SY0-701 Practice Test 39 — 15 Questions

Question 1

A customer portal must continue operating if one application server fails. The business wants a simple, cost-conscious design that improves availability. What is the best approach?

Accepted Answer

Add a second application server behind a load balancer.. Adding a second application server behind a load balancer creates an active-passive or active-active cluster that provides redundancy. If one server fails, the load balancer automatically redirects traffic to the healthy server, ensuring continuous operation. This design is cost-conscious because it uses commodity servers rather than expensive vertical scaling, and it directly improves availability by eliminating the single point of failure.

Answer

Schedule nightly backups to a different storage account.

Answer

Buy a larger server with more CPU and memory.

Answer

Move the portal to a different subnet without changing the servers.

Question 2

The email security team receives a suspicious invoice attachment from a vendor. The attachment is not blocked by signature-based detection, but the team wants to observe its behavior in a safe environment before delivery to users. What tool best fits this requirement?

Accepted Answer

Sandboxing the attachment in an isolated analysis environment. A sandbox provides an isolated, controlled environment where the suspicious attachment can be executed and monitored for malicious behavior without risking the production network. This allows the security team to observe dynamic indicators such as file system changes, registry modifications, or outbound connections that signature-based detection might miss. The goal is to analyze the attachment's true intent before deciding whether to deliver it to users.

Answer

Network access control for unmanaged devices

Answer

A data loss prevention rule on outbound email

Answer

An intrusion prevention system placed on the Wi-Fi network

Question 3

A vulnerability scan of a branch-office print server finds that its administrative web console is reachable from the internet. The appliance is still using the vendor's default password, and no access control list limits management access to the office subnet or VPN. Which remediation would reduce risk the most with the least disruption?

Accepted Answer

Restrict management access to the office network or VPN and change the default credentials.. Reduces risk the most with the least disruption by immediately addressing the two primary vulnerabilities: the default password and unrestricted internet exposure. Changing the default credentials prevents trivial authentication bypass, while restricting management access to the office subnet or VPN eliminates the attack surface from the public internet. This approach requires no hardware replacement or downtime, and it directly mitigates the highest-severity issues identified in the scan.

Answer

Increase the password length policy and leave the console publicly reachable.

Answer

Disable the management interface entirely and replace the device immediately.

Answer

Apply a patch after the next quarterly maintenance window and keep the current exposure unchanged.

Question 4

A monthly scan finds a critical remote-code-execution vulnerability on an internet-facing VPN appliance. The vendor has not released a patch for six weeks, but the service must stay online. Which short-term action is the best risk treatment?

Accepted Answer

Apply compensating controls such as strict access filtering, MFA, enhanced logging, and alerting.. When a patch is unavailable for a critical vulnerability, compensating controls reduce risk without taking the service offline. For an internet-facing VPN appliance, strict access filtering (e.g., limiting source IPs via ACLs), enforcing MFA, and enabling enhanced logging/alerting can mitigate exploitation attempts while maintaining availability. This aligns with the risk treatment strategy of risk reduction through controls rather than acceptance, avoidance, or transfer.

Answer

Accept the risk and wait for the next scheduled scan cycle.

Answer

Disable all logging so the appliance performs better under load.

Answer

Ignore the issue until the vendor confirms the vulnerability is being actively exploited.

Question 5

A caller claims to be from the company's SaaS provider and says a tenant migration will fail unless the help desk reads back a one-time verification code sent to an administrator's phone. The caller knows the admin's name and ticket number. What attack technique is being used?

Accepted Answer

Pretexting, because the attacker is inventing a believable support story to gain trust.. The attacker is using pretexting by fabricating a plausible scenario (a tenant migration requiring a verification code) to manipulate the help desk into divulging sensitive information. This social engineering technique relies on building false trust through invented details like the admin's name and ticket number, rather than exploiting technical vulnerabilities. The goal is to obtain the one-time verification code, which could be used for unauthorized access or account takeover.

Answer

Watering hole, because the attacker is targeting a trusted web service used by employees.

