SY0-701 Practice Test 43 — 15 Questions

Question 1

Based on the exhibit, what is the BEST remediation for the application flaw shown?

A user-controlled parameter is being passed to a shell command on the server. The application is intended to test connectivity to approved internal hosts only.

Accepted Answer

Replace the shell call with a safe library function and strictly allowlist approved host values.. The application flaw is command injection: a user-controlled parameter is passed directly to a shell command (e.g., `ping`). The best remediation is to replace the shell call with a safe library function (e.g., `InetAddress.isReachable()` in Java or a dedicated ICMP library) and strictly allowlist approved internal host values, eliminating the possibility of injecting arbitrary commands like `; rm -rf /`.

Answer

Keep the current shell command, but add HTML encoding to the response page.

Answer

Increase the web server timeout so the ping utility has more time to complete.

Answer

Require users to authenticate before they can access the page.

Question 2

A SOC analyst receives an alert that a domain admin account authenticated to a file server at 02:14 from a jump host that is normally used only by the infrastructure team. The Windows logs also show a scheduled task launching a backup script at the same time, and the backup team says the task was created during yesterday's change window. What is the best next step to determine whether this is a false positive?

Accepted Answer

Correlate the authentication event with the change ticket and the scheduled task details.. The alert involves a domain admin authentication from a jump host at an unusual time, but the scheduled task was created during a change window. Correlating the authentication event with the change ticket and the scheduled task details allows the SOC analyst to verify if the activity was authorized, preventing unnecessary incident response. This step aligns with the incident response process of validating alerts before taking action.

Answer

Disable the domain admin account immediately and wait for the backup team to respond.

Answer

Escalate the alert as confirmed compromise because the login occurred after hours.

Answer

Delete the scheduled task so it cannot be used again.

Question 3

A company wants every corporate laptop to use the same required screen-lock timeout, disk encryption setting, and local administrator restriction. Which document should define these mandatory settings?

Accepted Answer

A standard, because it specifies required configuration values. A standard is the correct document type because it mandates specific, measurable configuration values (e.g., screen-lock timeout of 300 seconds, AES-256 disk encryption, removal of local admin rights) that all corporate laptops must enforce. Standards are binding and establish a baseline for security compliance, unlike guidelines which are advisory. This aligns with the company's requirement for mandatory, uniform settings across all devices.

Answer

A guideline, because it offers flexible suggestions for users

Answer

A procedure, because it explains the business reason for security rules

Answer

A memo, because it is the fastest way to communicate changes

Question 4

A help desk team wants guest Wi-Fi users to access only the internet and nothing on the internal corporate network. Which control should the network team implement at the wireless edge?

Accepted Answer

An ACL or firewall rule set that blocks guest network access to internal subnets. To prevent guest Wi-Fi users from accessing the internal corporate network while allowing internet access, the network team must implement an ACL or firewall rule set at the wireless edge. This control explicitly blocks traffic from the guest VLAN/subnet to internal subnets (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) while permitting outbound traffic to the internet. This is a fundamental network segmentation technique that enforces the principle of least privilege at Layer 3/4.

Answer

A single shared password for all guest users

Answer

A stronger DNS server

Answer

A longer Wi-Fi passphrase rotated monthly

Question 5

A workstation opens an attachment labeled as an invoice and then begins creating scheduled tasks, disabling security services, and contacting a known malicious IP address. What is the best first containment action?

Accepted Answer

Isolate the workstation from the network using the EDR containment feature. The workstation is actively communicating with a known malicious IP address and disabling security services, indicating an active compromise. Isolating the workstation via EDR containment immediately stops the outbound command-and-control traffic and prevents lateral movement, which is the priority first step in incident response before any remediation or analysis.

Answer

Run a full antivirus scan while leaving the system connected

Answer

Reboot the workstation to clear any active malicious processes

Answer

Uninstall the email client that delivered the attachment

Question 6

Based on the exhibit, which architecture best meets the goal of keeping the order service running if one application server fails?

Accepted Answer

Run the application servers active-active behind the load balancer.. An active-active architecture behind a load balancer ensures that if one application server fails, the load balancer automatically redirects traffic to the remaining healthy server(s). This provides high availability and fault tolerance without manual intervention, keeping the order service running continuously.

Answer

Use one active server with a warm standby server that is started manually during outages.

Answer

Store the application binaries on RAID 1 disks to prevent service interruption.

Answer

Take nightly backups of the application servers and restore them after a failure.

Question 7

An EDR alert shows PowerShell launching from a scheduled task, downloading encoded commands, and running them in memory. No suspicious executable is written to disk. What kind of attack is this?

Accepted Answer

A fileless attack that relies on trusted tools already on the system. This is a fileless attack because PowerShell, a trusted system tool, is used to download and execute encoded commands directly in memory without writing any malicious executable to disk. The attack leverages living-off-the-land binaries (LOLBins) and PowerShell's ability to run scripts in memory, bypassing traditional file-based detection mechanisms.

Answer

A worm that spreads by exploiting a network service

Answer

A logic bomb that waits for a specific date or event

Answer

A rootkit that changes kernel behavior to hide processes

Question 8

A SIEM correlation rule alerts when a single user account fails to authenticate 20 times in 5 minutes and then succeeds from the same source IP. What is the most likely reason the team should investigate this event?

