SY0-701 Practice Test 42 — 15 Questions

Question 1

An EDR alert flags suspicious PowerShell on a finance workstation. Windows logs show the script started immediately after a patch-management tool launched from the software distribution server. The script only queries installed software and writes results to a log file. What is the most likely conclusion?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The alert is likely a false positive because the activity matches approved patch-management behavior. The EDR alert is likely a false positive because the PowerShell script's behavior—querying installed software and writing results to a log file—is consistent with legitimate patch-management inventory tasks. The script's execution immediately after the patch-management tool launched from the software distribution server indicates it was triggered by that tool as part of its normal operations, not by an attacker. Since the activity matches approved patch-management behavior and shows no signs of malicious intent (e.g., data exfiltration, lateral movement, or persistence), the alert should be investigated but is most likely a false positive.

Answer

The workstation is definitely compromised because PowerShell is always malicious

Answer

The endpoint should be immediately wiped because the script wrote to a log file

Answer

The software distribution server should be blocked from the network permanently

Question 2

Based on the exhibit, which issue should be remediated FIRST?

The team can only fully fix one issue today. Management wants the choice that best reduces real-world risk, not just the highest severity score.

Accepted Answer

Internet-facing VPN appliance. The Internet-facing VPN appliance is the highest priority because it is directly exposed to untrusted networks (the Internet), making it the most likely entry point for attackers. A compromise here could lead to full network access, bypassing all other security controls, which represents the greatest real-world risk regardless of its severity score.

Answer

Internal HR file server

Answer

Lab workstation

Answer

DMZ reporting server

Question 3

A company is placing its public web server so internet users can reach it, but the database server must stay hidden from the internet and be reachable only by the web server. Which design best supports this goal?

Accepted Answer

Place the web server in a DMZ and keep the database server on the internal network. It uses a DMZ (demilitarized zone) to isolate the public-facing web server from the internal network. The web server in the DMZ is accessible from the internet, while the database server remains on the internal network, reachable only by the web server through a firewall rule that permits traffic on the specific database port (e.g., TCP 3306 for MySQL). This layered security design prevents direct internet access to sensitive data.

Answer

Put both servers on the same flat internal network

Answer

Put the database server in the DMZ and the web server on the internal network

Answer

Disable the firewall so the web server can communicate freely with all hosts

Question 4

A team is moving a workload to infrastructure as a service (IaaS). Which two items are usually the customer's responsibility? Select two.

Accepted Answer

Patch the guest operating system running on the cloud virtual machine.. In an IaaS model, the customer is responsible for managing the guest operating system, including applying security patches and updates. This is because the cloud provider only manages the underlying physical infrastructure and hypervisor, while the customer controls the OS and applications running on the virtual machine.

Answer

Replace failed power supplies in the cloud provider's data center.

Answer

Maintain the cloud provider's hypervisor firmware.

Answer

Manage the physical firewall blades inside the provider's facility.

Question 5

An employee notices that a contractor left a printed report containing customer data on a conference room table. What should the employee do first?

Accepted Answer

Secure the report and report the incident through the company's approved process.. The immediate priority is to protect the sensitive customer data from further unauthorized access by securing the report, and then to follow the organization's incident response policy. This aligns with the principle of data breach containment and the requirement to report security incidents through official channels to ensure proper investigation and compliance with regulations like GDPR or HIPAA.

Answer

Take a photo of the report and post it in the team chat as a warning.

Answer

Leave the report where it is so the contractor can collect it later.

Answer

Shred the report immediately without telling anyone.

Question 6

A cloud-hosted application allows users to submit a URL for image processing. Logs show repeated requests such as `http://169.254.169.254/latest/meta-data/` and `http://localhost/admin`. The server is making outbound requests on behalf of the user input. What is the best defensive control to implement?

Accepted Answer

Use a strict allowlist for outbound destinations and block link-local metadata addresses. The requests target the AWS EC2 instance metadata service (169.254.169.254) and localhost, which are classic Server-Side Request Forgery (SSRF) attacks. By using a strict allowlist for outbound destinations and explicitly blocking link-local metadata addresses, the application prevents the server from making unauthorized requests to internal or cloud metadata endpoints, thereby mitigating SSRF.

Answer

Allow any URL that returns a valid HTTP status code

Answer

Escape all quotation marks before sending the request

Answer

Require users to change their passwords after each upload

Question 7

Based on the exhibit, what is the most likely SOC conclusion and next action?

A scheduled alert fired on a server that repeatedly connects to a vendor update site at fixed intervals. The security team wants to know whether the alert represents a real threat or a harmless operational pattern.

Accepted Answer

Classify the alert as a likely false positive, verify it against the maintenance record, and tune the rule.. The scheduled alert firing at fixed intervals to a known vendor update site strongly suggests a legitimate update or heartbeat mechanism, not malicious C2 traffic. Option B correctly directs the analyst to verify against maintenance records (confirming the pattern is expected) and then tune the rule to reduce future false positives, which is the standard SOC workflow for benign scheduled activity.

Answer

Treat the activity as confirmed command-and-control traffic and isolate the server immediately.

Answer

Assume DNS poisoning is occurring and immediately flush the DNS cache on every endpoint.

