SY0-701 Practice Test 40 — 15 Questions

Question 1

An HR system marks employees as hired, transferred, or terminated. The security team wants those changes to create, update, or disable accounts in multiple SaaS apps automatically after the user authenticates through the company identity provider. Which capability should be added?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SCIM provisioning integrated with the SSO platform.. SCIM (System for Cross-domain Identity Management) is the correct choice because it provides a standardized protocol for automating the creation, update, and deletion of user accounts across multiple SaaS applications. When integrated with an SSO platform (like SAML), SCIM handles the lifecycle events (hire, transfer, terminate) by sending RESTful API calls to each SaaS app, ensuring accounts are created, updated, or disabled without manual intervention. SAML alone only handles authentication, not account provisioning, making SCIM essential for the described automation.

Answer

SAML federation alone, with no additional account lifecycle automation.

Answer

Password synchronization between every application.

Answer

Local administrator groups on each SaaS application.

Question 2

Administrators must manage network switches from home. Requirements: encrypted management traffic, MFA for users, no management ports exposed to the Internet, and centralized logging of admin sessions. Which solution best meets the requirements?

Accepted Answer

Use a VPN with MFA that terminates on a hardened jump host, then reach switches over SSH or HTTPS.. It satisfies all requirements: a VPN with MFA encrypts management traffic, the hardened jump host provides a secure intermediary that keeps switch management ports off the Internet, and centralized logging can be implemented on the jump host to record all admin sessions. This architecture aligns with the principle of defense-in-depth by combining encrypted tunnels, strong authentication, and network segmentation.

Answer

Open SSH directly on each switch and allow access from the entire Internet.

Answer

Use port forwarding through the firewall to RDP on each switch.

Answer

Build an IPSec tunnel only between office routers and share a common admin password on the switches.

Question 3

A vulnerability scanner reports a critical issue on a Linux server. The administrator checks the application and confirms the vulnerable package is installed, but the affected feature is not enabled anywhere in production. What should the security team do next?

Accepted Answer

Validate whether the issue is a false positive or lower-risk finding before prioritizing remediation. The vulnerability scanner reports a critical issue, but the administrator has confirmed the vulnerable package is installed while the affected feature is not enabled in production. This means the actual risk is lower than the scanner's severity rating, as exploitation requires the feature to be active. The security team should validate whether this is a false positive or a lower-risk finding to prioritize remediation efforts appropriately, ensuring resources are allocated to genuine threats.

Answer

Ignore the finding permanently because the package is installed

Answer

Immediately shut down the server without further investigation

Answer

Apply an exception without documenting any compensating controls

Question 4

A company needs a public website that anyone on the internet can reach, but the application and database servers must stay off the internet. Where should the web server be placed?

Accepted Answer

In a DMZ separated from the internal application and database networks.. The web server must be placed in a DMZ (demilitarized zone) because this network segment is designed to host publicly accessible services while isolating them from internal networks. The DMZ allows inbound traffic from the internet to the web server, but the application and database servers remain on internal networks with strict firewall rules that block direct internet access, enforcing a layered security architecture.

Answer

On the internal user network with the database server.

Answer

On the same subnet as the firewall management interface.

Answer

Directly on the database subnet so performance is faster.

Question 5

A public web server becomes unreachable during an outage. Netflow shows a large number of DNS responses arriving from many open resolvers, while the server itself only sent tiny spoofed DNS queries with the victim's address as the source. What type of attack is this?

Accepted Answer

DNS amplification reflection denial-of-service.. This is a classic DNS amplification reflection DDoS attack. The attacker sends small DNS queries with a spoofed source IP (the victim's address) to open resolvers, which then send large DNS responses to the victim, overwhelming its bandwidth. The NetFlow data shows the server receiving many large DNS responses while only sending tiny spoofed queries, confirming the amplification and reflection vectors.

Answer

DNS zone transfer abuse against the organization.

Answer

A replay attack against a web application session token.

Answer

ARP poisoning inside the local network segment.

