SY0-701 Practice Test 40 — 15 Questions

Question 1

A company uses a SaaS email platform. The provider manages the servers and application code. Which two tasks remain the company's responsibility? Select two.

Accepted Answer

Configuring who can access company mailboxes and administrative roles.. In a SaaS model, the customer retains administrative control over user access and role-based permissions. This includes configuring mailbox permissions, setting up multi-factor authentication, and managing administrative roles within the provider's interface. The provider handles the underlying infrastructure, but identity and access management (IAM) remains the customer's responsibility.

Answer

Applying security patches to the provider's mail servers.

Answer

Replacing failed provider storage disks.

Answer

Hardening the provider's hypervisor.

Question 2

Based on the exhibit, which tool should the security team use to safely observe the attachment's behavior before delivery to users?

Accepted Answer

Sandboxing, so the file can execute in a controlled environment before release.. Sandboxing allows the security team to execute the attachment in a controlled, isolated environment to observe its behavior (e.g., network connections, file modifications) without risking the production network. This is the correct approach because it safely detonates the file before delivery, enabling detection of malicious activity such as ransomware or trojans. Other tools like DLP, NAC, or SIEM do not provide the dynamic analysis needed to assess the attachment's runtime behavior.

Answer

DLP, so the gateway can block sensitive data from leaving the organization.

Answer

NAC, so the sender's device can be checked before the message is accepted.

Answer

SIEM, so the team can store the attachment and review alerts later.

Question 3

A file server is actively renaming documents and generating ransom notes. The server hosts a shared drive used by finance, and users are still online. What is the best immediate action?

Accepted Answer

Isolate the server from the network to contain the spread while preserving evidence.. Isolating the server from the network stops the ransomware from encrypting more files or spreading laterally, while preserving volatile evidence (e.g., running processes, memory contents) needed for forensic analysis. In a live incident, immediate disconnection (not shutdown) is the standard containment step per NIST SP 800-61 and SANS incident response guidelines, as it halts the attack without destroying data in memory or logs.

Answer

Shut the server down immediately to stop all activity as fast as possible.

Answer

Restore the file server from backup before checking whether the infection is still active.

Answer

Run a full antivirus scan and wait for the results before taking any other action.

Question 4

After a user installs a free PDF converter from an unofficial site, the browser homepage changes, the endpoint protection agent stops launching, and the system begins making periodic outbound connections to the same unfamiliar IP address. No exploit was used during installation, and the installer appeared legitimate. What type of malware best matches this behavior?

Accepted Answer

Trojan, because it masquerades as useful software while delivering hidden malicious functionality.. B is correct because the software masquerades as a legitimate PDF converter while secretly performing malicious actions—changing the browser homepage, disabling endpoint protection, and making unauthorized outbound connections. This is the classic definition of a Trojan horse: it appears useful but contains hidden, harmful functionality. The lack of an exploit and the user's voluntary installation further confirm it is a Trojan, not a self-replicating worm or a kernel-hiding rootkit.

Answer

Worm, because the infection is spreading automatically across the network.

Answer

Rootkit, because the attacker must have hidden files in the kernel.

Answer

Spyware, because the main symptom is that the browser homepage changed.

Question 5

Based on the exhibit, what is the best fix so role changes are reflected promptly in the application?

Token and directory data:

09:10  Token issued for user jdoe
      groups=[Finance_Approver, Expense_Reviewer]
      auth_time=09:10
      exp=17:10
09:15  HR updated directory: jdoe moved to Sales
11:00  The application still accepts the original token and allows expense approval
11:01  Identity provider logs show no token revocation event

Accepted Answer

Shorten token and session lifetime and revoke active tokens when the directory role changes.. The token's long lifetime (issued at 09:10, expires at 17:10) allows the application to continue accepting the original token even after the user's directory role changes at 09:15. Shortening the token lifetime forces more frequent reauthentication, and revoking active tokens when the directory role changes ensures that the application immediately reflects the updated authorization. This aligns with the principle of dynamic access control and token lifecycle management.

Answer

Increase the token lifetime so users reauthenticate less often.

