SY0-701 Practice Test 46 — 15 Questions

Question 1

A Linux operations team is building a new production gold image for database servers. Security requires every build to disable password-based SSH, enable audit logging, use the company NTP servers, and remove the desktop package set. The admins need a document that defines these exact required settings and allows exceptions only through formal approval. Which artifact should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Baseline. A baseline defines the minimum security configuration that must be applied to all systems, such as disabling password-based SSH, enabling audit logging, using specific NTP servers, and removing unnecessary packages. It is the correct artifact because it specifies required settings and allows exceptions only through formal approval, which aligns with the scenario's need for a mandatory configuration standard. Policies are high-level statements of intent, guidelines are recommendations, and procedures are step-by-step instructions, none of which enforce mandatory settings with exception control.

Answer

Policy

Answer

Guideline

Answer

Procedure

Question 2

A help desk technician receives a phone call from someone who claims to be the CFO. The caller says they are traveling, cannot access their MFA app, and needs the technician to reset the account immediately. They also ask the technician to read back the one-time code sent to the executive's phone so they can "verify identity." What type of attack is this most likely?

Accepted Answer

Vishing. This is vishing (voice phishing) because the attacker uses a phone call to impersonate a trusted executive (the CFO) and manipulates the technician into bypassing MFA controls. The request to read back the one-time code is a classic social engineering tactic to capture a valid OTP, which the attacker can then use to authenticate as the CFO.

Answer

Pretexting

Answer

Smishing

Answer

Baiting

Question 3

After a phishing simulation, many employees still almost entered credentials into a fake login page. Leadership wants the fastest improvement without creating training fatigue or disrupting daily work. Which three measures are the best balance of security and usability? Select three.

Accepted Answer

Provide targeted microtraining only to users who clicked or nearly clicked.. Targeted microtraining focuses only on the users who demonstrated risky behavior (clicking or nearly clicking), which directly addresses the root cause without wasting time on users who did not engage. This approach avoids training fatigue by keeping content brief and relevant, and it does not disrupt daily work for the majority of employees who already exhibit secure behavior.

Answer

Replace email access with a weekly manual approval queue for all messages.

Answer

Publicly identify the worst performers in team meetings to discourage mistakes.

Question 4

A help desk technician receives a ticket asking for a password reset on a manager's account. The requester says the manager is traveling and cannot be reached. What is the best action before making any change?

Accepted Answer

Verify the request through an approved identity-check process before taking action.. The principle of least privilege and proper identity verification are critical before performing any privileged action like a password reset. Without verifying the requester's identity through an approved process (e.g., out-of-band verification, knowledge-based authentication, or manager callback), the technician risks unauthorized access, which could lead to a security breach. This aligns with the CompTIA SY0-701 objective on implementing identity and access management controls.

Answer

Reset the password immediately to avoid delaying the manager's work.

Answer

Tell the requester to ask a coworker to share the manager's existing password.

Answer

Ignore the ticket until the manager returns from travel.

Question 5

A help desk team is writing a procedure for resetting MFA after a user loses a phone. Which two details belong in the procedure rather than in the policy? Select two.

Accepted Answer

The exact step-by-step verification process the technician must follow. A procedure must contain the exact step-by-step verification process the technician follows to confirm the user's identity before resetting MFA. This operational detail ensures consistency and security, whereas a policy would only state the high-level requirement (e.g., 'verify identity'). Without precise steps, technicians might skip critical checks, leading to unauthorized MFA resets.

Answer

A statement that all employees must use MFA to access company systems

Answer

A general goal of protecting accounts from unauthorized access

Answer

A broad rule that users should protect company credentials

Question 6

A company wants to stop employees from running unauthorized tools downloaded from the internet on managed Windows laptops, but still allow approved internal apps and vendor-updated software. Which control is best?

Accepted Answer

Application control using an allowlist for approved executables and publishers.. Application control with an allowlist (also known as whitelisting) is the correct choice because it explicitly defines which executables, scripts, and publishers are permitted to run on managed Windows laptops. This prevents unauthorized tools downloaded from the internet from executing, while allowing approved internal apps and vendor-updated software that match the allowlist criteria. Technologies like Windows Defender Application Control (WDAC) or AppLocker enforce this by checking file hashes, publisher signatures, or path rules at runtime.

Answer

Full-disk encryption on every laptop before deployment.

Answer

A stronger screen-lock timeout and automatic logoff policy.

Answer

A firmware password for the BIOS without any other endpoint restrictions.

Question 7

A security tool reports repeated DNS requests for long, random-looking subdomains under the same domain name. What is the most likely explanation?

Accepted Answer

DNS tunneling used to hide command-and-control traffic.. DNS tunneling encodes non-DNS traffic (e.g., C2 commands) into DNS queries and responses, often using long, random-looking subdomains to evade detection. Repeated requests for such subdomains under a single domain are a classic indicator of data exfiltration or covert channel activity, as each query can carry a small payload.

Answer

A normal software update process from the operating system.

Answer

A successful password reset workflow for users.

Answer

A hardware failure on the network adapter.

Question 8

A vulnerability scan finds a critical flaw on an internet-facing SFTP gateway with public exploit code, and a high-severity flaw on an internal lab server that is only reachable from a restricted subnet. Which should be remediated first?

