SY0-701 Practice Test 45 — 15 Questions

Question 1

EDR flags encoded PowerShell launched by a spreadsheet application, followed by an attempt to access LSASS and outbound HTTPS traffic to a rare domain. What should the analyst do first from the EDR console?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the endpoint from the network while keeping it powered on. Isolating the endpoint from the network while keeping it powered on preserves volatile evidence (e.g., running processes, memory contents) and prevents the attacker from exfiltrating data or establishing further C2 communication. The EDR console allows immediate network isolation without losing the ability to perform live forensics or memory analysis. This aligns with the incident response priority of containment before eradication or recovery.

Answer

Reboot the endpoint to terminate the suspicious processes

Answer

Uninstall the spreadsheet application immediately

Answer

Block the rare domain and close the alert

Question 2

An engineering team requests a 30-day exception to use an unsupported browser plug-in on two workstations so a customer deliverable can be finished. Security agrees the business need is legitimate, but wants to reduce exposure. What must be included before the exception is approved?

Accepted Answer

A documented exception with an end date, compensating controls, and approval by the risk owner.. A documented exception with a defined end date, compensating controls, and risk-owner approval is the correct approach. Security exceptions should be controlled, reviewable, and temporary whenever possible. That structure shows the business need was acknowledged while ensuring someone has formally accepted the residual risk and the organization can reassess the exception before it becomes indefinite.

Why others are wrong: A verbal approval is not enough for auditability or accountability. A standing waiver without a review date can quietly become permanent and increase exposure. A guideline does not authorize deviation from policy or provide the controls required for an exception process. The question is about formal exception handling, not informal advice.

Answer

A verbal approval from the engineering manager and no additional documentation.

Answer

A standing waiver that remains in place until the project finishes, with no review date.

Answer

A guideline reminding the team to avoid risky behavior when practical.

Question 3

A Linux server starts showing many failed SSH logins from one source IP address. Which log source should the analyst review first?

Accepted Answer

The system authentication log. The system authentication log (e.g., /var/log/auth.log or /var/log/secure) records all SSH login attempts, including failed ones, along with source IP addresses. This is the primary log source for investigating authentication failures on Linux systems, as it captures PAM (Pluggable Authentication Module) events and SSH daemon messages.

Answer

The printer spooler log

Answer

The browser history log

Answer

The backup completion log

Question 4

After a server rebuild, a Windows administrator notices several unneeded services are still enabled, including Remote Registry and Print Spooler on a server that only hosts a database. What should the administrator do to reduce attack surface and keep the build consistent?

Accepted Answer

Apply the approved secure baseline and disable unnecessary services.. Applying an approved secure baseline and disabling unnecessary services (Option B) directly reduces the attack surface by removing potential entry points like Remote Registry (which allows remote modification of the registry) and Print Spooler (which has known privilege escalation vulnerabilities, e.g., CVE-2021-34527). This also ensures build consistency by enforcing a standardized configuration across all servers, which is critical for compliance and manageability in a Windows environment.

Answer

Install additional endpoint monitoring agents to compensate for the extra services.

Answer

Increase the disk encryption key size to protect the running services.

Answer

Move the server to a different subnet and leave the configuration unchanged.

Question 5

A business owner asks the security team to compare the cost of two controls for a legacy application in dollar terms. The team estimates the annual chance of a breach, the potential loss per event, and the expected yearly loss after each control is applied. Which risk analysis approach is being used?

Accepted Answer

Quantitative risk analysis. The question describes a risk analysis that uses dollar values for the annual chance of a breach, potential loss per event, and expected yearly loss after controls are applied. This is the hallmark of quantitative risk analysis, which assigns monetary or numerical values to risk components (e.g., ALE = SLE × ARO) to compare control costs in objective financial terms. The scenario explicitly asks for a cost comparison in dollar terms, which only a quantitative approach can provide.