Question 6

A policy states that sensitive data must be encrypted, but it does not say which encryption strength to use. The security architect wants a document that lists the exact approved encryption settings for systems to follow. What document is needed?

Accepted Answer

A standard, because it specifies the required technical values and configurations.. A standard is the correct document because it mandates specific, measurable technical requirements—such as exact encryption algorithms (e.g., AES-256), key lengths, and cipher modes (e.g., GCM)—that systems must follow to comply with the policy. Unlike a policy, which states a goal (e.g., 'encrypt sensitive data'), a standard provides the enforceable configuration baseline that the security architect needs.

Answer

A procedure, because it explains the step-by-step order for handling every file.

Answer

A guideline, because it gives suggestions that teams may choose to adopt.

Answer

A memo, because it is the fastest way to tell teams about a new requirement.

Question 7

A SIEM alert shows a successful VPN login for an executive account from an unusual country, followed 3 minutes later by large downloads from a file share the user rarely accesses. Which log source should the analyst review next to determine whether the session came from the user's assigned laptop or an unmanaged device?

Accepted Answer

Endpoint detection and response telemetry from the user's laptop. B is correct because endpoint detection and response (EDR) telemetry from the user's laptop provides granular process-level and network-level data, including the source IP of the VPN session, the device's hostname, and whether the VPN client software was initiated from the managed laptop's operating system. This allows the analyst to confirm if the VPN session originated from the assigned corporate device or from an unmanaged device using stolen credentials.

Answer

VPN concentrator logs

Answer

DNS query logs from the internal resolver

Answer

Email gateway logs for the executive mailbox

Question 8

After restoring a virtualized file server from backup, users can log in but the accounting application returns database consistency errors. What should you do next?

Accepted Answer

Verify the restore in an isolated environment and confirm application-level integrity and permissions.. The restore process must be validated beyond basic boot and login functionality. Database consistency errors indicate that the application-level data integrity was compromised during the restore, likely due to missing or inconsistent database files, permissions, or transaction logs. Verifying the restore in an isolated environment allows you to test application-specific integrity checks (e.g., DBCC CHECKDB for SQL Server) and confirm that file permissions and security descriptors are intact before returning the server to production.

Answer

Declare the restore successful because the virtual machine boots and users can sign in.

Answer

Increase the backup retention period and wait for the next scheduled full backup.

Answer

Delete the backup set to prevent confusion with the restored data.

Question 9

A Linux host is patched, but the scanner still flags the package as vulnerable. The vendor advisory says the distribution backported the fix, so the package version did not change. What should the analyst do before closing the ticket?

Accepted Answer

Verify the vendor advisory and package metadata, then document evidence of the fixed build.. When a vendor backports a security fix to an older package version without incrementing the version number, the vulnerability scanner may still flag the package based on its version string. The analyst must verify the vendor advisory and package metadata (e.g., using `rpm -q --changelog` or `dpkg --status`) to confirm the fix is present, then document this evidence to close the ticket with proper justification.

Answer

Close the ticket immediately because the patch was installed successfully.

Answer

Raise the severity of the finding because the scanner still reports it.

Answer

Disable the scanner until the next maintenance window to avoid repeated alerts.

Question 10

A company uses a SaaS email platform. The provider manages the servers and application code. Which two tasks remain the company's responsibility? Select two.

Accepted Answer

Configuring who can access company mailboxes and administrative roles.. In a SaaS model, the customer retains administrative control over user access and role-based permissions. This includes configuring mailbox permissions, setting up multi-factor authentication, and managing administrative roles within the provider's interface. The provider handles the underlying infrastructure, but identity and access management (IAM) remains the customer's responsibility.

Answer

Applying security patches to the provider's mail servers.

Answer

Replacing failed provider storage disks.

Answer

Hardening the provider's hypervisor.

Question 11

Based on the exhibit, which tool should the security team use to safely observe the attachment's behavior before delivery to users?