Accepted Answer

The pattern may indicate password guessing or credential stuffing. The pattern of 20 rapid failed authentication attempts followed by a successful authentication from the same source IP is a classic indicator of a password guessing or credential stuffing attack. The attacker likely used a list of common passwords or previously compromised credentials, and the final success suggests they found a valid password. SIEM correlation rules are designed to detect such brute-force or spraying behaviors, and this event warrants immediate investigation to determine if the account is compromised.

Answer

The account was probably being used normally because the password was changed

Answer

The SIEM is misconfigured because all failed logons are false positives

Answer

The account is definitely malicious and should be deleted immediately

Question 9

After confirming malicious activity on a workstation, the incident lead wants the system cleaned up quickly. The analyst has not yet collected any volatile data. What should the analyst do before remediation begins?

Accepted Answer

Capture volatile evidence such as memory and running process information before changing the system.. Volatile data (e.g., memory contents, running processes, network connections) is lost when the system is powered off or changed. The analyst must capture this evidence first to preserve forensic artifacts that can identify the root cause, scope, and indicators of compromise (IOCs) before remediation alters the system state.

Answer

Immediately uninstall every suspicious application and delete related files.

Answer

Restore the workstation from backup before documenting the incident.

Answer

Close the incident because the malicious activity has already been confirmed.

Question 10

A critical patch must be applied to a production server next week. What is the best way to reduce the risk of downtime if the patch causes a problem?

Accepted Answer

Create a rollback plan before installing the patch. Creating a rollback plan before installing a patch ensures that if the patch causes unexpected issues, the system can be restored to its previous stable state quickly, minimizing downtime. A rollback plan typically includes steps to revert the patch, restore from a backup, or switch to a failover system, which is a fundamental change management practice in security operations.

Answer

Apply the patch during business hours so users can report issues quickly

Answer

Skip testing because critical patches are always safe

Answer

Disable logging during the patch to improve performance

Question 11

A company uses a third-party expense application and wants employees to sign in with their corporate identity once, then automatically lose access in the expense app when they are terminated in the HR system. Which solution best meets both requirements?

Accepted Answer

Implement federated single sign-on and automated user provisioning and deprovisioning.. Federated single sign-on (SSO) allows users to authenticate once using their corporate identity (e.g., via SAML or OIDC), and automated provisioning/deprovisioning (often via SCIM) ensures that when an employee is terminated in the HR system, their access to the expense app is automatically revoked. This meets both requirements: seamless sign-in and immediate loss of access upon termination.

Answer

Create separate local usernames in the expense app and synchronize passwords weekly.

Answer

Require a VPN connection before users can open the expense app.

Answer

Use a shared generic account for all employees and rotate the password monthly.

Question 12

A SIEM alert shows a workstation connecting to the same unknown internet address every 15 minutes, even after business hours. The device belongs to an employee who is on vacation. What is the best next step for the analyst?

Accepted Answer

Treat the alert as potentially malicious and check endpoint and proxy logs for more context.. The alert describes a persistent outbound connection to an unknown external IP address at regular intervals, which is a classic indicator of beaconing behavior often associated with malware command-and-control (C2) traffic. The fact that the connection occurs after business hours and the workstation's user is on vacation increases suspicion, as legitimate scheduled tasks or updates would typically not run under those conditions. Checking endpoint and proxy logs provides the necessary context to determine if the traffic is benign (e.g., a misconfigured service) or malicious (e.g., C2 communication).

Answer

Dismiss the alert because periodic connections are always normal for workstations.

Answer

Immediately delete the workstation account from the directory service.

Answer

Shut down the entire office network until the analyst can review the alert.

Question 13

A web login form returns access after a tester enters `' OR '1'='1'--` into the username field. What type of attack is this?

Accepted Answer

SQL injection. The input `' OR '1'='1'--` is a classic SQL injection payload that manipulates the SQL query logic. By injecting a single quote to break out of the string context, the `OR '1'='1'` condition makes the WHERE clause always true, and the `--` comments out the rest of the query. This bypasses authentication because the database returns a valid row, granting access without a correct password.

Answer

Cross-site scripting

Answer

Session hijacking

Answer

Insecure deserialization

Question 14

A SOC analyst confirms that a critical Linux virtual machine is making outbound connections to a known malicious IP address. The application owner says the VM hosts a revenue system that cannot be powered off without causing a major outage. What is the best containment action?

Accepted Answer

Isolate the VM at the network layer while keeping it powered on.. Network isolation (e.g., applying a firewall ACL or moving the VM to a quarantine VLAN) stops outbound malicious traffic while keeping the revenue-critical system powered on and available for forensic analysis. This balances security containment with business continuity, as shutting down the VM (Option A) would cause a major outage, and waiting (Option C) would allow continued data exfiltration or lateral movement.

Answer

Shut down the VM immediately to stop all malicious activity.

Answer

Wait for the next maintenance window before taking action.

Answer

Reimage the VM from a known-good template immediately.

Question 15

A SIEM analyst reviews the following sequence from a VPN and email platform over 15 minutes: 47 failed logins against different accounts from one public IP, one successful VPN login from that same IP, a new inbox forwarding rule to an external address, and a mailbox sign-in from a device never seen before. Which three findings most strongly support a password-spraying-to-compromise scenario? Select three.

Accepted Answer

Many failed logins across different usernames from the same source IP in a short time window.. A high volume of failed logins against multiple accounts from a single public IP within a short time window is the hallmark of a password-spraying attack, where the attacker tries a few common passwords across many usernames to avoid account lockout. This pattern is distinct from a brute-force attack, which targets a single account with many passwords.

Answer

A workstation patch installation completed earlier that day.

Answer

The mailbox server reported normal disk utilization during the same hour.