Answer

Qualitative risk analysis

Answer

Business impact analysis

Answer

Risk acceptance

Question 6

A user reports that their laptop is suddenly encrypting files and showing a ransom note. What should the incident response team do first?

Accepted Answer

Isolate the laptop from the network to limit spread and preserve evidence.. When a laptop suddenly encrypts files and displays a ransom note, it indicates an active ransomware infection. The incident response team's first priority is to isolate the laptop from the network to prevent the ransomware from spreading laterally to other systems and to preserve volatile evidence (e.g., memory contents, running processes) that could be lost if the system is powered off or reconnected. This aligns with the NIST SP 800-61 incident response guidelines, which emphasize containment before eradication or recovery.

Answer

Immediately restore the laptop from backup before collecting any information.

Answer

Return the laptop to the user and monitor for additional alerts.

Answer

Apply all pending software updates to the laptop while it remains online.

Question 7

A scan finds two issues: a critical flaw on a lab server reachable only through VPN, and a high-severity flaw on an internet-facing file transfer appliance with active exploitation in the wild. Which should be remediated first?

Accepted Answer

The internet-facing file transfer appliance, because exploitability and exposure increase risk.. The internet-facing file transfer appliance with active exploitation in the wild presents a higher risk because it is directly exposed to untrusted networks and has a known exploit that attackers are actively using. Even though the lab server has a critical severity rating, its reachability only through VPN significantly reduces its attack surface and likelihood of exploitation. Risk is a function of both severity and exploitability/exposure, so the actively exploited, internet-facing asset should be remediated first.

Answer

The lab server, because critical severity is always higher than high severity.

Answer

Both issues at the same time, because prioritization is unnecessary when two findings are present.

Answer

The lab server, because systems behind VPN are always more trusted than public systems.

Question 8

After restoring a virtual file server from backup, users can browse folders, but an accounting application reports missing recent transactions. What should the administrator do next?

Accepted Answer

Verify the restore in an isolated test environment and compare application data consistency. The correct next step is to verify the restore in an isolated test environment and compare application data consistency. Although the file server is reachable and folders appear intact, the accounting application's missing recent transactions indicate that the restored data may be stale or incomplete. Testing in isolation ensures the application's database or transaction logs are consistent with the backup point before returning the server to production, preventing data corruption or loss.

Answer

Mark the restore complete because the file server is reachable

Answer

Immediately run a new full backup over the restored server

Answer

Disable the accounting application permanently to prevent further inconsistency

Question 9

A company is placing a customer-facing web application behind a new security control. The team wants to block malicious HTTP requests such as injection attempts before they reach the application server, with minimal code changes to the app itself. Which control is the best fit?

Accepted Answer

Web application firewall (WAF) in front of the application.. A web application firewall (WAF) is specifically designed to inspect and filter HTTP/HTTPS traffic at the application layer (Layer 7), blocking malicious payloads such as SQL injection and cross-site scripting (XSS) before they reach the web server. It operates without requiring changes to the application code, making it the ideal choice for this scenario.

Answer

Network access control (NAC) at the switch port.

Answer

Data loss prevention (DLP) on the email gateway.

Answer

Endpoint detection and response (EDR) on the web server only.

Question 10

Based on the exhibit, what type of social engineering attack is the caller using?

Accepted Answer

Vishing, because the attacker is using a phone call to pressure the target.. The caller is using a phone call to impersonate a trusted figure (the CEO) and create urgency to pressure the target into violating security policy. This matches the definition of vishing (voice phishing), which relies on social engineering over voice channels to extract sensitive information or actions.

Answer

Ransomware, because the caller is asking for money.

Answer

SQL injection, because the caller is asking for account details.

Answer

Tailgating, because the attacker mentions an executive assistant.

Question 11

Based on the exhibit, what should the analyst do before opening the forensic image for examination?