Answer

Tailgating, because the attacker is attempting to bypass a physical security barrier.

Answer

Whaling, because the attacker is targeting a high-value executive account directly.

Question 6

A team runs a confidential document repository on an IaaS virtual machine. The cloud provider secures the datacenter, hardware, and hypervisor. Which task remains the organization’s responsibility?

Accepted Answer

Hardening the guest operating system and controlling access to the repository application.. In an IaaS model, the cloud provider is responsible for the security of the cloud (physical datacenter, hardware, hypervisor), while the customer is responsible for security in the cloud. This includes hardening the guest OS, configuring firewalls, managing access controls, and patching the operating system and applications. Option C correctly identifies the organization's duty to secure the guest OS and the repository application.

Answer

Patching the physical hosts inside the cloud provider's datacenter.

Answer

Replacing the provider's hypervisor when a new version is released.

Answer

Managing the cloud provider's physical badge access for the server room.

Question 7

An HR system marks employees as hired, transferred, or terminated. The security team wants those changes to create, update, or disable accounts in multiple SaaS apps automatically after the user authenticates through the company identity provider. Which capability should be added?

Accepted Answer

SCIM provisioning integrated with the SSO platform.. SCIM (System for Cross-domain Identity Management) is the correct choice because it provides a standardized protocol for automating the creation, update, and deletion of user accounts across multiple SaaS applications. When integrated with an SSO platform (like SAML), SCIM handles the lifecycle events (hire, transfer, terminate) by sending RESTful API calls to each SaaS app, ensuring accounts are created, updated, or disabled without manual intervention. SAML alone only handles authentication, not account provisioning, making SCIM essential for the described automation.

Answer

SAML federation alone, with no additional account lifecycle automation.

Answer

Password synchronization between every application.

Answer

Local administrator groups on each SaaS application.

Question 8

Administrators must manage network switches from home. Requirements: encrypted management traffic, MFA for users, no management ports exposed to the Internet, and centralized logging of admin sessions. Which solution best meets the requirements?

Accepted Answer

Use a VPN with MFA that terminates on a hardened jump host, then reach switches over SSH or HTTPS.. It satisfies all requirements: a VPN with MFA encrypts management traffic, the hardened jump host provides a secure intermediary that keeps switch management ports off the Internet, and centralized logging can be implemented on the jump host to record all admin sessions. This architecture aligns with the principle of defense-in-depth by combining encrypted tunnels, strong authentication, and network segmentation.

Answer

Open SSH directly on each switch and allow access from the entire Internet.

Answer

Use port forwarding through the firewall to RDP on each switch.

Answer

Build an IPSec tunnel only between office routers and share a common admin password on the switches.

Question 9

A vulnerability scanner reports a critical issue on a Linux server. The administrator checks the application and confirms the vulnerable package is installed, but the affected feature is not enabled anywhere in production. What should the security team do next?

Accepted Answer

Validate whether the issue is a false positive or lower-risk finding before prioritizing remediation. The vulnerability scanner reports a critical issue, but the administrator has confirmed the vulnerable package is installed while the affected feature is not enabled in production. This means the actual risk is lower than the scanner's severity rating, as exploitation requires the feature to be active. The security team should validate whether this is a false positive or a lower-risk finding to prioritize remediation efforts appropriately, ensuring resources are allocated to genuine threats.

Answer

Ignore the finding permanently because the package is installed

Answer

Immediately shut down the server without further investigation

Answer

Apply an exception without documenting any compensating controls

Question 10

A company needs a public website that anyone on the internet can reach, but the application and database servers must stay off the internet. Where should the web server be placed?

Accepted Answer

In a DMZ separated from the internal application and database networks.. The web server must be placed in a DMZ (demilitarized zone) because this network segment is designed to host publicly accessible services while isolating them from internal networks. The DMZ allows inbound traffic from the internet to the web server, but the application and database servers remain on internal networks with strict firewall rules that block direct internet access, enforcing a layered security architecture.

Answer

On the internal user network with the database server.

