SY0-701 Practice Test 45 — 15 Questions

Question 1

Based on the exhibit, what type of social engineering attack is the caller using?

Accepted Answer

Vishing, because the attacker is using a phone call to pressure the target.. The caller is using a phone call to impersonate a trusted figure (the CEO) and create urgency to pressure the target into violating security policy. This matches the definition of vishing (voice phishing), which relies on social engineering over voice channels to extract sensitive information or actions.

Answer

Ransomware, because the caller is asking for money.

Answer

SQL injection, because the caller is asking for account details.

Answer

Tailgating, because the attacker mentions an executive assistant.

Question 2

Based on the exhibit, what should the analyst do before opening the forensic image for examination?

Accepted Answer

Calculate and compare the image hash to the source hash before analysis.. Before examining a forensic image, the analyst must verify its integrity by calculating its hash (e.g., MD5, SHA-1, SHA-256) and comparing it to the known hash of the original source. This ensures the image is an exact, unaltered copy, which is critical for maintaining the chain of custody and admissibility of evidence. Option B is correct because hash verification is the foundational step in forensic analysis.

Answer

Mount the image read-write so the analyst can begin searching immediately.

Answer

Defragment the original SSD so the files will be easier to search later.

Answer

Compress the image into a ZIP file to reduce storage usage before verifying it.

Question 3

Based on the exhibit, which control would best reduce unauthorized follow-on entry into the records room?

Accepted Answer

Install a mantrap so only one person can pass through at a time.. A mantrap is a physical security control consisting of a small space with two interlocking doors, designed to allow only one person to pass at a time. This prevents tailgating and piggybacking, which are common methods of unauthorized follow-on entry into a restricted area like a records room.

Answer

Add more network firewall rules around the records room door.

Answer

Increase the screen lock timeout on nearby workstations.

Answer

Replace the UPS batteries to stop unauthorized people from entering.

Question 4

A support portal searches customer records by last name. When a tester enters a single quote into the search field, the application returns a database syntax error. Which attack is most likely possible?

Accepted Answer

SQL injection, because the input may be altering the database query. The single quote character is a common SQL injection test payload. When it triggers a database syntax error, it confirms that the input is being directly concatenated into a SQL query without proper sanitization or parameterization. This allows an attacker to break out of the intended query structure and execute arbitrary SQL commands, making SQL injection the most likely attack.

Answer

Cross-site scripting, because the page is executing malicious JavaScript in the browser

Answer

Server-side request forgery, because the server is making internal network calls

Answer

Cross-site request forgery, because the user is being tricked into submitting a form

Question 5

A vulnerability scan finds that an administrative SSH service on a Linux server is listening on 0.0.0.0 and is reachable from the internet. The server is meant to be managed only from the internal admin subnet. What is the best remediation?

Accepted Answer

Restrict SSH to the management network and block public access with firewall or host-based rules.. The vulnerability is that SSH is exposed to the internet on 0.0.0.0, which violates the principle of least privilege and exposes the administrative interface to unauthorized access. The best remediation is to restrict SSH to the internal management subnet using firewall rules (e.g., iptables, security group ACLs) or host-based rules (e.g., tcpwrappers, /etc/hosts.allow), ensuring only trusted internal IPs can reach the service. This directly addresses the exposure without changing the protocol or client configuration.

Answer

Patch the SSH client on administrator laptops so the server cannot be reached externally.

Answer

Enable a captive portal on the public interface so only authenticated users see the service.

Answer

Replace SSH with FTP because FTP can be configured to allow administrative access more easily.

Question 6

Drag and drop the steps to perform a factory reset on a managed switch into the correct order.

Accepted Answer

Step 1: Power off the switch, Step 2: Press and hold the reset button, Step 3: Power on the switch while holding the reset button, Step 4: Continue holding the reset button for 10 seconds, Step 5: Release the reset button, Step 6: Wait for the switch to reboot with factory defaults.. Factory reset clears all configuration; the exact method may vary by vendor, but typically involves holding a button during power-on.

Answer

Step 2: Press and hold the reset button, Step 2: Power off the switch, Step 3: Power on the switch while holding the reset button, Step 4: Continue holding for 10 seconds, Step 5: Release, Step 6: Wait for reboot.

Answer

Step 1: Power off, Step 2: Press and hold reset, Step 3: Power on while holding, Step 4: Release after 2 seconds, Step 5: Wait for reboot.

Answer

Step 1: Power on the switch, Step 2: Press and hold reset, Step 3: Power off, Step 4: Power on again while holding reset, Step 5: Hold for 10 seconds, Step 6: Release, Step 7: Wait for reboot.

Question 7

A Linux operations team is building a new production gold image for database servers. Security requires every build to disable password-based SSH, enable audit logging, use the company NTP servers, and remove the desktop package set. The admins need a document that defines these exact required settings and allows exceptions only through formal approval. Which artifact should be used?

Accepted Answer

Baseline. A baseline defines the minimum security configuration that must be applied to all systems, such as disabling password-based SSH, enabling audit logging, using specific NTP servers, and removing unnecessary packages. It is the correct artifact because it specifies required settings and allows exceptions only through formal approval, which aligns with the scenario's need for a mandatory configuration standard. Policies are high-level statements of intent, guidelines are recommendations, and procedures are step-by-step instructions, none of which enforce mandatory settings with exception control.

Answer

Policy

Answer

Guideline

Answer

Procedure

Question 8

A help desk technician receives a phone call from someone who claims to be the CFO. The caller says they are traveling, cannot access their MFA app, and needs the technician to reset the account immediately. They also ask the technician to read back the one-time code sent to the executive's phone so they can "verify identity." What type of attack is this most likely?

