SY0-701 Practice Test 40 — 15 Questions

Question 1

An HR department wants each employee to access only the systems required for their job. A new hire should receive the same permissions as other HR specialists, and changes to the role should update access centrally. Which access model should be used?

Accepted Answer

Role-based access control (RBAC). Role-based access control (RBAC) is the correct model because it assigns permissions based on job roles (e.g., HR specialist), ensuring that a new hire automatically inherits the same access as others in that role. Centralized role management allows changes to the role's permissions to propagate to all members, meeting the requirement for centralized updates.

Answer

Attribute-based access control (ABAC)

Answer

Multi-factor authentication (MFA)

Answer

Privileged access management (PAM)

Question 2

An HR department hires contractors for fixed 60-day engagements. Accounts should stop working automatically when the engagement ends, and any rehire should require fresh approval rather than restoring old access. What IAM control is the best fit?

Accepted Answer

Configure an account expiration date and automatic deprovisioning tied to the approved role.. Option B is correct because configuring an account expiration date and automatic deprovisioning tied to the approved role directly enforces the 60-day limit and ensures that when the engagement ends, the account is automatically disabled or removed. This approach also supports the requirement that rehire requires fresh approval, as the old account is deprovisioned and cannot be simply re-enabled without going through the provisioning process again.

Answer

Use one shared contractor account and rotate the password when people leave.

Answer

Disable the account after the contract ends but keep all group memberships unchanged.

Answer

Create a local workstation account so the contractor does not need centralized identity services.

Question 3

An IDS raises an alert for a possible SQL injection attack against an internal reporting portal. The web server logs show the source IP belongs to the company's vulnerability scanner, and the requests match the scanner's normal test pattern. What is the most appropriate analyst action?

Accepted Answer

Mark the alert as a likely false positive after verifying the scanner schedule and source IP.. Option B is correct because the IDS alert matches the known behavior of the company's vulnerability scanner, which is a legitimate and scheduled security tool. Verifying the scanner schedule and source IP confirms the traffic is authorized, making the alert a false positive. Analysts should correlate IDS alerts with asset inventories and change management records to avoid unnecessary incident response actions.

Answer

Treat the alert as a confirmed breach and begin password resets for all portal users.

Answer

Block the scanner IP permanently to prevent future alerts from the same host.

Answer

Quarantine the reporting server because IDS alerts always indicate active exploitation.

Question 4

An IDS generates an alert for possible SQL injection against an internal reporting portal at 02:00. The web logs show the source IP belongs to the company's approved vulnerability scanner, the request path matches the scheduled test window, and the WAF blocked the request. What is the most appropriate analyst conclusion?

Accepted Answer

Close it as expected activity after validating the scanner schedule and source IP.. Option B is correct because the alert matches expected, authorized activity: the source IP belongs to the approved vulnerability scanner, the request occurred during the scheduled test window, and the WAF blocked the malicious payload. This is a classic false positive triggered by legitimate security testing, not an actual intrusion. The analyst should validate the scanner schedule and source IP, then close the alert as expected activity.

Answer

Treat it as a confirmed intrusion and immediately take the portal offline.

Answer

Classify it as malware because the blocked payload proves the scanner is infected.

Answer

Disable the WAF rule so the scanner can complete without generating more alerts.

Question 5

An internal finance application has an RTO of 2 hours and an RPO of 30 minutes. Current backups restore in about 6 hours because the team must rebuild the server from scratch. Which change best aligns the recovery design to the business requirement?

Accepted Answer

Add a warm standby or replicated recovery system that can be brought online within the RTO. The business requires an RTO of 2 hours and an RPO of 30 minutes, but current backups take 6 hours to restore because the server must be rebuilt from scratch. Adding a warm standby or replicated recovery system allows the application to be brought online within the RTO by maintaining a pre-configured, partially synchronized environment that can be activated quickly, reducing recovery time from hours to minutes. This aligns the recovery design with the business continuity requirements by meeting both the RTO and RPO targets.

