SY0-701 Practice Test 44 — 15 Questions

Question 1

After a user signs in, a file server checks whether they can edit a shared folder. Which AAA concept is being applied?

Accepted Answer

Authorization. The file server is checking whether the authenticated user has the specific permission to edit the shared folder. This is the definition of authorization: determining what an authenticated user is allowed to do. Authentication (A) only verifies identity, not rights; accounting (C) tracks usage; encryption (D) protects data in transit or at rest.

Answer

Authentication

Answer

Accounting

Answer

Encryption

Question 2

A vendor-supported application cannot be patched for 30 days, but the business must keep it online. What is the best short-term risk treatment?

Accepted Answer

Apply a compensating control, such as restricting access and monitoring traffic. When a known vulnerability cannot be patched immediately, applying a compensating control—such as restricting network access via firewall rules (e.g., allowing only specific source IPs) and enabling deep packet inspection (DPI) or an intrusion prevention system (IPS) to monitor for exploit attempts—reduces the risk to an acceptable level without taking the application offline. This approach aligns with the principle of defense in depth, buying time until the vendor patch is available.

Answer

Accept the risk without any additional controls

Answer

Delete the application so the vulnerability no longer exists

Answer

Transfer the risk by telling users to work faster

Question 3

Based on the exhibit, what type of malware is most likely present?

Accepted Answer

Ransomware, because the files are being renamed and recovery copies are being deleted.. The exhibit shows files being renamed with a new extension and recovery copies (shadow copies) being deleted via vssadmin.exe. This is a classic ransomware behavior: encrypting user files and removing Volume Shadow Copy backups to prevent recovery without the attacker's key. Ransomware specifically targets document files and system restore points to maximize extortion leverage.

Answer

Adware, because documents are no longer opening correctly.

Answer

Rootkit, because the system is using a command-line utility.

Answer

Spyware, because the attacker wants to read user documents.

Question 4

Based on the exhibit, which document type should define the exact encryption algorithm and minimum key length for all company laptops?

Accepted Answer

Standard. A Standard defines mandatory, specific technical requirements such as the exact encryption algorithm (e.g., AES-256) and minimum key length (e.g., 256 bits) that must be enforced on all company laptops. Policies are high-level statements of intent, while Standards provide the measurable, enforceable criteria to implement that intent. In this context, the encryption algorithm and key length are precise technical specifications, not general guidance or step-by-step instructions.

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 5

A contractor connects a personal tablet to a lobby Ethernet jack. The network team wants the device blocked from internal resources until it passes posture checks and only guest access is allowed meanwhile. Which control best fits?

Accepted Answer

Network access control that verifies the device before granting access.. Network Access Control (NAC) is the correct solution because it enforces security policies by checking a device's compliance (e.g., antivirus, patch level) before granting access to internal resources. In this scenario, the contractor's tablet is initially placed on a guest VLAN with internet-only access until posture checks pass, which is a core NAC function (e.g., using 802.1X or MAC authentication bypass).

Answer

A data loss prevention platform that inspects file transfers.

Answer

A network intrusion detection system placed inline at the switch.

Answer

A VPN concentrator that encrypts remote traffic back to headquarters.

Question 6

During onboarding, a manager wants a document that explains how to request access to a shared drive, who approves it, and what the help desk must do after approval. Which document type is MOST appropriate?

Accepted Answer

Procedure, because it provides the ordered steps for requesting and fulfilling access.. A procedure is the correct document type because it specifies the exact ordered steps for requesting access to a shared drive, the approval authority, and the help desk's post-approval actions. Unlike a policy, which states high-level security principles, a procedure provides the operational workflow needed for onboarding tasks.

Answer

Guideline, because it describes optional best practices for access requests.

Answer

Policy, because it names the general security principle without implementation detail.

Answer

Standard, because it should define every case-specific approval path in the organization.

Question 7

EDR flags encoded PowerShell launched by a spreadsheet application, followed by an attempt to access LSASS and outbound HTTPS traffic to a rare domain. What should the analyst do first from the EDR console?

Accepted Answer

Isolate the endpoint from the network while keeping it powered on. Isolating the endpoint from the network while keeping it powered on preserves volatile evidence (e.g., running processes, memory contents) and prevents the attacker from exfiltrating data or establishing further C2 communication. The EDR console allows immediate network isolation without losing the ability to perform live forensics or memory analysis. This aligns with the incident response priority of containment before eradication or recovery.

Answer

Reboot the endpoint to terminate the suspicious processes

Answer

Uninstall the spreadsheet application immediately

Answer

Block the rare domain and close the alert

Question 8

An engineering team requests a 30-day exception to use an unsupported browser plug-in on two workstations so a customer deliverable can be finished. Security agrees the business need is legitimate, but wants to reduce exposure. What must be included before the exception is approved?

Accepted Answer

A documented exception with an end date, compensating controls, and approval by the risk owner.. A documented exception with a defined end date, compensating controls, and risk-owner approval is the correct approach. Security exceptions should be controlled, reviewable, and temporary whenever possible. That structure shows the business need was acknowledged while ensuring someone has formally accepted the residual risk and the organization can reassess the exception before it becomes indefinite.

Why others are wrong: A verbal approval is not enough for auditability or accountability. A standing waiver without a review date can quietly become permanent and increase exposure. A guideline does not authorize deviation from policy or provide the controls required for an exception process. The question is about formal exception handling, not informal advice.

