SY0-701 Practice Test 41 — 15 Questions

Question 1

To discourage unauthorized entry into a records room, facilities installs a large warning sign, a visible camera over the door, and a turnstile staffed by a guard during business hours. Which control category is the warning sign intended to support most directly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deterrent. The warning sign is a physical security control designed to discourage unauthorized entry by making potential intruders aware of the risks and consequences. This directly supports the deterrent control category, which aims to reduce the likelihood of a security incident by influencing behavior through fear of detection or punishment. Unlike detective controls that identify incidents after they occur, or preventive controls that physically block access, the sign's primary function is psychological deterrence.

Answer

Detective

Answer

Preventive

Answer

Corrective

Question 2

An email attachment from an external supplier is not blocked by signature-based AV, but the SOC wants to see whether it drops files, launches child processes, or contacts suspicious domains before delivery to users. Which control best fits?

Accepted Answer

Sandboxing, because it detonates the file in an isolated environment.. Sandboxing is the correct control because it detonates the file in an isolated, virtualized environment to observe its runtime behavior, such as dropping files, spawning child processes, or making outbound connections to suspicious domains. This goes beyond signature-based AV by analyzing dynamic behavior rather than static file hashes or patterns. The SOC's goal is to assess the file's actions before delivery, which sandboxing directly addresses.

Answer

Network IDS, because it passively monitors traffic for known threats.

Answer

DLP, because it prevents sensitive data from leaving the organization.

Answer

NAC, because it controls whether a device can join the network.

Question 3

A customer portal runs from a primary data center. Management wants the secondary site to take over within minutes if the primary site loses power, and the secondary site should already have current systems and data ready to serve users. Which design best fits this requirement?

Accepted Answer

A hot site with synchronized data replication and automated failover. A hot site with synchronized data replication and automated failover is the correct choice because it maintains an exact, real-time copy of systems and data at the secondary site. Synchronous replication ensures zero data loss (RPO=0), and automated failover enables the secondary site to become operational within minutes (RTO measured in minutes), meeting the requirement for immediate takeover after a power loss at the primary site.

Answer

A cold site with nightly backups stored offsite

Answer

RAID 0 across two storage arrays in the primary data center

Answer

A single backup server with larger disks and more memory

Question 4

A team moved a Linux VM to IaaS. They need OS login events, process activity, and network flow metadata sent to one central platform for alerting. What is the best first step?

Accepted Answer

Deploy an endpoint logging agent and enable cloud-native flow logs to a centralized logging service.. Deploying an endpoint logging agent (e.g., auditd, osquery, or a SIEM agent) on the Linux VM captures OS login events and process activity at the guest level, while enabling cloud-native flow logs (e.g., AWS VPC Flow Logs, Azure NSG flow logs) provides network flow metadata. Sending both to a centralized logging service (e.g., AWS CloudWatch Logs, Azure Log Analytics, or a third-party SIEM) ensures all required telemetry is aggregated for alerting. This approach directly addresses the need for host-level and network-level visibility without relying on the cloud provider to collect guest OS internals.

Answer

Enable only perimeter security groups and assume the cloud provider will collect all host telemetry.

Answer

Store the VM snapshots in object storage and review them manually during incidents.

Answer

Rely on the hypervisor console and disable guest-level logging to reduce overhead.

Question 5

Based on the exhibit, which change best improves both recovery time and recovery point for the ERP database?

A mid-sized company has a two-hour RTO and a 30-minute RPO, but its current backup design cannot meet either objective during restore testing.

Accepted Answer

Implement frequent transaction log backups and a pre-staged standby or automated recovery image.. Implementing frequent transaction log backups (e.g., every 5–10 minutes) allows point-in-time recovery, reducing the recovery point objective (RPO) to minutes. A pre-staged standby or automated recovery image reduces recovery time objective (RTO) by eliminating the need to restore from scratch, enabling near-instant failover. This directly addresses the company's inability to meet its 30-minute RPO and 2-hour RTO during restore testing.

Answer

Add a second nightly full backup at 23:30 to the same NAS device.

