SY0-701 Practice Test 42 — 15 Questions

Question 1

Based on the exhibit, what is the best immediate action for the SOC or IR team?

A finance workstation shows evidence of a macro-launched script, followed by file renaming and lateral SMB traffic to two other hosts. The team has not yet determined the full scope of the incident.

Accepted Answer

Isolate the host from the network and revoke its remote access to stop further spread.. The exhibit shows a macro-launched script, file renaming, and lateral SMB traffic to two other hosts, indicating active lateral movement. Isolating the host (e.g., via network access control or disabling the switch port) immediately stops the spread of the malware to other systems, preserving the ability to investigate without further compromise. This aligns with the first step in incident response: containment before eradication or recovery.

Answer

Restore the workstation from backup immediately before preserving any evidence.

Answer

Run a vulnerability scan against the subnet to see whether the malware exploited an unpatched service.

Answer

Notify users to ignore the issue until the next maintenance window because the incident is likely self-limiting.

Question 2

Based on the exhibit, what should be implemented to reduce the blast radius if a backup server is compromised later?

Backup job configuration:
algorithm=AES-256-GCM
key_file=/opt/backup/key.bin
rotation=disabled
same_key_for_all_sites=true
backup_media copied to an offsite vault each night

Accepted Answer

Use envelope encryption with unique data encryption keys protected by a KMS-managed key encryption key.. Envelope encryption with unique data encryption keys (DEKs) protected by a KMS-managed key encryption key (KEK) ensures that even if the backup server is compromised, the attacker cannot decrypt all backups because each backup uses a different DEK, and the KEK is stored externally in a KMS. This limits the blast radius to only the data encrypted with the compromised DEK, rather than exposing all historical backups encrypted with a single static key.

Answer

Store the same key in a password-protected ZIP archive on the backup server.

Answer

Replace AES with SHA-256 so the files cannot be opened directly.

Answer

Keep one key forever and increase the backup frequency.

Question 3

A regulated workload must run in the cloud with the strongest possible isolation from other tenants, and the company wants to avoid managing its own physical hardware. Which placement is the best fit?

Accepted Answer

Use a dedicated host so the underlying hardware is allocated to one customer only.. A dedicated host provides the strongest possible isolation by ensuring that the physical server is not shared with any other tenant. This meets the requirement for a regulated workload without the company managing its own hardware, as the cloud provider still handles maintenance and patching.

Answer

Use a shared tenancy instance with tighter security groups and a private subnet.

Answer

Move the workload into a public subnet so the provider can inspect traffic more easily.

Answer

Use a container within a shared platform because containers always isolate tenants completely.

Question 4

A SaaS vendor supports both browser access and a mobile app. The company wants employees to sign in with corporate credentials, avoid separate passwords for each app, and use token-based authentication that works well with modern APIs. Which integration should the architect choose?

Accepted Answer

OpenID Connect federation with the corporate identity provider.. OpenID Connect (OIDC) is the correct choice because it is an identity layer built on top of OAuth 2.0, designed for token-based authentication that works seamlessly with modern REST APIs and mobile apps. It allows employees to sign in with corporate credentials via the corporate identity provider (IdP), eliminates separate app passwords, and issues ID tokens (JWT) and access tokens that the SaaS vendor can validate without browser redirects.

Answer

SAML federation to the SaaS vendor using browser assertions only.

Answer

LDAP bind authentication directly against each SaaS application.

Answer

Kerberos tickets issued directly by the SaaS vendor.

Question 5

A vulnerability scan identifies a critical patch for a fleet of internet-facing servers. The operations lead wants to apply it immediately during peak business hours because the exploit is public. What is the BEST next step?

Accepted Answer

Use the emergency change process with testing, approval, and a rollback plan. An emergency change process allows the critical patch to be applied quickly while still incorporating essential steps like testing, approval, and a rollback plan. This balances the urgency of a public exploit with the need to avoid unintended service disruptions during peak business hours, aligning with change management best practices in Security Operations.

Answer

Install the patch on all servers immediately without testing

Answer

Wait until the next quarterly maintenance window to avoid any risk

Answer

Patch only one production server and assume the rest will be fine

Question 6

A VPN concentrator shows that an authentication request from a user was accepted twice, even though the user insists they approved only one login. Packet analysis reveals that the second successful attempt reused the same authentication blob and arrived shortly after the first. Which attack is the best fit?

Accepted Answer

Replay attack, because a captured valid authentication message was resent to gain access again.. The scenario describes a captured authentication blob being reused to gain a second successful authentication. This is the hallmark of a replay attack, where an attacker intercepts a valid authentication message (e.g., a Kerberos TGT, RADIUS Access-Accept, or a VPN pre-shared key hash) and retransmits it to the VPN concentrator to impersonate the user. The VPN concentrator accepted the duplicate because it lacked proper replay protection mechanisms such as timestamps, sequence numbers, or one-time-use nonces.

Answer

ARP poisoning, because the attacker redirected traffic by altering local address resolution.

Answer

Phishing, because the user was tricked into entering credentials on a fake page.

Answer

Denial of service, because the attacker is overwhelming the VPN gateway with requests.

Question 7

Based on the exhibit, which document type should the service desk use for the locked-account workflow?

Accepted Answer

Procedure, because it lists the exact steps analysts must follow in sequence.. A procedure document is the correct choice because it provides a step-by-step sequence of actions that service desk analysts must follow to unlock an account. The locked-account workflow requires precise, ordered steps (e.g., verifying identity, checking lockout status, resetting the account) to ensure consistency and security, which aligns with the definition of a procedure.

Answer

Policy, because it states broad rules for account access.

Answer

Standard, because it defines the minimum password requirements for all users.

Answer

Guideline, because it gives flexible suggestions for handling locked accounts.