Answer

Keep the same design and simply increase backup retention

Answer

Switch to weekly full backups only

Answer

Reduce logging on the application server to improve restore speed

Question 6

An IT manager wants a document that defines the mandatory minimum requirements for all company laptops, including full-disk encryption, password length, and screen-lock timing. The help desk also needs a separate document that shows exactly how to enroll a laptop in management software. Which document type should contain the mandatory laptop requirements?

Accepted Answer

Standard, because it defines the required technical settings that must be followed.. Option B is correct because a standard defines mandatory, specific technical requirements that must be uniformly applied, such as full-disk encryption (e.g., AES-256), minimum password length (e.g., 14 characters), and screen-lock timeout (e.g., 5 minutes). Unlike a policy, which provides high-level direction, a standard enforces precise configuration baselines that all laptops must meet, ensuring compliance and security consistency.

Answer

Policy, because it gives broad direction without technical detail.

Answer

Procedure, because it gives step-by-step instructions for completing a task.

Answer

Guideline, because it offers flexible recommendations for administrators.

Question 7

An online ticketing system must survive a single server failure and continue operating after a primary site outage. The business wants the lowest-cost design that still improves availability. Which architecture is best?

Accepted Answer

Use an active-passive design with replicated data and automatic failover to a secondary site.. An active-passive design with replicated data and automatic failover (Option B) meets the requirement of surviving a single server failure and a primary site outage while minimizing cost. Unlike active-active, it uses standby resources that only activate during failover, reducing operational expense. This architecture improves availability without the complexity and cost of multi-region active-active deployment.

Answer

Deploy active-active servers across multiple regions with load balancing.

Answer

Schedule nightly backups and restore only after the outage is confirmed.

Answer

Add RAID to the server to protect against all availability failures.

Question 8

An organization is retiring a batch of laptops with SSDs. All of the systems used full-disk encryption and stored sensitive internal documents. What is the best action before the devices leave the company?

Accepted Answer

Perform a cryptographic erase by destroying the encryption keys and document the sanitization process.. Option B is correct because a cryptographic erase (also known as a crypto-scrub) renders the encrypted data permanently inaccessible by securely destroying the encryption keys. Since the SSDs used full-disk encryption (FDE), the data is already encrypted at rest, and without the keys, the ciphertext is effectively unrecoverable. This method is fast, reliable, and compliant with sanitization standards like NIST SP 800-88, making it the best action before the devices leave the organization.

Answer

Run a quick format and remove the asset tags after the files are deleted.

Answer

Degauss the SSDs and then store them in the disposal room until pickup.

Answer

Overwrite the drives once with random data and consider the devices ready for resale.

Question 9

An organization's file server contains sensitive HR data. The security team discovers that permissions on a confidential folder have been altered. Which of the following security controls would MOST likely help determine the account responsible for this change?

Accepted Answer

Audit logging. Audit logging is the correct answer because it records detailed information about who made changes to files and folders, including the account name, timestamp, and the specific permission alteration. By reviewing audit logs, the security team can trace the unauthorized permission change back to the responsible user account. This is a detective control that directly supports accountability and forensic investigation.

Answer

Data loss prevention (DLP) system

Answer

Mandatory access control (MAC)

Answer

Host-based intrusion prevention system (HIPS)

Question 10

Analysts see a malware campaign that changes its command-and-control domain every day, but the executable hash and a unique registry value remain the same across incidents. Which indicator is the best candidate for hunting?

Accepted Answer

The executable hash from the malware sample.. Option B is correct because the executable hash (e.g., SHA-256) and the unique registry value are static, immutable artifacts that persist across every incident, regardless of the daily domain rotation. These indicators are far more reliable for hunting since they directly identify the malware binary itself, whereas the domain changes frequently and may be blocked or sinkholed after detection.

Answer

The daily domain name used for command and control.

Answer

The employee's home city where the alert was observed.

Answer

The brand of the user's keyboard and mouse.