Answer

Move the NAS to a different VLAN but keep the backup schedule unchanged.

Answer

Increase backup retention from one month to one year.

Question 6

A company wants to state that customer data must not be emailed externally unless a manager approves the exception. Which document type should contain this rule?

Accepted Answer

Policy, because it establishes mandatory organizational rules. A policy is the correct document type because it establishes mandatory organizational rules that must be followed. The requirement that customer data must not be emailed externally without manager approval is a binding directive, not a suggestion or a step-by-step guide. Policies define high-level security requirements that all employees must comply with, making them the appropriate vehicle for this rule.

Answer

Guideline, because it gives staff flexible suggestions about email use

Answer

Procedure, because it lists the exact button clicks for sending email

Answer

Standard, because it provides a general recommendation for communication

Question 7

Based on the exhibit, which change best reduces the blast radius if a user workstation is compromised?

Accepted Answer

Remove direct user access to the backup VLAN and allow only the dedicated backup path.. Removing direct user access to the backup VLAN and allowing only the dedicated backup path enforces network segmentation, which limits lateral movement. If a workstation in VLAN 10 is compromised, an attacker cannot pivot directly to the backup server in VLAN 30, reducing the blast radius. This aligns with the principle of least privilege and defense-in-depth for backup infrastructure.

Answer

Add more allow rules from VLAN 10 to VLAN 30 for SMB and RDP so restore jobs stay flexible.

Answer

Move the backup server into the user VLAN to avoid routing and ACL complexity.

Answer

Increase the DHCP lease time so backup jobs run less often during business hours.

Question 8

A security team wants to reduce repeated user mistakes after a phishing campaign without overwhelming employees with long training sessions. Which approach is best?

Accepted Answer

Send a short, targeted reminder to the affected users with a clear reporting path. It applies targeted, immediate reinforcement to the specific users who made mistakes, using a short reminder that clarifies the reporting path. This approach leverages just-in-time training, which has been shown to improve retention and behavior change without overwhelming employees. It directly addresses the root cause—repeated user errors—by providing a clear, actionable step (e.g., 'Report suspicious emails using the PhishAlarm button') rather than generic awareness.

Answer

Require every employee to attend a full-day security class immediately

Answer

Wait until the next annual training cycle and do nothing now

Answer

Disable email access for all employees until they pass a new test

Question 9

A vendor says a patch for a critical flaw in a public-facing application will not be available for 30 days, but the service must stay online. What is the best short-term risk treatment?

Accepted Answer

Implement compensating controls, such as tighter filtering and temporary restrictions, until the patch is released.. When a critical patch is unavailable, the best short-term risk treatment is to implement compensating controls that reduce the likelihood or impact of exploitation. For a public-facing application, this could include deploying a web application firewall (WAF) with tighter rule sets, rate limiting, IP allowlisting, or temporarily disabling non-essential functionality. These controls provide a defense-in-depth layer until the vendor releases the patch, keeping the service online while reducing risk.

Answer

Accept the risk without making any changes because the patch is not available yet.

Answer

Avoid the risk by permanently shutting down the application.

Answer

Transfer the risk to an insurance policy and wait for the patch.

Question 10

A SOC analyst receives a SIEM alert for a possible brute-force attack against a remote access portal. The alert shows 240 failed logins from the same source IP over 4 minutes, followed by one successful login. Before escalating as an incident, what is the BEST evidence to check to determine whether the alert is a false positive caused by approved activity?

Accepted Answer

Whether there is a change ticket or test plan for the access portal and the activity matches the approved maintenance window. A change ticket or test plan that matches the observed activity (240 failed logins followed by a successful login during an approved maintenance window) would indicate that the alert is a false positive caused by authorized testing or maintenance, not a malicious brute-force attack. This is the best evidence because it directly ties the SIEM alert to approved, scheduled activity, which is a standard operational control for change management.

Answer

Whether the source IP belongs to the company help desk

Answer

Whether the user account has MFA enabled

Answer

Whether the firewall is in inline mode

Question 11

An employee receives an email that appears to come from payroll and asks them to open a link to "confirm direct deposit details". The link goes to a site with a slightly misspelled company name. What should the employee do first?

