SY0-701 Practice Test 43 — 15 Questions

Question 1

Based on the exhibit, what is the most likely SOC conclusion and next action?

A scheduled alert fired on a server that repeatedly connects to a vendor update site at fixed intervals. The security team wants to know whether the alert represents a real threat or a harmless operational pattern.

Accepted Answer

Classify the alert as a likely false positive, verify it against the maintenance record, and tune the rule.. The scheduled alert firing at fixed intervals to a known vendor update site strongly suggests a legitimate update or heartbeat mechanism, not malicious C2 traffic. Option B correctly directs the analyst to verify against maintenance records (confirming the pattern is expected) and then tune the rule to reduce future false positives, which is the standard SOC workflow for benign scheduled activity.

Answer

Treat the activity as confirmed command-and-control traffic and isolate the server immediately.

Answer

Assume DNS poisoning is occurring and immediately flush the DNS cache on every endpoint.

Answer

Open a credential theft incident and reset all administrator passwords across the environment.

Question 2

An HR department wants each employee to access only the systems required for their job. A new hire should receive the same permissions as other HR specialists, and changes to the role should update access centrally. Which access model should be used?

Accepted Answer

Role-based access control (RBAC). Role-based access control (RBAC) is the correct model because it assigns permissions based on job roles (e.g., HR specialist), ensuring that a new hire automatically inherits the same access as others in that role. Centralized role management allows changes to the role's permissions to propagate to all members, meeting the requirement for centralized updates.

Answer

Attribute-based access control (ABAC)

Answer

Multi-factor authentication (MFA)

Answer

Privileged access management (PAM)

Question 3

Several employees reported a text message that looked like it came from the VPN support team and linked to a fake sign-in page. Management wants to reduce future success of these attacks and improve how quickly users report suspicious messages. What should the security team implement?

Accepted Answer

Run role-based smishing simulations and provide a simple reporting workflow. Smishing simulations train users to recognize phishing SMS attacks in a controlled environment, directly reducing susceptibility. A simple reporting workflow (e.g., a dedicated email address or button in the messaging app) lowers the friction for users to report suspicious messages, enabling faster incident response. This combination addresses both the reduction of attack success and the improvement of reporting speed.

Answer

Send one annual lecture to all staff and close the ticket

Answer

Disable text messaging for every employee mobile device

Answer

Require managers to approve every external message before users open it

Question 4

A help desk ticket reports that a user's Microsoft 365 mailbox sent hundreds of messages to external contacts, and the user says they are still receiving MFA prompts they did not start. The attacker may still have an active web session. What is the best first containment action?

Accepted Answer

Revoke the account's active sessions and reset the password immediately.. The user is still receiving unsolicited MFA prompts, indicating an attacker likely has an active web session with a valid token. Revoking all active sessions immediately invalidates any existing tokens or cookies, while resetting the password ensures the attacker cannot re-authenticate. This is the fastest way to cut off the attacker's access and stop further abuse of the mailbox.

Answer

Delete the suspicious sent messages and close the ticket.

Answer

Wait until the end of the workday to avoid interrupting the user.

Answer

Reimage the user's laptop before touching the email account.

Question 5

A customer portal must keep operating if one application server fails and also remain available if an entire site goes offline. Management is willing to pay more for automatic failover and the shortest possible interruption. Which design is best?

Accepted Answer

An active-active deployment across two sites with load balancing and replicated data.. An active-active deployment across two sites with load balancing and replicated data ensures continuous operation if one application server fails and also if an entire site goes offline. Load balancers distribute traffic to healthy servers, and synchronous data replication keeps both sites consistent, enabling automatic failover with minimal interruption. This design meets the requirement for the shortest possible interruption because failover is instantaneous and does not require manual intervention or data restoration.

Answer

A cold site that restores from nightly backups after a failure.

Answer

A single active site with one standby server in the same rack.

Answer

RAID 1 on the database server with no additional redundancy.

Question 6

A file server suddenly renames documents with a new extension and displays a note demanding payment in cryptocurrency to restore access. What type of malware is most likely involved?

Accepted Answer

Ransomware. Ransomware is designed to encrypt files on a system, making them inaccessible, and then demand a ransom—typically in cryptocurrency—to restore access. The sudden renaming of documents with a new extension is a hallmark of ransomware encryption, as it appends a custom extension to indicate the files have been locked. The displayed note demanding payment confirms the extortion motive, which is unique to ransomware among the given options.

Answer

Spyware

Answer

Worm

Answer

Rootkit

Question 7

Which document tells all employees what they are allowed and not allowed to do when using company systems?

Accepted Answer

Policy. A policy is a high-level document that defines mandatory rules and expectations for employee behavior when using company systems. It specifies what is allowed and prohibited, such as acceptable use of email, internet browsing, and data handling, and is enforceable with consequences for non-compliance.

Answer

Procedure

Answer

Standard

Answer

Guideline

Question 8

The help desk needs a document that describes the exact steps for verifying a caller and resetting a password. What type of document should they use?

Accepted Answer

Procedure. A procedure provides the exact, step-by-step instructions needed for a specific task, such as verifying a caller's identity and resetting a password. This is distinct from a policy, which states high-level rules, or a standard, which defines mandatory technical requirements. The help desk needs a documented sequence of actions, which is the definition of a procedure.