Accepted Answer

Vishing. This is vishing (voice phishing) because the attacker uses a phone call to impersonate a trusted executive (the CFO) and manipulates the technician into bypassing MFA controls. The request to read back the one-time code is a classic social engineering tactic to capture a valid OTP, which the attacker can then use to authenticate as the CFO.

Answer

Pretexting

Answer

Smishing

Answer

Baiting

Question 9

After a phishing simulation, many employees still almost entered credentials into a fake login page. Leadership wants the fastest improvement without creating training fatigue or disrupting daily work. Which three measures are the best balance of security and usability? Select three.

Accepted Answer

Provide targeted microtraining only to users who clicked or nearly clicked.. Targeted microtraining focuses only on the users who demonstrated risky behavior (clicking or nearly clicking), which directly addresses the root cause without wasting time on users who did not engage. This approach avoids training fatigue by keeping content brief and relevant, and it does not disrupt daily work for the majority of employees who already exhibit secure behavior.

Answer

Replace email access with a weekly manual approval queue for all messages.

Answer

Publicly identify the worst performers in team meetings to discourage mistakes.

Question 10

A help desk technician receives a ticket asking for a password reset on a manager's account. The requester says the manager is traveling and cannot be reached. What is the best action before making any change?

Accepted Answer

Verify the request through an approved identity-check process before taking action.. The principle of least privilege and proper identity verification are critical before performing any privileged action like a password reset. Without verifying the requester's identity through an approved process (e.g., out-of-band verification, knowledge-based authentication, or manager callback), the technician risks unauthorized access, which could lead to a security breach. This aligns with the CompTIA SY0-701 objective on implementing identity and access management controls.

Answer

Reset the password immediately to avoid delaying the manager's work.

Answer

Tell the requester to ask a coworker to share the manager's existing password.

Answer

Ignore the ticket until the manager returns from travel.

Question 11

A help desk team is writing a procedure for resetting MFA after a user loses a phone. Which two details belong in the procedure rather than in the policy? Select two.

Accepted Answer

The exact step-by-step verification process the technician must follow. A procedure must contain the exact step-by-step verification process the technician follows to confirm the user's identity before resetting MFA. This operational detail ensures consistency and security, whereas a policy would only state the high-level requirement (e.g., 'verify identity'). Without precise steps, technicians might skip critical checks, leading to unauthorized MFA resets.

Answer

A statement that all employees must use MFA to access company systems

Answer

A general goal of protecting accounts from unauthorized access

Answer

A broad rule that users should protect company credentials

Question 12

A company wants to stop employees from running unauthorized tools downloaded from the internet on managed Windows laptops, but still allow approved internal apps and vendor-updated software. Which control is best?

Accepted Answer

Application control using an allowlist for approved executables and publishers.. Application control with an allowlist (also known as whitelisting) is the correct choice because it explicitly defines which executables, scripts, and publishers are permitted to run on managed Windows laptops. This prevents unauthorized tools downloaded from the internet from executing, while allowing approved internal apps and vendor-updated software that match the allowlist criteria. Technologies like Windows Defender Application Control (WDAC) or AppLocker enforce this by checking file hashes, publisher signatures, or path rules at runtime.

Answer

Full-disk encryption on every laptop before deployment.

Answer

A stronger screen-lock timeout and automatic logoff policy.

Answer

A firmware password for the BIOS without any other endpoint restrictions.

Question 13

A security tool reports repeated DNS requests for long, random-looking subdomains under the same domain name. What is the most likely explanation?

Accepted Answer

DNS tunneling used to hide command-and-control traffic.. DNS tunneling encodes non-DNS traffic (e.g., C2 commands) into DNS queries and responses, often using long, random-looking subdomains to evade detection. Repeated requests for such subdomains under a single domain are a classic indicator of data exfiltration or covert channel activity, as each query can carry a small payload.

Answer

A normal software update process from the operating system.

Answer

A successful password reset workflow for users.

Answer

A hardware failure on the network adapter.

Question 14

A vulnerability scan finds a critical flaw on an internet-facing SFTP gateway with public exploit code, and a high-severity flaw on an internal lab server that is only reachable from a restricted subnet. Which should be remediated first?

Accepted Answer

The internet-facing SFTP gateway, because it has higher immediate risk.. The internet-facing SFTP gateway has a critical vulnerability with public exploit code, meaning it is exposed to the entire internet and can be directly attacked without any network restrictions. This creates an immediate and high-likelihood risk of remote code execution or data breach, whereas the internal lab server is isolated to a restricted subnet, significantly reducing its attack surface and exploitability. Remediation priority should be based on risk severity (likelihood × impact), not just CVSS score, making the SFTP gateway the correct first choice.

Answer

The internal lab server, because every high-severity finding should be fixed first.

Answer

Both systems can wait until the next scheduled maintenance window.

Answer

Neither system needs urgent action because the lab server is isolated.

Question 15

Guest tablets in a conference room use the same physical switches as employee devices. The security team wants guests to have internet access only, with no route to internal subnets. Which design best meets the goal?

Accepted Answer

Place guests on a separate VLAN and block internal access with ACLs.. Placing guest tablets on a separate VLAN segments traffic at Layer 2, and applying ACLs on the Layer 3 interface (SVI or router) blocks all routes to internal subnets while permitting internet access. This design ensures that even though guests share the same physical switches, their traffic is isolated from employee VLANs and cannot reach internal resources.

Answer

Keep guests on the same VLAN and rely on a separate Wi-Fi password.

Answer

Use stronger WPA3 encryption on the wireless network and leave the network flat.

Answer

Enable MAC address filtering on the switch and allow all ports to remain in the default network.