Accepted Answer

Use the company's known payroll portal or help desk contact to verify the request. The safest first step when receiving a suspicious email is to verify its legitimacy through a trusted, independent channel—such as the company's known payroll portal or the help desk. This avoids interacting with the potentially malicious link or sender, which could lead to credential theft or malware installation. The email exhibits classic phishing indicators: a spoofed sender, a request for sensitive action, and a URL with a misspelled domain.

Answer

Click the link and sign in quickly before the account is locked

Answer

Reply to the email and ask payroll whether the message is real

Answer

Forward the message to co-workers so they can compare it with similar emails

Question 12

After an endpoint cleanup, an EDR agent shows inconsistent results: a suspicious process does not appear in normal task listings, a file in System32 is hidden from user-mode tools, and some security logs stop recording events at the same time. Which malware type best matches these symptoms?

Accepted Answer

Rootkit, because it hides processes, files, or activity from standard system tools.. A rootkit is designed to hide its presence and the presence of associated processes, files, and system activities from standard operating system tools and user-mode APIs. The symptoms described—a process invisible to task listings, a hidden file in System32, and security logs ceasing to record events—are classic indicators of kernel-mode or user-mode rootkit behavior that intercepts system calls to filter out its own artifacts.

Answer

Spyware, because it secretly collects user information and browser data.

Answer

Worm, because it spreads quickly through network shares and email attachments.

Answer

Trojan, because it masquerades as legitimate software to trick the user.

Question 13

A web login form uses unsanitized input in the backend query. When an attacker enters `' OR '1'='1'--` into the username field, the application grants access without a valid password. Which attack pattern is being used?

Accepted Answer

SQL injection, because the input changes the meaning of the database query.. The attacker's input (`' OR '1'='1'--`) is a classic SQL injection payload that alters the structure of the backend SQL query. By injecting a tautology (`OR '1'='1'`) and commenting out the rest of the query with `--`, the attacker bypasses authentication, causing the database to return a valid row without requiring a correct password.

Answer

Cross-site scripting, because the attacker is trying to run code in the browser.

Answer

Broken session management, because the user is still logged in after leaving the page.

Answer

Insecure deserialization, because the application accepts user input.

Question 14

Leadership wants to compare two controls for protecting a customer portal. Option A costs $40,000 and reduces annual loss expectancy from $120,000 to $30,000. Option B costs $15,000 and reduces annual loss expectancy to $70,000. Which analysis method best supports this decision?

Accepted Answer

Quantitative risk analysis. Quantitative risk analysis uses monetary values and numerical data to calculate risk, making it the best method to compare the cost-benefit of Option A (ALE reduction from $120,000 to $30,000 with a $40,000 cost) versus Option B (ALE reduction to $70,000 with a $15,000 cost). By computing the annualized loss expectancy (ALE) and comparing the cost of each control against the reduction in expected loss, leadership can determine which option provides a better return on investment. This approach directly supports the decision because it provides objective, dollar-based metrics for comparison.

Answer

Qualitative risk analysis

Answer

Business impact analysis

Answer

Risk acceptance

Question 15

A help desk ticket confirms that a user entered corporate credentials into a fake sign-in page. Minutes later, the security team finds a new mailbox forwarding rule and evidence that the attacker added backup MFA codes. After disabling the account, what should the team do next to support containment and recovery?

Accepted Answer

Revoke active sessions and reset the compromised credentials.. After disabling a compromised account, the immediate next step is to revoke all active sessions and reset the credentials. This ensures the attacker cannot maintain access via existing tokens or session cookies, and the new password invalidates any cached or stolen credentials. This aligns with the NIST SP 800-61 incident response containment phase, which prioritizes cutting off active attacker access before further investigation.

Answer

Wait for the user to confirm the behavior before taking any further steps.

Answer

Reimage the user's laptop before reviewing the account activity.

Answer

Close the ticket because MFA was enabled and should have prevented access.