SY0-701 Practice Test 42 — 15 Questions

Question 1

A critical vulnerability is discovered on an internet-facing VPN appliance that cannot be patched for six weeks because the vendor has not released a fix. The VPN service must remain available. What is the best operational response?

Accepted Answer

Apply compensating controls such as restricting source IPs and increasing monitoring.. Option B is correct because when a vulnerability cannot be patched immediately, compensating controls such as restricting source IPs via ACLs and increasing monitoring (e.g., enabling detailed logging and alerting on anomalous traffic) reduce the attack surface and improve detection of exploitation attempts. This approach maintains service availability while mitigating risk until the vendor releases a fix.

Answer

Leave the appliance unchanged until the vendor releases a patch.

Answer

Disable all logging so the appliance performs better under load.

Answer

Replace the VPN with a less secure remote access method to avoid the vulnerability.

Question 2

A customer portal must keep operating if one application server fails and also remain available if an entire site goes offline. Management is willing to pay more for automatic failover and the shortest possible interruption. Which design is best?

Accepted Answer

An active-active deployment across two sites with load balancing and replicated data.. An active-active deployment across two sites with load balancing and replicated data ensures continuous operation if one application server fails and also if an entire site goes offline. Load balancers distribute traffic to healthy servers, and synchronous data replication keeps both sites consistent, enabling automatic failover with minimal interruption. This design meets the requirement for the shortest possible interruption because failover is instantaneous and does not require manual intervention or data restoration.

Answer

A cold site that restores from nightly backups after a failure.

Answer

A single active site with one standby server in the same rack.

Answer

RAID 1 on the database server with no additional redundancy.

Question 3

A customer service application shows the same session ID being used from two countries within five minutes. The legitimate user did not report a password change, but an order shipping address was modified successfully without reauthentication. What attack pattern is most likely?

Accepted Answer

Session abuse, because a stolen or replayed session token allowed unauthorized actions.. The simultaneous use of the same session ID from two different countries within five minutes, combined with a successful address change without reauthentication, indicates that an attacker has obtained and reused the legitimate user's session token. This is session abuse, where the attacker leverages a stolen or replayed session token to perform unauthorized actions, bypassing the need for credentials or reauthentication.

Answer

Broken authentication, because the application failed to verify the user again.

Answer

Cross-site request forgery, because the attacker may have tricked the browser into sending a request.

Answer

Credential stuffing, because the account was likely accessed using reused passwords.

Question 4

A defense contractor is deploying a new document management system that will store classified military intelligence. The security policy requires that user access to each document is strictly determined by the document's classification label (e.g., Confidential, Secret, Top Secret) and the user's verified security clearance level. Furthermore, system administrators must not be able to change these access rules or grant themselves access to documents above their clearance. Which access control model is best suited for this requirement?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) is the correct choice because it enforces access decisions based on security labels (e.g., classification levels) and user clearances, which are centrally managed and cannot be overridden by users or administrators. In this scenario, the system must strictly enforce that a user's clearance level matches or exceeds the document's classification label, and administrators cannot modify these rules or elevate their own access—a core property of MAC systems like SELinux or those implementing Bell-LaPadula.

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)

Question 5

A desktop engineering team needs the document that sets the mandatory minimum password length and screen-lock timeout for all company laptops. Which document type should they use?

Accepted Answer

Standard. A standard specifies mandatory technical requirements, such as minimum password length and screen-lock timeout, that must be implemented on all company laptops. Unlike a policy, which is high-level and states management intent, a standard provides the specific, enforceable configuration settings. This aligns with the desktop engineering team's need for a document that dictates exact technical parameters.

Answer

Policy

Answer

Guideline

Answer

Procedure

Question 6

A development team deploys a Linux web server on an IaaS cloud VM. The cloud provider secures the datacenter, hardware, and hypervisor. Which control remains the organization's responsibility?

