SY0-701 Practice Test 44 — 15 Questions

Question 1

An EDR alert shows PowerShell launching from a scheduled task, downloading encoded commands, and running them in memory. No suspicious executable is written to disk. What kind of attack is this?

Accepted Answer

A fileless attack that relies on trusted tools already on the system. This is a fileless attack because PowerShell, a trusted system tool, is used to download and execute encoded commands directly in memory without writing any malicious executable to disk. The attack leverages living-off-the-land binaries (LOLBins) and PowerShell's ability to run scripts in memory, bypassing traditional file-based detection mechanisms.

Answer

A worm that spreads by exploiting a network service

Answer

A logic bomb that waits for a specific date or event

Answer

A rootkit that changes kernel behavior to hide processes

Question 2

A SIEM correlation rule alerts when a single user account fails to authenticate 20 times in 5 minutes and then succeeds from the same source IP. What is the most likely reason the team should investigate this event?

Accepted Answer

The pattern may indicate password guessing or credential stuffing. The pattern of 20 rapid failed authentication attempts followed by a successful authentication from the same source IP is a classic indicator of a password guessing or credential stuffing attack. The attacker likely used a list of common passwords or previously compromised credentials, and the final success suggests they found a valid password. SIEM correlation rules are designed to detect such brute-force or spraying behaviors, and this event warrants immediate investigation to determine if the account is compromised.

Answer

The account was probably being used normally because the password was changed

Answer

The SIEM is misconfigured because all failed logons are false positives

Answer

The account is definitely malicious and should be deleted immediately

Question 3

After confirming malicious activity on a workstation, the incident lead wants the system cleaned up quickly. The analyst has not yet collected any volatile data. What should the analyst do before remediation begins?

Accepted Answer

Capture volatile evidence such as memory and running process information before changing the system.. Volatile data (e.g., memory contents, running processes, network connections) is lost when the system is powered off or changed. The analyst must capture this evidence first to preserve forensic artifacts that can identify the root cause, scope, and indicators of compromise (IOCs) before remediation alters the system state.

Answer

Immediately uninstall every suspicious application and delete related files.

Answer

Restore the workstation from backup before documenting the incident.

Answer

Close the incident because the malicious activity has already been confirmed.

Question 4

A critical patch must be applied to a production server next week. What is the best way to reduce the risk of downtime if the patch causes a problem?

Accepted Answer

Create a rollback plan before installing the patch. Creating a rollback plan before installing a patch ensures that if the patch causes unexpected issues, the system can be restored to its previous stable state quickly, minimizing downtime. A rollback plan typically includes steps to revert the patch, restore from a backup, or switch to a failover system, which is a fundamental change management practice in security operations.

Answer

Apply the patch during business hours so users can report issues quickly

Answer

Skip testing because critical patches are always safe

Answer

Disable logging during the patch to improve performance

Question 5

A company uses a third-party expense application and wants employees to sign in with their corporate identity once, then automatically lose access in the expense app when they are terminated in the HR system. Which solution best meets both requirements?

Accepted Answer

Implement federated single sign-on and automated user provisioning and deprovisioning.. Federated single sign-on (SSO) allows users to authenticate once using their corporate identity (e.g., via SAML or OIDC), and automated provisioning/deprovisioning (often via SCIM) ensures that when an employee is terminated in the HR system, their access to the expense app is automatically revoked. This meets both requirements: seamless sign-in and immediate loss of access upon termination.

Answer

Create separate local usernames in the expense app and synchronize passwords weekly.

Answer

Require a VPN connection before users can open the expense app.

Answer

Use a shared generic account for all employees and rotate the password monthly.

Question 6

A SIEM alert shows a workstation connecting to the same unknown internet address every 15 minutes, even after business hours. The device belongs to an employee who is on vacation. What is the best next step for the analyst?

Accepted Answer

Treat the alert as potentially malicious and check endpoint and proxy logs for more context.. The alert describes a persistent outbound connection to an unknown external IP address at regular intervals, which is a classic indicator of beaconing behavior often associated with malware command-and-control (C2) traffic. The fact that the connection occurs after business hours and the workstation's user is on vacation increases suspicion, as legitimate scheduled tasks or updates would typically not run under those conditions. Checking endpoint and proxy logs provides the necessary context to determine if the traffic is benign (e.g., a misconfigured service) or malicious (e.g., C2 communication).

Answer

Dismiss the alert because periodic connections are always normal for workstations.

Answer

Immediately delete the workstation account from the directory service.

Answer

Shut down the entire office network until the analyst can review the alert.

Question 7

A web login form returns access after a tester enters `' OR '1'='1'--` into the username field. What type of attack is this?

Accepted Answer

SQL injection. The input `' OR '1'='1'--` is a classic SQL injection payload that manipulates the SQL query logic. By injecting a single quote to break out of the string context, the `OR '1'='1'` condition makes the WHERE clause always true, and the `--` comments out the rest of the query. This bypasses authentication because the database returns a valid row, granting access without a correct password.

Answer

Cross-site scripting

Answer

Session hijacking

Answer

Insecure deserialization

Question 8

A SOC analyst confirms that a critical Linux virtual machine is making outbound connections to a known malicious IP address. The application owner says the VM hosts a revenue system that cannot be powered off without causing a major outage. What is the best containment action?