Question 11

Based on the exhibit, what control type is the file integrity monitor providing?

Accepted Answer

Detective control, because the tool identifies the unauthorized change and alerts the SOC.. A file integrity monitor (FIM) operates by comparing current file hashes against a known good baseline. When it detects a hash mismatch, it generates an alert to the Security Operations Center (SOC). This is a detective control because it identifies and reports the unauthorized change after it has occurred, rather than preventing or automatically correcting it.

Answer

Preventive control, because the file monitor stopped the change from occurring.

Answer

Corrective control, because the monitor automatically fixed the configuration after the change.

Answer

Directive control, because the alert tells administrators what they should review next.

Question 12

Based on the exhibit, what is the best cloud identity control to ensure terminated users lose access to the SaaS application quickly and consistently?

Accepted Answer

Enable federated authentication with the corporate IdP and automate provisioning and deprovisioning with SCIM.. Option B is correct because federated authentication with a corporate identity provider (IdP) combined with SCIM (System for Cross-domain Identity Management) ensures that when a user is terminated in the IdP (e.g., Active Directory or Azure AD), the SaaS application is automatically notified via SCIM to deprovision the user account. This eliminates manual intervention and guarantees consistent, near-instant revocation of access across all federated SaaS applications.

Answer

Keep the SaaS local user accounts and require the help desk to disable them manually after each termination.

Answer

Create a shared emergency administrator account so access can be revoked by changing one password.

Answer

Require users to clear browser cookies after termination so the SaaS session expires sooner.

Question 13

Based on the exhibit, what is the best next request before approving the vendor?

Accepted Answer

Request a current SOC 2 Type II report or equivalent independent operating-effectiveness attestation.. Option D is correct because a SOC 2 Type II report provides an independent, third-party attestation of the effectiveness of a vendor's security controls over a period of time (typically 6–12 months). This is the most reliable evidence for verifying that the vendor's operational security controls are working as intended, which is critical before approving a vendor. The internal penetration test summary (Option B) lacks independence and may not cover all relevant controls, while a marketing brochure (Option A) is not a verifiable audit artifact. The shared responsibility matrix (Option C) defines roles but does not attest to control effectiveness.

Answer

Ask for a fresh marketing brochure that describes the vendor's security controls in detail.

Answer

Accept the internal penetration test summary because it proves the controls were tested recently.

Answer

Request only the shared responsibility matrix again, since it covers all security responsibilities.

Question 14

Based on the exhibit, what is the most important next IR action?

Accepted Answer

Revoke active sessions and OAuth consent grants for the account.. The exhibit shows a compromised account with a suspicious inbox rule forwarding emails externally. The most critical next step is to revoke active sessions and OAuth consent grants to immediately terminate the attacker's access and prevent further data exfiltration, as changing the password alone does not invalidate existing OAuth tokens or active sessions.

Answer

Change the password again and monitor the mailbox for a few days.

Answer

Restore the deleted inbox rule from backup to preserve evidence.

Answer

Close the incident because the forwarding rule was removed.

Question 15

Based on the exhibit, what is the most likely SOC conclusion and next action?

A scheduled alert fired on a server that repeatedly connects to a vendor update site at fixed intervals. The security team wants to know whether the alert represents a real threat or a harmless operational pattern.

Accepted Answer

Classify the alert as a likely false positive, verify it against the maintenance record, and tune the rule.. The scheduled alert firing at fixed intervals to a known vendor update site strongly suggests a legitimate update or heartbeat mechanism, not malicious C2 traffic. Option B correctly directs the analyst to verify against maintenance records (confirming the pattern is expected) and then tune the rule to reduce future false positives, which is the standard SOC workflow for benign scheduled activity.

Answer

Treat the activity as confirmed command-and-control traffic and isolate the server immediately.

Answer

Assume DNS poisoning is occurring and immediately flush the DNS cache on every endpoint.

Answer

Open a credential theft incident and reset all administrator passwords across the environment.