Accepted Answer

Apply OS patches and harden services running inside the virtual machine.. In an IaaS model, the provider handles the physical infrastructure, storage, networking foundation, and hypervisor layer. The customer remains responsible for what runs on the VM, including the guest operating system, services, configuration, and application patching. Hardening the server inside the VM is therefore the correct answer because it is one of the core customer responsibilities in this cloud model.

Why others are wrong: Physical badge access and hypervisor patching are provider duties in IaaS, so the customer cannot rely on those as their own control. Replacing the provider backbone is outside the scope of the customer’s operational responsibility and is not how shared responsibility works. The question asks for the organization’s remaining duty, which is securing the guest OS and its applications.

Answer

Monitor physical badge access at the provider facility.

Answer

Replace the provider's network backbone with a private carrier circuit.

Answer

Ensure the hypervisor is updated before every release cycle.

Question 7

A development team is moving a regulated application to a cloud platform. The security architect wants the strongest practical separation from other customers without buying and operating physical servers. Which hosting option is most appropriate?

Accepted Answer

A dedicated host or isolated compute offering from the cloud provider.. A dedicated host or isolated compute offering (option B) provides the strongest practical separation because it ensures the application runs on a physical server dedicated solely to that customer, preventing any resource sharing or potential side-channel attacks from other tenants. This meets the regulatory requirement for strong isolation without the cost and operational overhead of purchasing and managing physical servers on-premises.

Answer

A shared multi-tenant environment with no additional security configuration.

Answer

Any public object storage service because the data will be encrypted by default.

Answer

A remote desktop service on the cheapest shared instance available.

Question 8

A development team updates a third-party software library used by its web application. After the release, new deployments begin making unexpected outbound connections to an unfamiliar domain. What type of threat is most likely?

Accepted Answer

Dependency compromise. The correct answer is A, dependency compromise. This scenario describes a supply chain attack where a third-party library has been maliciously altered or replaced, causing the web application to make unauthorized outbound connections to an attacker-controlled domain. Such compromises often occur when developers unknowingly integrate a tampered version of a library from a compromised repository or via a typosquatting attack, leading to data exfiltration or command-and-control (C2) communication.

Answer

Phishing

Answer

Rootkit infection

Answer

Password spraying

Question 9

A DevOps team stores container images in a registry before deployment. Which two practices reduce the chance of deploying a risky image? Select two.

Accepted Answer

Scan images for known vulnerabilities before they are promoted to production.. Option A is correct because scanning container images for known vulnerabilities (e.g., using tools like Trivy or Clair) identifies CVEs in the OS packages or application dependencies before the image reaches production. This proactive check prevents deploying images with exploitable flaws, aligning with secure software supply chain practices. Option B is correct because using trusted minimal base images (e.g., Alpine or distroless) reduces the attack surface, and removing unnecessary packages eliminates potential vulnerabilities from unused components, following the principle of least functionality.

Answer

Run containers as root by default to simplify troubleshooting.

Answer

Mount the host operating system filesystem into every container.

Answer

Deploy images using the latest tag without reviewing version history.

Question 10

A file server is actively renaming documents and generating ransom notes. The server hosts a shared drive used by finance, and users are still online. What is the best immediate action?

Accepted Answer

Isolate the server from the network to contain the spread while preserving evidence.. Option B is correct because isolating the server from the network stops the ransomware from encrypting more files or spreading laterally, while preserving volatile evidence (e.g., running processes, memory contents) needed for forensic analysis. In a live incident, immediate disconnection (not shutdown) is the standard containment step per NIST SP 800-61 and SANS incident response guidelines, as it halts the attack without destroying data in memory or logs.

Answer

Shut the server down immediately to stop all activity as fast as possible.

Answer

Restore the file server from backup before checking whether the infection is still active.

Answer

Run a full antivirus scan and wait for the results before taking any other action.