Answer

Open a credential theft incident and reset all administrator passwords across the environment.

Question 8

An HR department wants each employee to access only the systems required for their job. A new hire should receive the same permissions as other HR specialists, and changes to the role should update access centrally. Which access model should be used?

Accepted Answer

Role-based access control (RBAC). Role-based access control (RBAC) is the correct model because it assigns permissions based on job roles (e.g., HR specialist), ensuring that a new hire automatically inherits the same access as others in that role. Centralized role management allows changes to the role's permissions to propagate to all members, meeting the requirement for centralized updates.

Answer

Attribute-based access control (ABAC)

Answer

Multi-factor authentication (MFA)

Answer

Privileged access management (PAM)

Question 9

Several employees reported a text message that looked like it came from the VPN support team and linked to a fake sign-in page. Management wants to reduce future success of these attacks and improve how quickly users report suspicious messages. What should the security team implement?

Accepted Answer

Run role-based smishing simulations and provide a simple reporting workflow. Smishing simulations train users to recognize phishing SMS attacks in a controlled environment, directly reducing susceptibility. A simple reporting workflow (e.g., a dedicated email address or button in the messaging app) lowers the friction for users to report suspicious messages, enabling faster incident response. This combination addresses both the reduction of attack success and the improvement of reporting speed.

Answer

Send one annual lecture to all staff and close the ticket

Answer

Disable text messaging for every employee mobile device

Answer

Require managers to approve every external message before users open it

Question 10

A help desk ticket reports that a user's Microsoft 365 mailbox sent hundreds of messages to external contacts, and the user says they are still receiving MFA prompts they did not start. The attacker may still have an active web session. What is the best first containment action?

Accepted Answer

Revoke the account's active sessions and reset the password immediately.. The user is still receiving unsolicited MFA prompts, indicating an attacker likely has an active web session with a valid token. Revoking all active sessions immediately invalidates any existing tokens or cookies, while resetting the password ensures the attacker cannot re-authenticate. This is the fastest way to cut off the attacker's access and stop further abuse of the mailbox.

Answer

Delete the suspicious sent messages and close the ticket.

Answer

Wait until the end of the workday to avoid interrupting the user.

Answer

Reimage the user's laptop before touching the email account.

Question 11

A customer portal must keep operating if one application server fails and also remain available if an entire site goes offline. Management is willing to pay more for automatic failover and the shortest possible interruption. Which design is best?

Accepted Answer

An active-active deployment across two sites with load balancing and replicated data.. An active-active deployment across two sites with load balancing and replicated data ensures continuous operation if one application server fails and also if an entire site goes offline. Load balancers distribute traffic to healthy servers, and synchronous data replication keeps both sites consistent, enabling automatic failover with minimal interruption. This design meets the requirement for the shortest possible interruption because failover is instantaneous and does not require manual intervention or data restoration.

Answer

A cold site that restores from nightly backups after a failure.

Answer

A single active site with one standby server in the same rack.

Answer

RAID 1 on the database server with no additional redundancy.

Question 12

A file server suddenly renames documents with a new extension and displays a note demanding payment in cryptocurrency to restore access. What type of malware is most likely involved?

Accepted Answer

Ransomware. Ransomware is designed to encrypt files on a system, making them inaccessible, and then demand a ransom—typically in cryptocurrency—to restore access. The sudden renaming of documents with a new extension is a hallmark of ransomware encryption, as it appends a custom extension to indicate the files have been locked. The displayed note demanding payment confirms the extortion motive, which is unique to ransomware among the given options.

Answer

Spyware

Answer

Worm

Answer

Rootkit

Question 13

Which document tells all employees what they are allowed and not allowed to do when using company systems?

Accepted Answer

Policy. A policy is a high-level document that defines mandatory rules and expectations for employee behavior when using company systems. It specifies what is allowed and prohibited, such as acceptable use of email, internet browsing, and data handling, and is enforceable with consequences for non-compliance.

Answer

Procedure

Answer

Standard

Answer

Guideline

Question 14

The help desk needs a document that describes the exact steps for verifying a caller and resetting a password. What type of document should they use?

Accepted Answer

Procedure. A procedure provides the exact, step-by-step instructions needed for a specific task, such as verifying a caller's identity and resetting a password. This is distinct from a policy, which states high-level rules, or a standard, which defines mandatory technical requirements. The help desk needs a documented sequence of actions, which is the definition of a procedure.

Answer

Policy

Answer

Standard

Answer

Guideline

Question 15

After reviewing a risk memo, the operations director signs off on continuing to use an older application because the cost of replacement is too high right now. Which risk management action did the director take?

Accepted Answer

Risk acceptance, because management chose to live with the remaining risk.. The operations director chose to continue using the older application despite the identified risk, explicitly because the cost of replacement was too high. This is the definition of risk acceptance: management acknowledges the risk and decides to tolerate the residual risk without implementing additional controls. The director did not transfer, avoid, or mitigate the risk; they accepted it as a cost of business.

Answer

Risk transfer, because the risk was moved to another company.

Answer

Risk avoidance, because the application is still being used.

Answer

Risk mitigation, because the replacement cost was too high.