SY0-701 Practice Test 39 — 15 Questions

Question 1

Based on the exhibit, which metric best indicates improved phishing resistance?

Accepted Answer

Phish report rate.. The phish report rate measures how many users report a simulated phishing email to the security team, which directly indicates their ability to recognize and respond to phishing attempts. A higher report rate demonstrates improved security awareness and resistance because users are actively identifying threats rather than ignoring or falling for them. This metric is a key performance indicator in security awareness programs because it reflects behavioral change, not just training completion.

Answer

Training completion rate.

Answer

Number of phishing emails sent by attackers.

Answer

Total number of help desk tickets.

Question 2

Following a ransomware incident, management wants to verify that backups are usable and that a restored file server will meet recovery expectations before declaring the system trusted again. Which action is best?

Accepted Answer

Perform a documented restore test in an isolated environment and validate the recovered data.. Performing a documented restore test in an isolated environment is the only action that directly validates the integrity and usability of backups, ensuring the restored file server meets recovery point objective (RPO) and recovery time objective (RTO) expectations. This process verifies that the backup data is not corrupted, encrypted, or incomplete, which is critical after a ransomware incident where backups may have been targeted. Without such a test, management cannot confidently declare the system trusted, as logs or retention changes do not prove data recoverability.

Answer

Review the backup job logs and mark the backups as valid.

Answer

Increase the retention period so more restore points are available later.

Answer

Create a new full backup immediately after the incident and trust that one instead.

Question 3

Field staff use company-owned tablets that also run approved personal apps. Security wants corporate email and documents separated from personal data, with the ability to wipe only the work data if a device is lost. What is the best control?

Accepted Answer

Use a work profile or container managed by a mobile device management platform.. A work profile or container managed by a mobile device management (MDM) platform creates a separate, encrypted partition on the device for corporate data. This allows the organization to enforce policies and perform a selective wipe of only the work container without affecting personal apps or data, meeting the requirement for separation and targeted remote wipe.

Answer

Disable all personal apps by removing internet access from the tablet.

Answer

Install only a screen lock and require a longer PIN for the tablet.

Answer

Use a USB cable lock so the tablet cannot be physically moved.

Question 4

A SIEM alert shows 120 failed logins for one user account from three different countries within 10 minutes, followed by a successful login. What should the analyst do first?

Accepted Answer

Verify the activity with related logs and check whether the account owner confirms the login.. The analyst must first validate the alert by correlating the SIEM data with additional logs (e.g., authentication logs, firewall logs) and contacting the account owner to confirm whether the successful login was legitimate. This follows the incident response process of verification before action, preventing unnecessary disruption if the activity is benign (e.g., the user traveling with VPN).

Answer

Close the alert because the login eventually succeeded.

Answer

Immediately delete the account to stop further access.

Answer

Reimage the user's laptop before collecting any information.

Question 5

Based on the exhibit, what should management implement next?

Accepted Answer

Role-based security awareness training with recurring phishing simulations and reporting practice.. The exhibit shows a user who clicked a phishing link and entered credentials, indicating a need for improved security awareness. Role-based training with phishing simulations directly addresses this human risk by teaching users to recognize and report such attacks, which is the most effective next step. This aligns with the Security Program Management domain's focus on continuous improvement through user education and testing.

Answer

Disable all email attachments for every user in the company.

Answer

Replace all passwords with longer usernames.

Answer

Move all users to a single shared mailbox for easier monitoring.

Question 6

Employees need to sign in once to the corporate portal and then access email and the HR app without entering credentials again. Which two technologies make this possible in a secure design? Select two.

Accepted Answer

Single sign-on (SSO).. Single sign-on (SSO) allows a user to authenticate once and then access multiple applications (email, HR app) without re-entering credentials. This is achieved by the identity provider (IdP) issuing a token (e.g., SAML assertion, OIDC ID token) that is trusted by the service providers. SSO reduces password fatigue and centralizes authentication, but must be paired with federation to securely share identity across different domains or applications.

Answer

Network address translation (NAT).

Answer

Port address translation (PAT).

Answer

A hardened BIOS password on each workstation.

Question 7

A development team wants to skip testing and deploy a major application change directly to production to meet a release date. What should the security team require?

Accepted Answer

Require change approval and testing in a nonproduction environment first.. Security policy requires that all changes to production systems undergo formal change management, including approval and testing in a nonproduction environment first. Skipping testing violates the principle of change control and could introduce vulnerabilities or misconfigurations that compromise confidentiality, integrity, or availability. The security team must enforce this process to ensure the change is reviewed for security impact and validated before deployment.

Answer

Disable logging temporarily so the release is less likely to fail.

Answer

Deploy only to one server and monitor from there before deciding.

Answer

Let developers decide without review because they understand the code best.

Question 8

An employee receives a text message from an unknown number pretending to be IT. It includes a shortened URL for "urgent MFA re-enrollment" and says the account will be locked in 15 minutes. What is the best response?

Accepted Answer

Report the message through the official security channel and verify the request using known IT contact information.. It follows the principle of verifying unsolicited requests through trusted channels, which is a key defense against social engineering and phishing attacks. The message exhibits classic phishing indicators: an unknown sender, a shortened URL (which can mask the true destination), a false sense of urgency, and a request for MFA re-enrollment—a common pretext to harvest credentials or MFA tokens. Reporting through the official security channel ensures the incident is logged and investigated, while verifying with known IT contact information prevents falling for a spoofed or compromised source.

Answer

Open the link and enter the requested information if the page looks legitimate.

Answer

Forward the text to coworkers so they can check whether they received the same message.