Accepted Answer

Isolate the VM at the network layer while keeping it powered on.. Network isolation (e.g., applying a firewall ACL or moving the VM to a quarantine VLAN) stops outbound malicious traffic while keeping the revenue-critical system powered on and available for forensic analysis. This balances security containment with business continuity, as shutting down the VM (Option A) would cause a major outage, and waiting (Option C) would allow continued data exfiltration or lateral movement.

Answer

Shut down the VM immediately to stop all malicious activity.

Answer

Wait for the next maintenance window before taking action.

Answer

Reimage the VM from a known-good template immediately.

Question 9

A SIEM analyst reviews the following sequence from a VPN and email platform over 15 minutes: 47 failed logins against different accounts from one public IP, one successful VPN login from that same IP, a new inbox forwarding rule to an external address, and a mailbox sign-in from a device never seen before. Which three findings most strongly support a password-spraying-to-compromise scenario? Select three.

Accepted Answer

Many failed logins across different usernames from the same source IP in a short time window.. A high volume of failed logins against multiple accounts from a single public IP within a short time window is the hallmark of a password-spraying attack, where the attacker tries a few common passwords across many usernames to avoid account lockout. This pattern is distinct from a brute-force attack, which targets a single account with many passwords.

Answer

A workstation patch installation completed earlier that day.

Answer

The mailbox server reported normal disk utilization during the same hour.

Question 10

After a user signs in, a file server checks whether they can edit a shared folder. Which AAA concept is being applied?

Accepted Answer

Authorization. The file server is checking whether the authenticated user has the specific permission to edit the shared folder. This is the definition of authorization: determining what an authenticated user is allowed to do. Authentication (A) only verifies identity, not rights; accounting (C) tracks usage; encryption (D) protects data in transit or at rest.

Answer

Authentication

Answer

Accounting

Answer

Encryption

Question 11

A vendor-supported application cannot be patched for 30 days, but the business must keep it online. What is the best short-term risk treatment?

Accepted Answer

Apply a compensating control, such as restricting access and monitoring traffic. When a known vulnerability cannot be patched immediately, applying a compensating control—such as restricting network access via firewall rules (e.g., allowing only specific source IPs) and enabling deep packet inspection (DPI) or an intrusion prevention system (IPS) to monitor for exploit attempts—reduces the risk to an acceptable level without taking the application offline. This approach aligns with the principle of defense in depth, buying time until the vendor patch is available.

Answer

Accept the risk without any additional controls

Answer

Delete the application so the vulnerability no longer exists

Answer

Transfer the risk by telling users to work faster

Question 12

Based on the exhibit, what type of malware is most likely present?

Accepted Answer

Ransomware, because the files are being renamed and recovery copies are being deleted.. The exhibit shows files being renamed with a new extension and recovery copies (shadow copies) being deleted via vssadmin.exe. This is a classic ransomware behavior: encrypting user files and removing Volume Shadow Copy backups to prevent recovery without the attacker's key. Ransomware specifically targets document files and system restore points to maximize extortion leverage.

Answer

Adware, because documents are no longer opening correctly.

Answer

Rootkit, because the system is using a command-line utility.

Answer

Spyware, because the attacker wants to read user documents.

Question 13

Based on the exhibit, which document type should define the exact encryption algorithm and minimum key length for all company laptops?

Accepted Answer

Standard. A Standard defines mandatory, specific technical requirements such as the exact encryption algorithm (e.g., AES-256) and minimum key length (e.g., 256 bits) that must be enforced on all company laptops. Policies are high-level statements of intent, while Standards provide the measurable, enforceable criteria to implement that intent. In this context, the encryption algorithm and key length are precise technical specifications, not general guidance or step-by-step instructions.

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 14

A contractor connects a personal tablet to a lobby Ethernet jack. The network team wants the device blocked from internal resources until it passes posture checks and only guest access is allowed meanwhile. Which control best fits?

Accepted Answer

Network access control that verifies the device before granting access.. Network Access Control (NAC) is the correct solution because it enforces security policies by checking a device's compliance (e.g., antivirus, patch level) before granting access to internal resources. In this scenario, the contractor's tablet is initially placed on a guest VLAN with internet-only access until posture checks pass, which is a core NAC function (e.g., using 802.1X or MAC authentication bypass).

Answer

A data loss prevention platform that inspects file transfers.

Answer

A network intrusion detection system placed inline at the switch.

Answer

A VPN concentrator that encrypts remote traffic back to headquarters.

Question 15

During onboarding, a manager wants a document that explains how to request access to a shared drive, who approves it, and what the help desk must do after approval. Which document type is MOST appropriate?

Accepted Answer

Procedure, because it provides the ordered steps for requesting and fulfilling access.. A procedure is the correct document type because it specifies the exact ordered steps for requesting access to a shared drive, the approval authority, and the help desk's post-approval actions. Unlike a policy, which states high-level security principles, a procedure provides the operational workflow needed for onboarding tasks.

Answer

Guideline, because it describes optional best practices for access requests.

Answer

Policy, because it names the general security principle without implementation detail.

Answer

Standard, because it should define every case-specific approval path in the organization.