Answer

Move the application to a different subnet to isolate it from HR systems.

Answer

Disable group-based authorization and let any authenticated user approve expenses.

Question 6

A company suspects the master encryption key used by a cloud storage service may have been exposed. The data must remain protected if someone later obtains a copy of the old key. What is the best next step?

Accepted Answer

Rotate the key and re-encrypt or rewrap the protected data under the new key.. Key rotation is the correct response because it invalidates the old master encryption key by generating a new one and re-encrypting or rewrapping the protected data under the new key. This ensures that even if an attacker later obtains a copy of the old key, the data remains protected because it is no longer encrypted with that key. In cloud storage services like AWS KMS or Azure Key Vault, this process is typically automated and does not require re-uploading the data.

Answer

Delete the stored files so the exposed key can no longer be used.

Answer

Change every user's password because that will also invalidate the exposed encryption key.

Answer

Increase file compression so the data becomes harder to read.

Question 7

To discourage unauthorized entry into a records room, facilities installs a large warning sign, a visible camera over the door, and a turnstile staffed by a guard during business hours. Which control category is the warning sign intended to support most directly?

Accepted Answer

Deterrent. The warning sign is a physical security control designed to discourage unauthorized entry by making potential intruders aware of the risks and consequences. This directly supports the deterrent control category, which aims to reduce the likelihood of a security incident by influencing behavior through fear of detection or punishment. Unlike detective controls that identify incidents after they occur, or preventive controls that physically block access, the sign's primary function is psychological deterrence.

Answer

Detective

Answer

Preventive

Answer

Corrective

Question 8

An email attachment from an external supplier is not blocked by signature-based AV, but the SOC wants to see whether it drops files, launches child processes, or contacts suspicious domains before delivery to users. Which control best fits?

Accepted Answer

Sandboxing, because it detonates the file in an isolated environment.. Sandboxing is the correct control because it detonates the file in an isolated, virtualized environment to observe its runtime behavior, such as dropping files, spawning child processes, or making outbound connections to suspicious domains. This goes beyond signature-based AV by analyzing dynamic behavior rather than static file hashes or patterns. The SOC's goal is to assess the file's actions before delivery, which sandboxing directly addresses.

Answer

Network IDS, because it passively monitors traffic for known threats.

Answer

DLP, because it prevents sensitive data from leaving the organization.

Answer

NAC, because it controls whether a device can join the network.

Question 9

A customer portal runs from a primary data center. Management wants the secondary site to take over within minutes if the primary site loses power, and the secondary site should already have current systems and data ready to serve users. Which design best fits this requirement?

Accepted Answer

A hot site with synchronized data replication and automated failover. A hot site with synchronized data replication and automated failover is the correct choice because it maintains an exact, real-time copy of systems and data at the secondary site. Synchronous replication ensures zero data loss (RPO=0), and automated failover enables the secondary site to become operational within minutes (RTO measured in minutes), meeting the requirement for immediate takeover after a power loss at the primary site.

Answer

A cold site with nightly backups stored offsite

Answer

RAID 0 across two storage arrays in the primary data center

Answer

A single backup server with larger disks and more memory

Question 10

A team moved a Linux VM to IaaS. They need OS login events, process activity, and network flow metadata sent to one central platform for alerting. What is the best first step?

Accepted Answer

Deploy an endpoint logging agent and enable cloud-native flow logs to a centralized logging service.. Deploying an endpoint logging agent (e.g., auditd, osquery, or a SIEM agent) on the Linux VM captures OS login events and process activity at the guest level, while enabling cloud-native flow logs (e.g., AWS VPC Flow Logs, Azure NSG flow logs) provides network flow metadata. Sending both to a centralized logging service (e.g., AWS CloudWatch Logs, Azure Log Analytics, or a third-party SIEM) ensures all required telemetry is aggregated for alerting. This approach directly addresses the need for host-level and network-level visibility without relying on the cloud provider to collect guest OS internals.

Answer

Enable only perimeter security groups and assume the cloud provider will collect all host telemetry.