Answer

A verbal approval from the engineering manager and no additional documentation.

Answer

A standing waiver that remains in place until the project finishes, with no review date.

Answer

A guideline reminding the team to avoid risky behavior when practical.

Question 9

A Linux server starts showing many failed SSH logins from one source IP address. Which log source should the analyst review first?

Accepted Answer

The system authentication log. The system authentication log (e.g., /var/log/auth.log or /var/log/secure) records all SSH login attempts, including failed ones, along with source IP addresses. This is the primary log source for investigating authentication failures on Linux systems, as it captures PAM (Pluggable Authentication Module) events and SSH daemon messages.

Answer

The printer spooler log

Answer

The browser history log

Answer

The backup completion log

Question 10

After a server rebuild, a Windows administrator notices several unneeded services are still enabled, including Remote Registry and Print Spooler on a server that only hosts a database. What should the administrator do to reduce attack surface and keep the build consistent?

Accepted Answer

Apply the approved secure baseline and disable unnecessary services.. Applying an approved secure baseline and disabling unnecessary services (Option B) directly reduces the attack surface by removing potential entry points like Remote Registry (which allows remote modification of the registry) and Print Spooler (which has known privilege escalation vulnerabilities, e.g., CVE-2021-34527). This also ensures build consistency by enforcing a standardized configuration across all servers, which is critical for compliance and manageability in a Windows environment.

Answer

Install additional endpoint monitoring agents to compensate for the extra services.

Answer

Increase the disk encryption key size to protect the running services.

Answer

Move the server to a different subnet and leave the configuration unchanged.

Question 11

A business owner asks the security team to compare the cost of two controls for a legacy application in dollar terms. The team estimates the annual chance of a breach, the potential loss per event, and the expected yearly loss after each control is applied. Which risk analysis approach is being used?

Accepted Answer

Quantitative risk analysis. The question describes a risk analysis that uses dollar values for the annual chance of a breach, potential loss per event, and expected yearly loss after controls are applied. This is the hallmark of quantitative risk analysis, which assigns monetary or numerical values to risk components (e.g., ALE = SLE × ARO) to compare control costs in objective financial terms. The scenario explicitly asks for a cost comparison in dollar terms, which only a quantitative approach can provide.

Answer

Qualitative risk analysis

Answer

Business impact analysis

Answer

Risk acceptance

Question 12

A user reports that their laptop is suddenly encrypting files and showing a ransom note. What should the incident response team do first?

Accepted Answer

Isolate the laptop from the network to limit spread and preserve evidence.. When a laptop suddenly encrypts files and displays a ransom note, it indicates an active ransomware infection. The incident response team's first priority is to isolate the laptop from the network to prevent the ransomware from spreading laterally to other systems and to preserve volatile evidence (e.g., memory contents, running processes) that could be lost if the system is powered off or reconnected. This aligns with the NIST SP 800-61 incident response guidelines, which emphasize containment before eradication or recovery.

Answer

Immediately restore the laptop from backup before collecting any information.

Answer

Return the laptop to the user and monitor for additional alerts.

Answer

Apply all pending software updates to the laptop while it remains online.

Question 13

A scan finds two issues: a critical flaw on a lab server reachable only through VPN, and a high-severity flaw on an internet-facing file transfer appliance with active exploitation in the wild. Which should be remediated first?

Accepted Answer

The internet-facing file transfer appliance, because exploitability and exposure increase risk.. The internet-facing file transfer appliance with active exploitation in the wild presents a higher risk because it is directly exposed to untrusted networks and has a known exploit that attackers are actively using. Even though the lab server has a critical severity rating, its reachability only through VPN significantly reduces its attack surface and likelihood of exploitation. Risk is a function of both severity and exploitability/exposure, so the actively exploited, internet-facing asset should be remediated first.

Answer

The lab server, because critical severity is always higher than high severity.

Answer

Both issues at the same time, because prioritization is unnecessary when two findings are present.

Answer

The lab server, because systems behind VPN are always more trusted than public systems.

Question 14

After restoring a virtual file server from backup, users can browse folders, but an accounting application reports missing recent transactions. What should the administrator do next?

Accepted Answer

Verify the restore in an isolated test environment and compare application data consistency. The correct next step is to verify the restore in an isolated test environment and compare application data consistency. Although the file server is reachable and folders appear intact, the accounting application's missing recent transactions indicate that the restored data may be stale or incomplete. Testing in isolation ensures the application's database or transaction logs are consistent with the backup point before returning the server to production, preventing data corruption or loss.

Answer

Mark the restore complete because the file server is reachable

Answer

Immediately run a new full backup over the restored server

Answer

Disable the accounting application permanently to prevent further inconsistency

Question 15

A company is placing a customer-facing web application behind a new security control. The team wants to block malicious HTTP requests such as injection attempts before they reach the application server, with minimal code changes to the app itself. Which control is the best fit?

Accepted Answer

Web application firewall (WAF) in front of the application.. A web application firewall (WAF) is specifically designed to inspect and filter HTTP/HTTPS traffic at the application layer (Layer 7), blocking malicious payloads such as SQL injection and cross-site scripting (XSS) before they reach the web server. It operates without requiring changes to the application code, making it the ideal choice for this scenario.

Answer

Network access control (NAC) at the switch port.

Answer

Data loss prevention (DLP) on the email gateway.

Answer

Endpoint detection and response (EDR) on the web server only.