2-1 rule into the correct order.

Question 13

Drag and drop the steps for a typical digital forensics investigation process in the correct order.

Question 14

Drag and drop the steps to configure a VPN tunnel using IPsec in tunnel mode into the correct order.

Question 15

Drag and drop the steps for the TLS 1.3 handshake process into the correct order.