Answer

Policy

Answer

Standard

Answer

Guideline

Question 9

After reviewing a risk memo, the operations director signs off on continuing to use an older application because the cost of replacement is too high right now. Which risk management action did the director take?

Accepted Answer

Risk acceptance, because management chose to live with the remaining risk.. The operations director chose to continue using the older application despite the identified risk, explicitly because the cost of replacement was too high. This is the definition of risk acceptance: management acknowledges the risk and decides to tolerate the residual risk without implementing additional controls. The director did not transfer, avoid, or mitigate the risk; they accepted it as a cost of business.

Answer

Risk transfer, because the risk was moved to another company.

Answer

Risk avoidance, because the application is still being used.

Answer

Risk mitigation, because the replacement cost was too high.

Question 10

Based on the exhibit, what is the BEST remediation for the application flaw shown?

A user-controlled parameter is being passed to a shell command on the server. The application is intended to test connectivity to approved internal hosts only.

Accepted Answer

Replace the shell call with a safe library function and strictly allowlist approved host values.. The application flaw is command injection: a user-controlled parameter is passed directly to a shell command (e.g., `ping`). The best remediation is to replace the shell call with a safe library function (e.g., `InetAddress.isReachable()` in Java or a dedicated ICMP library) and strictly allowlist approved internal host values, eliminating the possibility of injecting arbitrary commands like `; rm -rf /`.

Answer

Keep the current shell command, but add HTML encoding to the response page.

Answer

Increase the web server timeout so the ping utility has more time to complete.

Answer

Require users to authenticate before they can access the page.

Question 11

A SOC analyst receives an alert that a domain admin account authenticated to a file server at 02:14 from a jump host that is normally used only by the infrastructure team. The Windows logs also show a scheduled task launching a backup script at the same time, and the backup team says the task was created during yesterday's change window. What is the best next step to determine whether this is a false positive?

Accepted Answer

Correlate the authentication event with the change ticket and the scheduled task details.. The alert involves a domain admin authentication from a jump host at an unusual time, but the scheduled task was created during a change window. Correlating the authentication event with the change ticket and the scheduled task details allows the SOC analyst to verify if the activity was authorized, preventing unnecessary incident response. This step aligns with the incident response process of validating alerts before taking action.

Answer

Disable the domain admin account immediately and wait for the backup team to respond.

Answer

Escalate the alert as confirmed compromise because the login occurred after hours.

Answer

Delete the scheduled task so it cannot be used again.

Question 12

A company wants every corporate laptop to use the same required screen-lock timeout, disk encryption setting, and local administrator restriction. Which document should define these mandatory settings?

Accepted Answer

A standard, because it specifies required configuration values. A standard is the correct document type because it mandates specific, measurable configuration values (e.g., screen-lock timeout of 300 seconds, AES-256 disk encryption, removal of local admin rights) that all corporate laptops must enforce. Standards are binding and establish a baseline for security compliance, unlike guidelines which are advisory. This aligns with the company's requirement for mandatory, uniform settings across all devices.

Answer

A guideline, because it offers flexible suggestions for users

Answer

A procedure, because it explains the business reason for security rules

Answer

A memo, because it is the fastest way to communicate changes

Question 13

A help desk team wants guest Wi-Fi users to access only the internet and nothing on the internal corporate network. Which control should the network team implement at the wireless edge?

Accepted Answer

An ACL or firewall rule set that blocks guest network access to internal subnets. To prevent guest Wi-Fi users from accessing the internal corporate network while allowing internet access, the network team must implement an ACL or firewall rule set at the wireless edge. This control explicitly blocks traffic from the guest VLAN/subnet to internal subnets (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) while permitting outbound traffic to the internet. This is a fundamental network segmentation technique that enforces the principle of least privilege at Layer 3/4.

Answer

A single shared password for all guest users

Answer

A stronger DNS server

Answer

A longer Wi-Fi passphrase rotated monthly

Question 14

A workstation opens an attachment labeled as an invoice and then begins creating scheduled tasks, disabling security services, and contacting a known malicious IP address. What is the best first containment action?

Accepted Answer

Isolate the workstation from the network using the EDR containment feature. The workstation is actively communicating with a known malicious IP address and disabling security services, indicating an active compromise. Isolating the workstation via EDR containment immediately stops the outbound command-and-control traffic and prevents lateral movement, which is the priority first step in incident response before any remediation or analysis.

Answer

Run a full antivirus scan while leaving the system connected

Answer

Reboot the workstation to clear any active malicious processes

Answer

Uninstall the email client that delivered the attachment

Question 15

Based on the exhibit, which architecture best meets the goal of keeping the order service running if one application server fails?

Accepted Answer

Run the application servers active-active behind the load balancer.. An active-active architecture behind a load balancer ensures that if one application server fails, the load balancer automatically redirects traffic to the remaining healthy server(s). This provides high availability and fault tolerance without manual intervention, keeping the order service running continuously.

Answer

Use one active server with a warm standby server that is started manually during outages.

Answer

Store the application binaries on RAID 1 disks to prevent service interruption.

Answer

Take nightly backups of the application servers and restore them after a failure.