Accepted Answer

Sandboxing, so the file can execute in a controlled environment before release.. Sandboxing allows the security team to execute the attachment in a controlled, isolated environment to observe its behavior (e.g., network connections, file modifications) without risking the production network. This is the correct approach because it safely detonates the file before delivery, enabling detection of malicious activity such as ransomware or trojans. Other tools like DLP, NAC, or SIEM do not provide the dynamic analysis needed to assess the attachment's runtime behavior.

Answer

DLP, so the gateway can block sensitive data from leaving the organization.

Answer

NAC, so the sender's device can be checked before the message is accepted.

Answer

SIEM, so the team can store the attachment and review alerts later.

Question 12

A file server is actively renaming documents and generating ransom notes. The server hosts a shared drive used by finance, and users are still online. What is the best immediate action?

Accepted Answer

Isolate the server from the network to contain the spread while preserving evidence.. Isolating the server from the network stops the ransomware from encrypting more files or spreading laterally, while preserving volatile evidence (e.g., running processes, memory contents) needed for forensic analysis. In a live incident, immediate disconnection (not shutdown) is the standard containment step per NIST SP 800-61 and SANS incident response guidelines, as it halts the attack without destroying data in memory or logs.

Answer

Shut the server down immediately to stop all activity as fast as possible.

Answer

Restore the file server from backup before checking whether the infection is still active.

Answer

Run a full antivirus scan and wait for the results before taking any other action.

Question 13

After a user installs a free PDF converter from an unofficial site, the browser homepage changes, the endpoint protection agent stops launching, and the system begins making periodic outbound connections to the same unfamiliar IP address. No exploit was used during installation, and the installer appeared legitimate. What type of malware best matches this behavior?

Accepted Answer

Trojan, because it masquerades as useful software while delivering hidden malicious functionality.. B is correct because the software masquerades as a legitimate PDF converter while secretly performing malicious actions—changing the browser homepage, disabling endpoint protection, and making unauthorized outbound connections. This is the classic definition of a Trojan horse: it appears useful but contains hidden, harmful functionality. The lack of an exploit and the user's voluntary installation further confirm it is a Trojan, not a self-replicating worm or a kernel-hiding rootkit.

Answer

Worm, because the infection is spreading automatically across the network.

Answer

Rootkit, because the attacker must have hidden files in the kernel.

Answer

Spyware, because the main symptom is that the browser homepage changed.

Question 14

Based on the exhibit, what is the best fix so role changes are reflected promptly in the application?

Token and directory data:

09:10  Token issued for user jdoe
      groups=[Finance_Approver, Expense_Reviewer]
      auth_time=09:10
      exp=17:10
09:15  HR updated directory: jdoe moved to Sales
11:00  The application still accepts the original token and allows expense approval
11:01  Identity provider logs show no token revocation event

Accepted Answer

Shorten token and session lifetime and revoke active tokens when the directory role changes.. The token's long lifetime (issued at 09:10, expires at 17:10) allows the application to continue accepting the original token even after the user's directory role changes at 09:15. Shortening the token lifetime forces more frequent reauthentication, and revoking active tokens when the directory role changes ensures that the application immediately reflects the updated authorization. This aligns with the principle of dynamic access control and token lifecycle management.

Answer

Increase the token lifetime so users reauthenticate less often.

Answer

Move the application to a different subnet to isolate it from HR systems.

Answer

Disable group-based authorization and let any authenticated user approve expenses.

Question 15

A company suspects the master encryption key used by a cloud storage service may have been exposed. The data must remain protected if someone later obtains a copy of the old key. What is the best next step?

Accepted Answer

Rotate the key and re-encrypt or rewrap the protected data under the new key.. Key rotation is the correct response because it invalidates the old master encryption key by generating a new one and re-encrypting or rewrapping the protected data under the new key. This ensures that even if an attacker later obtains a copy of the old key, the data remains protected because it is no longer encrypted with that key. In cloud storage services like AWS KMS or Azure Key Vault, this process is typically automated and does not require re-uploading the data.

Answer

Delete the stored files so the exposed key can no longer be used.

Answer

Change every user's password because that will also invalidate the exposed encryption key.

Answer

Increase file compression so the data becomes harder to read.