Question 8

A development team needs to release a security fix to a customer portal, but the change must not introduce a new outage or bypass review controls. Which practice best supports a secure and repeatable release?

Accepted Answer

Use an approved pipeline with peer review, automated testing, and rollback steps. An approved pipeline with peer review, automated testing, and rollback steps ensures that the security fix is deployed in a controlled, repeatable manner. This approach prevents unauthorized changes, validates the fix through testing, and provides a safety net via rollback, directly addressing the requirement to avoid new outages and bypass review controls.

Answer

Apply the change directly in production so users get the fix immediately

Answer

Skip testing because security fixes should always be deployed quickly

Answer

Let any on-call developer approve and deploy without documentation

Question 9

After imaging laptops, the security team wants to ensure screen-lock timeouts, local admin restrictions, and USB storage controls remain consistent on every device even after users make changes. What is the best approach?

Accepted Answer

Enforce a hardened baseline with configuration management and compliance checks.. Configuration management tools (e.g., Microsoft Intune, Group Policy, or Ansible) can enforce a hardened baseline by applying settings like screen-lock timeouts, local admin restrictions, and USB storage controls. These tools also perform compliance checks to detect and remediate any drift caused by user changes, ensuring consistency across all devices.

Answer

Rely on users to follow the build sheet during setup and avoid future changes.

Answer

Increase antivirus scan frequency so policy settings do not change.

Answer

Apply full disk encryption only, since it covers all endpoint hardening needs.

Question 10

An EDR alert flags suspicious PowerShell on a finance workstation. Windows logs show the script started immediately after a patch-management tool launched from the software distribution server. The script only queries installed software and writes results to a log file. What is the most likely conclusion?

Accepted Answer

The alert is likely a false positive because the activity matches approved patch-management behavior. The EDR alert is likely a false positive because the PowerShell script's behavior—querying installed software and writing results to a log file—is consistent with legitimate patch-management inventory tasks. The script's execution immediately after the patch-management tool launched from the software distribution server indicates it was triggered by that tool as part of its normal operations, not by an attacker. Since the activity matches approved patch-management behavior and shows no signs of malicious intent (e.g., data exfiltration, lateral movement, or persistence), the alert should be investigated but is most likely a false positive.

Answer

The workstation is definitely compromised because PowerShell is always malicious

Answer

The endpoint should be immediately wiped because the script wrote to a log file

Answer

The software distribution server should be blocked from the network permanently

Question 11

Based on the exhibit, which issue should be remediated FIRST?

The team can only fully fix one issue today. Management wants the choice that best reduces real-world risk, not just the highest severity score.

Accepted Answer

Internet-facing VPN appliance. The Internet-facing VPN appliance is the highest priority because it is directly exposed to untrusted networks (the Internet), making it the most likely entry point for attackers. A compromise here could lead to full network access, bypassing all other security controls, which represents the greatest real-world risk regardless of its severity score.

Answer

Internal HR file server

Answer

Lab workstation

Answer

DMZ reporting server

Question 12

A company is placing its public web server so internet users can reach it, but the database server must stay hidden from the internet and be reachable only by the web server. Which design best supports this goal?

Accepted Answer

Place the web server in a DMZ and keep the database server on the internal network. It uses a DMZ (demilitarized zone) to isolate the public-facing web server from the internal network. The web server in the DMZ is accessible from the internet, while the database server remains on the internal network, reachable only by the web server through a firewall rule that permits traffic on the specific database port (e.g., TCP 3306 for MySQL). This layered security design prevents direct internet access to sensitive data.

Answer

Put both servers on the same flat internal network

Answer

Put the database server in the DMZ and the web server on the internal network

Answer

Disable the firewall so the web server can communicate freely with all hosts

Question 13

A team is moving a workload to infrastructure as a service (IaaS). Which two items are usually the customer's responsibility? Select two.

Accepted Answer

Patch the guest operating system running on the cloud virtual machine.. In an IaaS model, the customer is responsible for managing the guest operating system, including applying security patches and updates. This is because the cloud provider only manages the underlying physical infrastructure and hypervisor, while the customer controls the OS and applications running on the virtual machine.

Answer

Replace failed power supplies in the cloud provider's data center.

Answer

Maintain the cloud provider's hypervisor firmware.

Answer

Manage the physical firewall blades inside the provider's facility.

Question 14

An employee notices that a contractor left a printed report containing customer data on a conference room table. What should the employee do first?

Accepted Answer

Secure the report and report the incident through the company's approved process.. The immediate priority is to protect the sensitive customer data from further unauthorized access by securing the report, and then to follow the organization's incident response policy. This aligns with the principle of data breach containment and the requirement to report security incidents through official channels to ensure proper investigation and compliance with regulations like GDPR or HIPAA.

Answer

Take a photo of the report and post it in the team chat as a warning.

Answer

Leave the report where it is so the contractor can collect it later.

Answer

Shred the report immediately without telling anyone.

Question 15

A cloud-hosted application allows users to submit a URL for image processing. Logs show repeated requests such as `http://169.254.169.254/latest/meta-data/` and `http://localhost/admin`. The server is making outbound requests on behalf of the user input. What is the best defensive control to implement?

Accepted Answer

Use a strict allowlist for outbound destinations and block link-local metadata addresses. The requests target the AWS EC2 instance metadata service (169.254.169.254) and localhost, which are classic Server-Side Request Forgery (SSRF) attacks. By using a strict allowlist for outbound destinations and explicitly blocking link-local metadata addresses, the application prevents the server from making unauthorized requests to internal or cloud metadata endpoints, thereby mitigating SSRF.

Answer

Allow any URL that returns a valid HTTP status code

Answer

Escape all quotation marks before sending the request

Answer

Require users to change their passwords after each upload