Answer

Reply to the text asking for a company badge number before proceeding.

Question 9

Based on the exhibit, which system should be restored first after a total site outage?

Accepted Answer

Payroll, because it has the shortest maximum tolerable downtime and the strongest compliance impact.. Payroll should be restored first because it has the shortest maximum tolerable downtime (MTD) and the strongest compliance impact. In disaster recovery, systems with the lowest MTD must be prioritized to avoid exceeding the recovery time objective (RTO), and compliance-driven systems like payroll often carry legal or regulatory penalties for extended outages.

Answer

Customer portal, because it produces the largest daily revenue loss and has the shortest RPO.

Answer

Email, because restoring communication always takes precedence over all other services.

Answer

Dev test lab, because lower business impact means it is easiest to restore first.

Question 10

A customer portal must continue operating if one application server fails. The business wants a simple, cost-conscious design that improves availability. What is the best approach?

Accepted Answer

Add a second application server behind a load balancer.. Adding a second application server behind a load balancer creates an active-passive or active-active cluster that provides redundancy. If one server fails, the load balancer automatically redirects traffic to the healthy server, ensuring continuous operation. This design is cost-conscious because it uses commodity servers rather than expensive vertical scaling, and it directly improves availability by eliminating the single point of failure.

Answer

Schedule nightly backups to a different storage account.

Answer

Buy a larger server with more CPU and memory.

Answer

Move the portal to a different subnet without changing the servers.

Question 11

The email security team receives a suspicious invoice attachment from a vendor. The attachment is not blocked by signature-based detection, but the team wants to observe its behavior in a safe environment before delivery to users. What tool best fits this requirement?

Accepted Answer

Sandboxing the attachment in an isolated analysis environment. A sandbox provides an isolated, controlled environment where the suspicious attachment can be executed and monitored for malicious behavior without risking the production network. This allows the security team to observe dynamic indicators such as file system changes, registry modifications, or outbound connections that signature-based detection might miss. The goal is to analyze the attachment's true intent before deciding whether to deliver it to users.

Answer

Network access control for unmanaged devices

Answer

A data loss prevention rule on outbound email

Answer

An intrusion prevention system placed on the Wi-Fi network

Question 12

A vulnerability scan of a branch-office print server finds that its administrative web console is reachable from the internet. The appliance is still using the vendor's default password, and no access control list limits management access to the office subnet or VPN. Which remediation would reduce risk the most with the least disruption?

Accepted Answer

Restrict management access to the office network or VPN and change the default credentials.. Reduces risk the most with the least disruption by immediately addressing the two primary vulnerabilities: the default password and unrestricted internet exposure. Changing the default credentials prevents trivial authentication bypass, while restricting management access to the office subnet or VPN eliminates the attack surface from the public internet. This approach requires no hardware replacement or downtime, and it directly mitigates the highest-severity issues identified in the scan.

Answer

Increase the password length policy and leave the console publicly reachable.

Answer

Disable the management interface entirely and replace the device immediately.

Answer

Apply a patch after the next quarterly maintenance window and keep the current exposure unchanged.

Question 13

A monthly scan finds a critical remote-code-execution vulnerability on an internet-facing VPN appliance. The vendor has not released a patch for six weeks, but the service must stay online. Which short-term action is the best risk treatment?

Accepted Answer

Apply compensating controls such as strict access filtering, MFA, enhanced logging, and alerting.. When a patch is unavailable for a critical vulnerability, compensating controls reduce risk without taking the service offline. For an internet-facing VPN appliance, strict access filtering (e.g., limiting source IPs via ACLs), enforcing MFA, and enabling enhanced logging/alerting can mitigate exploitation attempts while maintaining availability. This aligns with the risk treatment strategy of risk reduction through controls rather than acceptance, avoidance, or transfer.

Answer

Accept the risk and wait for the next scheduled scan cycle.

Answer

Disable all logging so the appliance performs better under load.

Answer

Ignore the issue until the vendor confirms the vulnerability is being actively exploited.

Question 14

A caller claims to be from the company's SaaS provider and says a tenant migration will fail unless the help desk reads back a one-time verification code sent to an administrator's phone. The caller knows the admin's name and ticket number. What attack technique is being used?

Accepted Answer

Pretexting, because the attacker is inventing a believable support story to gain trust.. The attacker is using pretexting by fabricating a plausible scenario (a tenant migration requiring a verification code) to manipulate the help desk into divulging sensitive information. This social engineering technique relies on building false trust through invented details like the admin's name and ticket number, rather than exploiting technical vulnerabilities. The goal is to obtain the one-time verification code, which could be used for unauthorized access or account takeover.

Answer

Watering hole, because the attacker is targeting a trusted web service used by employees.

Answer

Tailgating, because the attacker is attempting to bypass a physical security barrier.

Answer

Whaling, because the attacker is targeting a high-value executive account directly.

Question 15

A team runs a confidential document repository on an IaaS virtual machine. The cloud provider secures the datacenter, hardware, and hypervisor. Which task remains the organization’s responsibility?

Accepted Answer

Hardening the guest operating system and controlling access to the repository application.. In an IaaS model, the cloud provider is responsible for the security of the cloud (physical datacenter, hardware, hypervisor), while the customer is responsible for security in the cloud. This includes hardening the guest OS, configuring firewalls, managing access controls, and patching the operating system and applications. Option C correctly identifies the organization's duty to secure the guest OS and the repository application.

Answer

Patching the physical hosts inside the cloud provider's datacenter.

Answer

Replacing the provider's hypervisor when a new version is released.

Answer

Managing the cloud provider's physical badge access for the server room.