SY0-701 Practice Test 41 — 15 Questions

Question 1

Based on the exhibit, what security issue is most likely present?

Accepted Answer

Exposed service, because management and streaming ports are listening on all interfaces and allowed from anywhere.. Option C is correct because the exhibit shows that both the management interface (TCP 443) and the streaming interface (TCP 554) are bound to 0.0.0.0 (all interfaces) and the firewall rules allow traffic from 0.0.0.0/0 (any source). This exposes the camera's web management and RTSP streaming services to the entire internet, making it vulnerable to unauthorized access, reconnaissance, and potential exploitation. An exposed service of this nature is a common entry point for attackers to compromise IoT devices.

Answer

Weak permissions, because the camera streams video to multiple ports.

Answer

Default credentials, because the admin login is enabled.

Answer

Outdated component, because firmware version 1.0.3 is listed.

Question 2

Based on the exhibit, what should the analyst do before opening the forensic image for examination?

Accepted Answer

Calculate and compare the image hash to the source hash before analysis.. Before examining a forensic image, the analyst must verify its integrity by calculating its hash (e.g., MD5, SHA-1, SHA-256) and comparing it to the known hash of the original source. This ensures the image is an exact, unaltered copy, which is critical for maintaining the chain of custody and admissibility of evidence. Option B is correct because hash verification is the foundational step in forensic analysis.

Answer

Mount the image read-write so the analyst can begin searching immediately.

Answer

Defragment the original SSD so the files will be easier to search later.

Answer

Compress the image into a ZIP file to reduce storage usage before verifying it.

Question 3

A branch office needs to send a confidential design document to headquarters over an untrusted network. Headquarters already has the public/private key pair available for document exchange. Which method is most appropriate to keep the file confidential during transit without first sharing a secret key?

Accepted Answer

Encrypt the file with headquarters' public key. Encrypting the file with headquarters' public key ensures that only headquarters, possessing the corresponding private key, can decrypt and read the file. This method provides confidentiality over an untrusted network without requiring a pre-shared secret key, as the public key can be freely distributed.

Answer

Publish a hash of the file for comparison

Answer

Sign the file with the branch office private key only

Answer

Compress the file before sending it

Question 4

A cloud-hosted image-processing API accepts a URL parameter so it can download a picture and generate a thumbnail. Logs show a user submitting `http://169.254.169.254/latest/meta-data/` and receiving instance credentials in the response. Which attack is being used?

Accepted Answer

Server-side request forgery (SSRF). The attack is Server-Side Request Forgery (SSRF) because the cloud-hosted API is tricked into making a request to the internal metadata service at the link-local address 169.254.169.254. This endpoint is only accessible from within the cloud provider's network and exposes instance credentials, which the attacker then receives in the response. SSRF exploits the server's ability to make outbound requests to internal or restricted resources.

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Question 5

A cloud support team is replacing separate logins for several internal apps. The new design must support one sign-in, reduce the chance that a stolen session remains valid too long, and let the identity team revoke access centrally after termination. Which three controls best fit? Select three.

Accepted Answer

Implement SSO through federation with the identity provider as the source of truth.. Option A is correct because implementing SSO through federation with the identity provider (IdP) as the source of truth allows users to sign in once and access multiple internal apps without separate logins. This design centralizes authentication, so when the identity team revokes access after termination, the IdP denies all subsequent token requests, effectively invalidating sessions across all apps. Federation typically uses SAML 2.0 or OIDC, where the IdP issues signed assertions or ID tokens that apps trust, eliminating the need for app-specific credentials.

Answer

Keep app-specific local accounts so each application can manage sessions independently.

Answer

Disable centralized logout so active sessions are never interrupted during maintenance.

Question 6

A company can patch only one of two internet-facing systems this week. System 1 has a critical vulnerability but is reachable only through the corporate VPN during maintenance windows. System 2 has a medium vulnerability and supports the public payment site, which shows active attack traffic every day. Which system should be prioritized first?

Accepted Answer

System 2, because it is exposed to the public and directly supports a business-critical service. System 2 should be prioritized because it is directly exposed to the public internet and supports a business-critical payment service that is under active attack daily. Even though System 1 has a critical vulnerability, it is only reachable through the corporate VPN during maintenance windows, which significantly reduces its attack surface and exploitability. In risk management, the likelihood of exploitation and business impact often outweigh the CVSS base score alone, making System 2 the higher priority.

Answer

System 1, because the vulnerability is rated critical

Answer

Neither system, because both are internet-facing and must wait for the next maintenance cycle

Answer

System 1, because VPN access always makes a vulnerability more dangerous than a public application issue

Question 7

A company is considering a new SaaS vendor that will process customer records. What is the best first action before signing the contract?

Accepted Answer

Perform vendor due diligence and review the vendor's security controls. Performing vendor due diligence and reviewing the vendor's security controls is the best first action because it proactively assesses the SaaS vendor's ability to protect customer records before any data is shared. This aligns with the principle of 'trust but verify' and ensures that the vendor's security posture meets the company's compliance requirements (e.g., GDPR, HIPAA) and risk tolerance before signing a legally binding contract.

Answer

Allow the vendor access immediately and monitor for misuse afterward

Answer

Ask the vendor to send a marketing brochure and pricing sheet only

Answer

Wait until a security incident occurs before reviewing the vendor

Question 8

A company is placing a customer-facing web application behind a new security control. The team wants to block malicious HTTP requests such as injection attempts before they reach the application server, with minimal code changes to the app itself. Which control is the best fit?

Accepted Answer

Web application firewall (WAF) in front of the application.. A web application firewall (WAF) is specifically designed to inspect and filter HTTP/HTTPS traffic at the application layer (Layer 7), blocking malicious payloads such as SQL injection and cross-site scripting (XSS) before they reach the web server. It operates without requiring changes to the application code, making it the ideal choice for this scenario.