Answer

On the same subnet as the firewall management interface.

Answer

Directly on the database subnet so performance is faster.

Question 11

A public web server becomes unreachable during an outage. Netflow shows a large number of DNS responses arriving from many open resolvers, while the server itself only sent tiny spoofed DNS queries with the victim's address as the source. What type of attack is this?

Accepted Answer

DNS amplification reflection denial-of-service.. This is a classic DNS amplification reflection DDoS attack. The attacker sends small DNS queries with a spoofed source IP (the victim's address) to open resolvers, which then send large DNS responses to the victim, overwhelming its bandwidth. The NetFlow data shows the server receiving many large DNS responses while only sending tiny spoofed queries, confirming the amplification and reflection vectors.

Answer

DNS zone transfer abuse against the organization.

Answer

A replay attack against a web application session token.

Answer

ARP poisoning inside the local network segment.

Question 12

A policy states that sensitive data must be encrypted, but it does not say which encryption strength to use. The security architect wants a document that lists the exact approved encryption settings for systems to follow. What document is needed?

Accepted Answer

A standard, because it specifies the required technical values and configurations.. A standard is the correct document because it mandates specific, measurable technical requirements—such as exact encryption algorithms (e.g., AES-256), key lengths, and cipher modes (e.g., GCM)—that systems must follow to comply with the policy. Unlike a policy, which states a goal (e.g., 'encrypt sensitive data'), a standard provides the enforceable configuration baseline that the security architect needs.

Answer

A procedure, because it explains the step-by-step order for handling every file.

Answer

A guideline, because it gives suggestions that teams may choose to adopt.

Answer

A memo, because it is the fastest way to tell teams about a new requirement.

Question 13

A SIEM alert shows a successful VPN login for an executive account from an unusual country, followed 3 minutes later by large downloads from a file share the user rarely accesses. Which log source should the analyst review next to determine whether the session came from the user's assigned laptop or an unmanaged device?

Accepted Answer

Endpoint detection and response telemetry from the user's laptop. B is correct because endpoint detection and response (EDR) telemetry from the user's laptop provides granular process-level and network-level data, including the source IP of the VPN session, the device's hostname, and whether the VPN client software was initiated from the managed laptop's operating system. This allows the analyst to confirm if the VPN session originated from the assigned corporate device or from an unmanaged device using stolen credentials.

Answer

VPN concentrator logs

Answer

DNS query logs from the internal resolver

Answer

Email gateway logs for the executive mailbox

Question 14

After restoring a virtualized file server from backup, users can log in but the accounting application returns database consistency errors. What should you do next?

Accepted Answer

Verify the restore in an isolated environment and confirm application-level integrity and permissions.. The restore process must be validated beyond basic boot and login functionality. Database consistency errors indicate that the application-level data integrity was compromised during the restore, likely due to missing or inconsistent database files, permissions, or transaction logs. Verifying the restore in an isolated environment allows you to test application-specific integrity checks (e.g., DBCC CHECKDB for SQL Server) and confirm that file permissions and security descriptors are intact before returning the server to production.

Answer

Declare the restore successful because the virtual machine boots and users can sign in.

Answer

Increase the backup retention period and wait for the next scheduled full backup.

Answer

Delete the backup set to prevent confusion with the restored data.

Question 15

A Linux host is patched, but the scanner still flags the package as vulnerable. The vendor advisory says the distribution backported the fix, so the package version did not change. What should the analyst do before closing the ticket?

Accepted Answer

Verify the vendor advisory and package metadata, then document evidence of the fixed build.. When a vendor backports a security fix to an older package version without incrementing the version number, the vulnerability scanner may still flag the package based on its version string. The analyst must verify the vendor advisory and package metadata (e.g., using `rpm -q --changelog` or `dpkg --status`) to confirm the fix is present, then document this evidence to close the ticket with proper justification.

Answer

Close the ticket immediately because the patch was installed successfully.

Answer

Raise the severity of the finding because the scanner still reports it.

Answer

Disable the scanner until the next maintenance window to avoid repeated alerts.