Accepted Answer

The internet-facing SFTP gateway, because it has higher immediate risk.. The internet-facing SFTP gateway has a critical vulnerability with public exploit code, meaning it is exposed to the entire internet and can be directly attacked without any network restrictions. This creates an immediate and high-likelihood risk of remote code execution or data breach, whereas the internal lab server is isolated to a restricted subnet, significantly reducing its attack surface and exploitability. Remediation priority should be based on risk severity (likelihood × impact), not just CVSS score, making the SFTP gateway the correct first choice.

Answer

The internal lab server, because every high-severity finding should be fixed first.

Answer

Both systems can wait until the next scheduled maintenance window.

Answer

Neither system needs urgent action because the lab server is isolated.

Question 9

Guest tablets in a conference room use the same physical switches as employee devices. The security team wants guests to have internet access only, with no route to internal subnets. Which design best meets the goal?

Accepted Answer

Place guests on a separate VLAN and block internal access with ACLs.. Placing guest tablets on a separate VLAN segments traffic at Layer 2, and applying ACLs on the Layer 3 interface (SVI or router) blocks all routes to internal subnets while permitting internet access. This design ensures that even though guests share the same physical switches, their traffic is isolated from employee VLANs and cannot reach internal resources.

Answer

Keep guests on the same VLAN and rely on a separate Wi-Fi password.

Answer

Use stronger WPA3 encryption on the wireless network and leave the network flat.

Answer

Enable MAC address filtering on the switch and allow all ports to remain in the default network.

Question 10

A company requires MFA, endpoint protection, and network filtering so that if one control misses a threat, another control still helps stop it. Which security principle is this?

Accepted Answer

Defense in depth. Defense in depth is a layered security strategy where multiple, independent controls (e.g., MFA, endpoint protection, network filtering) are deployed so that if one layer fails, another still provides protection. This ensures no single point of failure can compromise the entire system, directly matching the scenario where overlapping controls compensate for each other's gaps.

Answer

Single sign-on

Answer

Nonrepudiation

Answer

Data masking

Question 11

A server room is located next to a chilled-water pipe, and facilities staff want the earliest possible warning if moisture starts leaking under the raised floor. Which control is the best fit?

Accepted Answer

Install water leak sensors tied into the environmental monitoring system.. Water leak sensors are specifically designed to detect the presence of moisture, and when integrated into an environmental monitoring system, they provide immediate alerts (e.g., SNMP traps or email notifications) at the earliest sign of a leak. This allows facilities staff to respond before water damages server equipment under the raised floor, meeting the requirement for earliest possible warning.

Answer

Replace the badge reader with a biometric lock.

Answer

Add a security camera pointing at the server racks.

Answer

Move the servers onto a separate VLAN.

Question 12

Based on the exhibit, which integration best lets the SaaS application trust the company's existing identity provider so users can sign in with their corporate credentials?

Accepted Answer

Establish SAML federation so the SaaS app trusts the corporate identity provider.. SAML (Security Assertion Markup Language) federation allows the SaaS application to trust the corporate identity provider (IdP) by exchanging signed XML assertions. This enables users to authenticate against their corporate credentials without the SaaS app ever storing or managing those credentials, providing single sign-on (SSO) across domains.

Answer

Enable password synchronization so the SaaS app stores the same password as the directory.

Answer

Create a shared local administrator account for all subsidiary users.

Answer

Configure MAC address filtering on company laptops to allow portal access.

Question 13

A monthly vulnerability scan identifies a critical vulnerability on a public-facing VPN appliance, but the vendor says no patch is available yet. The service must remain online for remote workers. What is the best compensating control to reduce risk right away?

Accepted Answer

Apply virtual patching or traffic filtering to block exploit attempts until remediation is possible.. Virtual patching or traffic filtering (e.g., via an IPS or WAF) provides immediate, compensating protection by inspecting and blocking exploit traffic targeting the vulnerability, without requiring the vendor to release a patch. This allows the VPN appliance to remain online for remote workers while reducing the risk of exploitation until a permanent fix is available.

Answer

Ignore the finding until the next quarterly review because there is no patch available.

Answer

Move the appliance to a less critical VLAN and leave all access rules unchanged.

Answer

Disable logging so that attackers cannot learn the appliance version from log data.

Question 14

A SOC analyst sees 20 failed logins for one user account, followed by a successful login 30 seconds later from the same office subnet. The user confirms they mistyped the password several times. What is the best conclusion?

Accepted Answer

It is most likely a false positive caused by user error and should be documented after verification.. The scenario shows 20 failed logins followed by a successful login from the same office subnet, and the user confirms they mistyped the password. This pattern is consistent with user error (e.g., Caps Lock or typo), not an automated brute-force attack, which would typically show a much higher volume of attempts from diverse IPs. The best conclusion is a false positive, which should be documented after verification to maintain accurate incident records.

Answer

It is definitely a brute-force attack and should be treated as confirmed compromise.

Answer

It is evidence of malware on the user's workstation until the device is rebuilt.

Answer

It proves the password was changed by an attacker and the account must be disabled immediately.

Question 15

Facilities sees occasional water droplets forming above the cable trays in a data room during humid afternoons. The team wants the earliest possible warning before equipment is damaged. Which control should be added?

Accepted Answer

Water leak sensors tied to environmental monitoring.. Water leak sensors tied to environmental monitoring provide the earliest possible warning by detecting moisture directly on or near the cable trays. Unlike motion detectors or badge readers, these sensors are specifically designed to alert before water reaches sensitive equipment, enabling proactive remediation.

Answer

Motion detectors connected to the alarm panel.

Answer

Badge readers on the room entrance only.

Answer

Fire suppression tests scheduled more frequently.