SY0-701 Practice Test 47 — 15 Questions

Question 1

Based on the exhibit, what should the employee do first?

Accepted Answer

Report the message through the company’s phishing-report process and do not share the code.. Option B is correct because the message exhibits classic social engineering indicators: an unsolicited request for a sensitive code, urgency, and a spoofed sender address. The employee must report it via the company's phishing-report process to alert the security team and must not share the code, as that would compromise the account. This aligns with security awareness training that emphasizes verifying requests out-of-band and never providing credentials or codes in response to email requests.

Answer

Reply with the code because the request appears to come from payroll support.

Answer

Forward the email to coworkers so they can watch for the same request.

Answer

Open the attached file to see whether it contains the payroll fix details.

Question 2

After a phishing simulation, many users still nearly entered credentials. Leadership wants to reduce repeat mistakes without causing long training sessions. Which two actions are the best balance of security and usability? Select two.

Accepted Answer

Send a short targeted refresher focused on the exact mistake. Option A is correct because a short, targeted refresher directly addresses the specific mistake (e.g., entering credentials on a phishing page) without overwhelming users. This approach leverages microlearning principles, which improve retention and reduce cognitive load compared to lengthy training. It balances security by reinforcing the exact behavior to avoid, while maintaining usability by minimizing time away from work.

Answer

Require every employee to attend a full-day annual course this week

Answer

Publicly post the names of employees who clicked the simulation

Answer

Disable all email attachments for every user

Question 3

After a ransomware event, management wants proof that last night's backups can actually support business operations before they declare recovery complete. What is the best action?

Accepted Answer

Perform a test restore into an isolated environment and validate the files or application work correctly.. Option A is correct because performing a test restore into an isolated environment directly validates that the backup data is intact, the restore process works, and the restored files or applications function as expected. This provides management with the proof they need to confirm business operations can resume, which is the core requirement after a ransomware event.

Answer

Increase the backup retention period without testing the backups.

Answer

Copy the backup set to a new storage bucket and assume it is usable.

Answer

Run a vulnerability scan against the backup server.

Question 4

After a server rebuild, an administrator notices that Remote Desktop, SMBv1, and Print Spooler are still enabled on a Windows file server even though the server only stores department documents. The security team also wants to know if future changes drift away from the approved build. What should be implemented?

Accepted Answer

Apply the approved secure baseline and enable configuration drift monitoring against it.. Option A is correct because applying an approved secure baseline (e.g., via Group Policy or Security Compliance Toolkit) ensures that unnecessary services like Remote Desktop, SMBv1, and Print Spooler are explicitly disabled. Enabling configuration drift monitoring (e.g., using Azure Policy, DSC, or a SIEM) allows the security team to detect and alert on any unauthorized changes that deviate from the baseline, addressing both the immediate risk and the long-term compliance requirement.

Answer

Keep the server as-is and rely on the antivirus console to stop misuse.

Answer

Move the server into a different VLAN and leave the operating system settings unchanged.

Answer

Schedule a monthly reboot to clear temporary settings and reduce attack surface.

Question 5

After a switch reboot in a conference room, several laptops obtain valid IP addresses in the correct subnet, but their default gateway changes to 10.20.40.50, which is not the legitimate router. Packet capture shows DHCP offers coming from a MAC address that does not belong to the approved DHCP server, and the rogue device responds faster than the real server. What attack is most likely occurring?

Accepted Answer

Rogue DHCP service, because an unauthorized DHCP server is handing out network settings.. The scenario describes an unauthorized device responding to DHCP discovery messages faster than the legitimate server, assigning valid IPs but a rogue default gateway (10.20.40.50). This is the classic behavior of a rogue DHCP server, which intercepts DHCP traffic to manipulate client network settings, enabling man-in-the-middle attacks. The packet capture confirming DHCP offers from an unknown MAC address directly identifies the attack as a Rogue DHCP service.

Answer

ARP poisoning, because the attacker is changing IP-to-MAC mappings on the local network.

Answer

Replay attack, because the attacker is reusing old DHCP offers.

Answer

DNS poisoning, because the clients are being sent to the wrong network path.

Question 6

After building a new file server, an administrator reviews the security baseline and notices that a remote desktop service is enabled even though no one uses it. What is the best hardening action?

Accepted Answer

Disable the unnecessary service. The best hardening action is to disable the unnecessary remote desktop service because it reduces the attack surface. An enabled but unused service, such as Remote Desktop Protocol (RDP) on TCP/3389, is a common vector for brute-force attacks and exploits (e.g., BlueKeep, CVE-2019-0708). Disabling it eliminates this risk without affecting legitimate operations.

Answer

Keep the service enabled in case someone needs it later

Answer

Change the server name to make it harder to find

Answer

Increase disk space on the server

Question 7

After an employee successfully signs in to a file-sharing portal, the portal checks whether the employee can upload files to a specific project folder. Which AAA concept is being used?