Answer

Network access control (NAC) at the switch port.

Answer

Data loss prevention (DLP) on the email gateway.

Answer

Endpoint detection and response (EDR) on the web server only.

Question 9

A company is signing a contract with a SaaS expense platform. Security wants the vendor to notify the company within 24 hours of a confirmed incident, maintain customer data segregation, and allow the company to verify security commitments if required. Which control should be added to the agreement?

Accepted Answer

A security addendum with SLA terms. A security addendum or contract clause set is the right place to define incident notification timing, data segregation expectations, and verification rights. These requirements need to be written into a binding agreement so both sides understand their responsibilities and so the customer has leverage if the vendor does not comply. This is stronger than informal assurances or generic privacy language.

Why others are wrong: An NDA is about secrecy, not measurable security obligations. A verbal promise is not enforceable and is weak evidence for oversight or audits. Default public terms often favor the vendor and may not cover incident timing or security commitments in enough detail. The organization needs a contract mechanism that clearly states the control expectations, not just a confidentiality promise.

Answer

A non-disclosure agreement only

Answer

A verbal assurance from the account representative

Answer

The vendor's standard public terms without changes

Question 10

A company requires MFA, endpoint protection, and network filtering so that if one control misses a threat, another control still helps stop it. Which security principle is this?

Accepted Answer

Defense in depth. Defense in depth is a layered security strategy where multiple, independent controls (e.g., MFA, endpoint protection, network filtering) are deployed so that if one layer fails, another still provides protection. This ensures no single point of failure can compromise the entire system, directly matching the scenario where overlapping controls compensate for each other's gaps.

Answer

Single sign-on

Answer

Nonrepudiation

Answer

Data masking

Question 11

A company runs payroll and HR application servers on the same VLAN because a redesign is not possible this quarter. Security wants to reduce lateral movement if one workload is compromised, but the team cannot renumber the environment or add new physical firewalls. Which control best fits the requirement?

Accepted Answer

Implement microsegmentation with host-based or distributed firewall rules between workloads. Microsegmentation using host-based or distributed firewall rules (e.g., via a hypervisor firewall or host firewall policies) allows the security team to enforce zero-trust east-west traffic controls between the payroll and HR servers without changing the VLAN, subnet, or adding physical firewalls. This directly reduces lateral movement by restricting communication to only what is necessary, even though both workloads share the same Layer 2 broadcast domain.

Answer

Move the servers into a single larger subnet so internal routing is simplified

Answer

Place the servers behind a network address translation device to hide their IP addresses

Answer

Rely on password rotation and MFA for administrative logins only

Question 12

A company uses MFA, endpoint protection, firewalls, and network segmentation together to protect a customer portal. Which security principle does this best illustrate?

Accepted Answer

Defense in depth, because multiple layers protect the same asset.. Defense in depth is the correct principle because the company is deploying multiple, overlapping security controls—MFA, endpoint protection, firewalls, and network segmentation—to protect the same customer portal. This layered approach ensures that if one control fails (e.g., a firewall rule is misconfigured), other controls (e.g., endpoint detection or segmentation) still provide protection, reducing the overall risk of a single point of compromise.

Answer

Need-to-know, because users only see the data assigned to them.

Answer

Separation of duties, because no single person performs every security task.

Answer

Zero trust, because the portal is hosted in the cloud.

Question 13

A company wants guest laptops on Wi-Fi to reach the internet, but not internal file servers or printers. Which two changes best support that design? Select two.

Accepted Answer

Place guest devices in a separate VLAN or subnet from employee devices.. Placing guest devices in a separate VLAN or subnet (Option A) is a fundamental network segmentation technique that isolates guest traffic from the internal corporate network at Layer 2 and Layer 3. This ensures that guest laptops cannot directly communicate with internal file servers or printers unless explicitly routed, and it allows the administrator to apply distinct security policies to the guest subnet.

Answer

Put guests on the same VLAN as employees and rely on stronger Wi-Fi passwords.

Answer

Disable SSID broadcast so guests cannot discover the network name.

Answer

Allow guest devices to use the same DHCP scope as internal endpoints.

Question 14

A company wants visibility into who changed settings in its cloud account and what commands ran on a cloud VM. Which two log sources should the team enable first? Select two.

Accepted Answer

Cloud provider audit or API logs. Cloud provider audit or API logs (Option A) capture all changes made to the cloud account via the provider's management plane, including who modified settings and when. Guest operating system event logs (Option B) record commands executed within the VM itself, such as PowerShell or bash commands, providing visibility into runtime activities. Together, these two sources cover both the control plane (account-level changes) and data plane (VM-level commands) for comprehensive monitoring.

Answer

Printer spooler logs

Answer

Browser history from employees' home PCs

Answer

DHCP lease logs from the office router

Question 15

A contractor signs in to a project portal that fronts several SaaS tools. Access must be granted only if all of the following are true: the user is assigned to the project, the device is managed, and the request occurs during the approved maintenance window. Which access model best supports this requirement?

Accepted Answer

Attribute-based access control because multiple runtime attributes determine access. Attribute-based access control (ABAC) evaluates multiple runtime attributes—such as user-project assignment, device management status, and time of request—against policies to grant access. This matches the requirement because all three conditions must be true simultaneously, and ABAC can combine subject, resource, and environment attributes in a single policy rule. Role-based access control (RBAC) would only check the user's role, not device or time attributes.

Answer

Role-based access control because the contractor has one project role

Answer

Single sign-on because the user should not log in more than once

Answer

Privileged access management because the contractor needs temporary access

SY0-701 Practice Test 41 — 15 Questions

Exhibit

SY0-701 Practice Test 41 — 15 Questions

Exhibit