SY0-701 Practice Test 4 — 10 Questions

Question 1

A web service begins experiencing severe latency. Netflow shows thousands of short DNS queries leaving the attacker network, while a much larger volume of DNS responses is arriving at the victim’s public IP address from many open resolvers. Which attack is most likely occurring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS reflection and amplification denial-of-service attack. The attack described is a DNS reflection and amplification denial-of-service attack. The attacker sends thousands of short DNS queries with a spoofed source IP (the victim's IP) to many open resolvers, which then send large DNS responses to the victim, overwhelming its bandwidth. NetFlow shows a small volume of queries leaving the attacker and a much larger volume of responses arriving at the victim, which is the hallmark of amplification (small request, large response) combined with reflection (responses from third-party resolvers).

Answer

Replay attack using previously captured packets

Answer

ARP poisoning that redirects local traffic on a LAN

Answer

Session hijacking through stolen authentication cookies

Question 2

A firewall analyst reviews logs and sees one external IP address sending connection attempts to TCP ports 22, 80, 139, 445, and 3389 on dozens of internal hosts every few seconds. No payloads are delivered and no sessions are established. What is the most likely activity?

Accepted Answer

Port scanning, because the source is systematically probing many ports and hosts for exposed services.. The observed behavior—a single external IP sending connection attempts to multiple TCP ports (22, 80, 139, 445, 3389) across many internal hosts at regular intervals—is the hallmark of a port scan. The absence of payload delivery or session establishment confirms the attacker is only probing for open services, not attempting exploitation or data transfer. This matches the definition of a reconnaissance activity, specifically a horizontal port scan targeting common service ports.

Answer

Reflection-based denial-of-service, because the attacker is using third-party systems to amplify traffic.

Answer

Man-in-the-middle, because the attacker is intercepting communications between internal hosts.

Answer

Protocol abuse, because the attacker is sending malformed traffic to crash services.

Question 3

A security analyst is reviewing authentication logs and observes multiple failed login attempts for a single user account occurring within a short timeframe, followed by a successful login from an IP address located in a country where the user has never traveled. The failed attempts originate from various IP addresses and use different passwords. Which type of attack has most likely occurred?

Accepted Answer

Brute-force attack. (Brute-force attack) because the log shows multiple failed login attempts from various IP addresses using different passwords, followed by a successful login from an unfamiliar country. This pattern indicates a distributed brute-force attack where the attacker systematically tries many passwords against a single account, often using a botnet or proxy rotation to evade IP-based rate limiting. The successful login from a foreign IP confirms the attacker eventually guessed the correct password.

Answer

Credential stuffing

Answer

Password spraying

Answer

Dictionary attack

Question 4

After several employees clicked on a realistic phishing email, management wants a control that both improves user behavior and gives the security team a way to measure improvement over time. Which approach is best?

Accepted Answer

Run simulated phishing campaigns with immediate feedback and follow-up training. Simulated phishing campaigns with immediate feedback and follow-up training directly address user behavior by providing a safe, controlled environment where employees can learn to recognize phishing attempts. This approach also gives the security team measurable metrics (e.g., click rates over time) to track improvement, aligning with the goal of both behavioral change and quantifiable assessment.

Answer

Send a company-wide reminder not to open suspicious emails

Answer

Block all external email messages at the gateway

Answer

Require employees to change passwords every week

Question 5

After several password-reset incidents, the security team wants one document that sets mandatory minimum controls for privileged accounts and another that tells the help desk the exact steps to verify identity and reset access. Which two document types should they use? Select two.

Accepted Answer

Standard, because it defines the mandatory minimum requirements that everyone must follow.. A standard defines mandatory minimum requirements that must be followed, such as password length, complexity, and MFA enforcement for privileged accounts. This ensures consistent security controls across the organization without ambiguity, unlike a policy which is high-level intent.

Answer

Policy, because it explains the organization's overall security intent in broad terms.

Answer

Guideline, because it provides recommended practices that staff may ignore if needed.

Answer

Baseline, because it is mainly used as a casual reference document for analysts.