Question 11

A file-conversion API accepts a URL to generate a preview image. An attacker submits a URL for the cloud metadata service at 169.254.169.254 and receives instance credentials in the preview output. What attack is this?

Accepted Answer

Server-side request forgery. The attack is Server-Side Request Forgery (SSRF) because the attacker manipulates the file-conversion API into making an outbound HTTP request to an internal IP address (169.254.169.254, the cloud metadata service). The API then returns the metadata (including instance credentials) in the generated preview image, exploiting the server's trust to access internal resources that are not directly accessible from the internet.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Command injection

Question 12

A finance analyst receives an email that appears to come from the CFO. It references a real project, asks for an urgent wire transfer to a "new vendor account," and says to avoid the normal approval workflow because the deal is time-sensitive. What is the best immediate response?

Accepted Answer

Verify the request using a known-good contact method and report the message as suspicious.. The best response is to verify the request through a known, trusted communication path and then report it. In a spear phishing or business email compromise scenario, the attacker relies on urgency, authority, and familiarity to bypass normal controls. A separate phone call, chat message, or in-person confirmation using an existing contact list provides stronger assurance than any reply to the suspicious email itself.

Why others are wrong: Replying, processing the transfer, or forwarding the message all keep the workflow inside the attacker’s channel and increase the chance of fraud. None of those actions independently validate the sender’s identity or the payment change request. The key security habit is to stop, verify outside the email thread, and escalate the suspicious communication.

Answer

Reply to the email asking for additional payment details and wait for a response.

Answer

Process the transfer quickly because the message appears to come from an executive.

Answer

Forward the email to another finance employee so someone else can confirm the request.

Question 13

A finance app uses the corporate IdP for authentication. A user who moved out of finance can still approve invoices until the browser session expires, and the app caches local roles. Which two changes best make access changes take effect faster without storing app passwords? Select two.

Accepted Answer

Shorten token and session lifetimes, and require reauthentication for high-risk actions.. Option A is correct because shortening token and session lifetimes reduces the window during which stale permissions remain active, and requiring reauthentication for high-risk actions (like approving invoices) ensures that the user's current authorization status is verified before sensitive operations. This directly addresses the problem of cached roles persisting beyond the user's actual group membership changes.

Answer

Increase password complexity but keep session duration unchanged.

Answer

Disable SSO and email one-time passwords for every login.

Answer

Keep long-lived sessions to reduce help desk tickets.

Question 14

A finance application has a known vulnerability in a third-party reporting component. The vendor says a patch will not be available for six months, but the business cannot stop using the application. What is the BEST risk treatment for the organization to pursue next?

Accepted Answer

Mitigate the risk by adding compensating controls and tracking residual risk until the patch is available.. Option B is correct because when a known vulnerability exists in a third-party component and patching is delayed, the best risk treatment is to implement compensating controls (such as network segmentation, WAF rules, or input validation) to reduce the likelihood or impact of exploitation. This approach allows the business to continue operations while actively tracking residual risk until the vendor releases the patch. It aligns with the NIST risk management framework, which prioritizes mitigation when avoidance is not feasible.

Answer

Avoid the risk by shutting down the finance application immediately.

Answer

Transfer the risk by asking the vendor to guarantee that no incident will occur.

Answer

Accept the risk because any delay in patching is automatically low priority.

Question 15

A finance application works normally for weeks after a contractor leaves the company. On the first business day of the quarter, a hidden task runs, deletes archived reports, and then removes itself from the scheduled task list. What type of malware behavior is this?

Accepted Answer

Logic bomb. The malware behavior described is a logic bomb because it lies dormant for a specific period (weeks) and triggers on a predefined condition (the first business day of the quarter) to execute a malicious payload (deleting archived reports) and then self-destructs by removing itself from the scheduled task list. This matches the definition of a logic bomb: malicious code that executes when a logical condition is met, often used for sabotage or delayed attacks.

Answer

Worm

Answer

Rootkit

Answer

Spyware