Answer

Store the VM snapshots in object storage and review them manually during incidents.

Answer

Rely on the hypervisor console and disable guest-level logging to reduce overhead.

Question 11

Based on the exhibit, which change best improves both recovery time and recovery point for the ERP database?

A mid-sized company has a two-hour RTO and a 30-minute RPO, but its current backup design cannot meet either objective during restore testing.

Accepted Answer

Implement frequent transaction log backups and a pre-staged standby or automated recovery image.. Implementing frequent transaction log backups (e.g., every 5–10 minutes) allows point-in-time recovery, reducing the recovery point objective (RPO) to minutes. A pre-staged standby or automated recovery image reduces recovery time objective (RTO) by eliminating the need to restore from scratch, enabling near-instant failover. This directly addresses the company's inability to meet its 30-minute RPO and 2-hour RTO during restore testing.

Answer

Add a second nightly full backup at 23:30 to the same NAS device.

Answer

Move the NAS to a different VLAN but keep the backup schedule unchanged.

Answer

Increase backup retention from one month to one year.

Question 12

A company wants to state that customer data must not be emailed externally unless a manager approves the exception. Which document type should contain this rule?

Accepted Answer

Policy, because it establishes mandatory organizational rules. A policy is the correct document type because it establishes mandatory organizational rules that must be followed. The requirement that customer data must not be emailed externally without manager approval is a binding directive, not a suggestion or a step-by-step guide. Policies define high-level security requirements that all employees must comply with, making them the appropriate vehicle for this rule.

Answer

Guideline, because it gives staff flexible suggestions about email use

Answer

Procedure, because it lists the exact button clicks for sending email

Answer

Standard, because it provides a general recommendation for communication

Question 13

Based on the exhibit, which change best reduces the blast radius if a user workstation is compromised?

Accepted Answer

Remove direct user access to the backup VLAN and allow only the dedicated backup path.. Removing direct user access to the backup VLAN and allowing only the dedicated backup path enforces network segmentation, which limits lateral movement. If a workstation in VLAN 10 is compromised, an attacker cannot pivot directly to the backup server in VLAN 30, reducing the blast radius. This aligns with the principle of least privilege and defense-in-depth for backup infrastructure.

Answer

Add more allow rules from VLAN 10 to VLAN 30 for SMB and RDP so restore jobs stay flexible.

Answer

Move the backup server into the user VLAN to avoid routing and ACL complexity.

Answer

Increase the DHCP lease time so backup jobs run less often during business hours.

Question 14

A security team wants to reduce repeated user mistakes after a phishing campaign without overwhelming employees with long training sessions. Which approach is best?

Accepted Answer

Send a short, targeted reminder to the affected users with a clear reporting path. It applies targeted, immediate reinforcement to the specific users who made mistakes, using a short reminder that clarifies the reporting path. This approach leverages just-in-time training, which has been shown to improve retention and behavior change without overwhelming employees. It directly addresses the root cause—repeated user errors—by providing a clear, actionable step (e.g., 'Report suspicious emails using the PhishAlarm button') rather than generic awareness.

Answer

Require every employee to attend a full-day security class immediately

Answer

Wait until the next annual training cycle and do nothing now

Answer

Disable email access for all employees until they pass a new test

Question 15

A vendor says a patch for a critical flaw in a public-facing application will not be available for 30 days, but the service must stay online. What is the best short-term risk treatment?

Accepted Answer

Implement compensating controls, such as tighter filtering and temporary restrictions, until the patch is released.. When a critical patch is unavailable, the best short-term risk treatment is to implement compensating controls that reduce the likelihood or impact of exploitation. For a public-facing application, this could include deploying a web application firewall (WAF) with tighter rule sets, rate limiting, IP allowlisting, or temporarily disabling non-essential functionality. These controls provide a defense-in-depth layer until the vendor releases the patch, keeping the service online while reducing risk.

Answer

Accept the risk without making any changes because the patch is not available yet.

Answer

Avoid the risk by permanently shutting down the application.

Answer

Transfer the risk to an insurance policy and wait for the patch.