Question 6

An employee gets a text message saying their mobile carrier will suspend service unless they tap a link and verify their account details. What type of attack is this?

Accepted Answer

Smishing, because the attacker is using SMS messages to trick the user. This is smishing because the attacker uses SMS (Short Message Service) as the delivery vector to send a fraudulent message that tricks the recipient into clicking a malicious link. Smishing is a form of social engineering that exploits the trust users place in text-based communications from known entities like mobile carriers, often leading to credential theft or malware installation.

Answer

Vishing, because the attacker is using a voice call to pressure the user

Answer

Baiting, because the attacker is offering a free service upgrade

Answer

Tailgating, because the attacker is trying to enter a building behind someone else

Question 7

A security analyst is reviewing network flow logs and notices a series of outbound connections from a single internal workstation to an external IP address on TCP port 443. The connections occur every 5 minutes, each lasting about 2 seconds, and the amount of data transferred per connection is consistently around 1 KB. The workstation's user reports no unusual activity. The analyst checks the host's EDR logs and sees no malicious processes or known indicators. Which type of activity is this pattern most consistent with?

Accepted Answer

Beaconing to a command-and-control server. This pattern is most consistent with beaconing to a command-and-control (C2) server because the connections are periodic (every 5 minutes), short-lived (2 seconds), and consistently transfer a small amount of data (~1 KB) over HTTPS (TCP 443). These characteristics—regular intervals, low data volume, and stealthy use of encrypted channels—are hallmarks of C2 beaconing used by malware to maintain persistence and receive instructions without raising immediate suspicion.

Answer

Normal software update check

Answer

DNS tunneling

Answer

Data exfiltration via HTTPS

Question 8

A security analyst is reviewing logs after a successful phishing attack. The attacker used a fake login page that mimicked the company's single sign-on portal to harvest usernames and passwords. The attacker then used the stolen credentials to access the corporate email system. Which type of attack best describes the initial compromise?

Accepted Answer

Credential harvesting via phishing. The initial compromise was achieved by luring the victim to a fake login page that mimicked the company's single sign-on portal, which is a classic phishing technique. The attacker harvested the credentials directly from the user's submission, making this a credential harvesting attack via phishing. This aligns with the definition of phishing as a social engineering attack that uses deception to obtain sensitive information, distinct from brute-force or password spraying which rely on guessing or trying multiple passwords.

Answer

On-path attack

Answer

Brute-force attack

Answer

Password spraying

Question 9

Leadership is deciding between two security controls for a customer portal outage risk. Finance wants to compare the options in dollars, using expected loss, not just a high/medium/low rating. Which approach should the analyst use?

Accepted Answer

Quantitative risk analysis, because it expresses likelihood and impact in monetary terms.. Quantitative risk analysis (A) is correct because it assigns monetary values to both the likelihood and impact of a risk, enabling a direct dollar-based comparison of expected loss. The Finance team's requirement for a dollar comparison rules out qualitative ratings, making quantitative analysis the only approach that meets their needs.

Answer

Qualitative risk analysis, because it uses categories like critical, medium, and low.

Answer

Business impact analysis, because it identifies which business processes are important.

Answer

Risk avoidance, because eliminating the activity removes the threat completely.

Question 10

Based on the exhibit, which principle should the organization enforce to reduce fraud risk while keeping the business process functional?

Accepted Answer

Separation of duties, because no single user should be able to complete every high-risk finance step alone.. Separation of duties (SoD) is the correct principle because it prevents any single employee from completing all steps in a high-risk financial transaction alone. By requiring at least two people to authorize and execute critical actions—such as initiating a payment and approving it—the organization reduces the risk of internal fraud without blocking the business workflow. This directly addresses the scenario where a single user could otherwise create, approve, and release a fraudulent payment.

Answer

Least privilege, because each employee should only have the fewest permissions needed for the shared account.

Answer

Need-to-know, because only employees with confidential financial data should see the workflow details.

Answer

Defense in depth, because the organization should add more security layers around the finance process.