Accepted Answer

Calculate and compare the image hash to the source hash before analysis.. Before examining a forensic image, the analyst must verify its integrity by calculating its hash (e.g., MD5, SHA-1, SHA-256) and comparing it to the known hash of the original source. This ensures the image is an exact, unaltered copy, which is critical for maintaining the chain of custody and admissibility of evidence. Option B is correct because hash verification is the foundational step in forensic analysis.

Answer

Mount the image read-write so the analyst can begin searching immediately.

Answer

Defragment the original SSD so the files will be easier to search later.

Answer

Compress the image into a ZIP file to reduce storage usage before verifying it.

Question 12

Based on the exhibit, which control would best reduce unauthorized follow-on entry into the records room?

Accepted Answer

Install a mantrap so only one person can pass through at a time.. A mantrap is a physical security control consisting of a small space with two interlocking doors, designed to allow only one person to pass at a time. This prevents tailgating and piggybacking, which are common methods of unauthorized follow-on entry into a restricted area like a records room.

Answer

Add more network firewall rules around the records room door.

Answer

Increase the screen lock timeout on nearby workstations.

Answer

Replace the UPS batteries to stop unauthorized people from entering.

Question 13

A support portal searches customer records by last name. When a tester enters a single quote into the search field, the application returns a database syntax error. Which attack is most likely possible?

Accepted Answer

SQL injection, because the input may be altering the database query. The single quote character is a common SQL injection test payload. When it triggers a database syntax error, it confirms that the input is being directly concatenated into a SQL query without proper sanitization or parameterization. This allows an attacker to break out of the intended query structure and execute arbitrary SQL commands, making SQL injection the most likely attack.

Answer

Cross-site scripting, because the page is executing malicious JavaScript in the browser

Answer

Server-side request forgery, because the server is making internal network calls

Answer

Cross-site request forgery, because the user is being tricked into submitting a form

Question 14

A vulnerability scan finds that an administrative SSH service on a Linux server is listening on 0.0.0.0 and is reachable from the internet. The server is meant to be managed only from the internal admin subnet. What is the best remediation?

Accepted Answer

Restrict SSH to the management network and block public access with firewall or host-based rules.. The vulnerability is that SSH is exposed to the internet on 0.0.0.0, which violates the principle of least privilege and exposes the administrative interface to unauthorized access. The best remediation is to restrict SSH to the internal management subnet using firewall rules (e.g., iptables, security group ACLs) or host-based rules (e.g., tcpwrappers, /etc/hosts.allow), ensuring only trusted internal IPs can reach the service. This directly addresses the exposure without changing the protocol or client configuration.

Answer

Patch the SSH client on administrator laptops so the server cannot be reached externally.

Answer

Enable a captive portal on the public interface so only authenticated users see the service.

Answer

Replace SSH with FTP because FTP can be configured to allow administrative access more easily.

Question 15

Drag and drop the steps to perform a factory reset on a managed switch into the correct order.

Accepted Answer

Step 1: Power off the switch, Step 2: Press and hold the reset button, Step 3: Power on the switch while holding the reset button, Step 4: Continue holding the reset button for 10 seconds, Step 5: Release the reset button, Step 6: Wait for the switch to reboot with factory defaults.. Factory reset clears all configuration; the exact method may vary by vendor, but typically involves holding a button during power-on.

Answer

Step 2: Press and hold the reset button, Step 2: Power off the switch, Step 3: Power on the switch while holding the reset button, Step 4: Continue holding for 10 seconds, Step 5: Release, Step 6: Wait for reboot.

Answer

Step 1: Power off, Step 2: Press and hold reset, Step 3: Power on while holding, Step 4: Release after 2 seconds, Step 5: Wait for reboot.

Answer

Step 1: Power on the switch, Step 2: Press and hold reset, Step 3: Power off, Step 4: Power on again while holding reset, Step 5: Hold for 10 seconds, Step 6: Release, Step 7: Wait for reboot.