Accepted Answer

Authorization, because the system is deciding what the signed-in user is allowed to do.. After the user successfully signs in (authentication), the portal checks permissions to determine if they can upload files to a specific project folder. This is the definition of authorization: verifying what an authenticated user is allowed to do. The system is enforcing access control based on the user's identity and the folder's permissions.

Answer

Authentication, because the user proved their identity with credentials.

Answer

Accounting, because the portal is recording the folder permissions for later review.

Answer

Nonrepudiation, because the portal proves the user cannot deny uploading a file.

Question 8

After confirming malicious activity on a workstation, the incident lead wants the system cleaned up quickly. The analyst has not yet collected any volatile data. What should the analyst do before remediation begins?

Accepted Answer

Capture volatile evidence such as memory and running process information before changing the system.. Option A is correct because volatile data (e.g., memory contents, running processes, network connections) is lost when the system is powered off or changed. The analyst must capture this evidence first to preserve forensic artifacts that can identify the root cause, scope, and indicators of compromise (IOCs) before remediation alters the system state.

Answer

Immediately uninstall every suspicious application and delete related files.

Answer

Restore the workstation from backup before documenting the incident.

Answer

Close the incident because the malicious activity has already been confirmed.

Question 9

After containment and eradication of malware on several laptops, the team restores the devices from known-good images and verifies that users can authenticate and access email. Which action should occur NEXT to complete the incident response lifecycle and reduce future impact?

Accepted Answer

Perform a lessons-learned review and update playbooks, controls, or detections based on the incident. Option B is correct because the incident response lifecycle includes a post-incident activity phase where the team conducts a lessons-learned review to identify gaps in security controls, update playbooks, and improve detection signatures. This step ensures that the organization reduces the likelihood and impact of similar incidents in the future, completing the lifecycle beyond just restoring operations.

Answer

Close the ticket immediately because the systems are working again

Answer

Reimage the laptops again even though they were already restored and tested

Answer

Disable all email access for the organization until the next quarterly meeting

Question 10

After restoring a virtual file server from last night’s backup, users can browse shares, but finance reports that several spreadsheet edits from yesterday are missing. What should the administrator verify next before declaring the restore successful?

Accepted Answer

Whether the backup job used the correct restore point and included the needed transaction logs.. Option A is correct because the missing spreadsheet edits indicate that the backup may have been taken before those changes were committed. The administrator must verify that the restore point includes the necessary transaction logs (e.g., from a VSS-aware backup or application-consistent snapshot) to recover the most recent data. Without these logs, any edits made after the last full backup are lost, so confirming the correct restore point and log inclusion is the next logical step before declaring success.

Answer

Whether the file server antivirus signatures are fully up to date.

Answer

Whether the share permissions were tightened during the restore.

Answer

Whether the virtual machine has enough CPU and memory allocated.

Question 11

After several unauthorized edits to firewall objects caused a production outage, a security team wants one control that will flag future configuration drift and another that will automatically restore the approved baseline before the next maintenance window. Which two controls best meet that goal? Select two.

Accepted Answer

File integrity monitoring on firewall configuration files and rule exports.. File integrity monitoring (FIM) on firewall configuration files and rule exports (Option A) detects unauthorized changes by computing cryptographic hashes of baseline files and alerting on any deviation. This directly flags configuration drift, meeting the first requirement. Automated configuration management (Option B) can reapply the approved baseline from a version-controlled repository, restoring the correct state before the next maintenance window, satisfying the second requirement.

Answer

A login banner warning administrators that unauthorized changes are monitored.

Answer

Mandatory annual security awareness training for all IT staff.

Answer

Quarterly business impact reviews of the firewall change log.

Question 12

An accounts payable clerk receives an email that continues a real vendor conversation from last week. The sender domain is only one character different from the vendor's real address. The message says the invoice is overdue and asks the clerk to update the payment account before the end of the day. What is the best next action?

Accepted Answer

Verify the request using a known phone number or portal from previous records before taking action.. Option B is correct because the email exhibits classic signs of a business email compromise (BEC) attack: a spoofed sender domain (typosquatting) and urgent payment redirection. The best next action is to verify the request out-of-band using a trusted phone number or portal from previous records, as this bypasses any compromised email channels and confirms the legitimacy of the request before any financial loss occurs.

Answer

Reply to the email asking for confirmation of the new bank details.

Answer

Forward the email to the vendor's entire contact list to warn them immediately.

Answer

Open the attached invoice to check whether the payment information matches past records.

Question 13

An administrator notices that a finance file share remained normal for weeks after a former contractor left the company. This morning, multiple PDFs and spreadsheets were deleted, and a scheduled task created months ago is now executing a script that wipes files in the shared folder. Which malware type is most consistent with this behavior?

Accepted Answer

Logic bomb triggered by a time or condition after being planted earlier. The behavior matches a logic bomb: malicious code planted in advance (the scheduled task created months ago) that remains dormant until triggered by a specific condition (the passage of time or a date). The file share was normal for weeks because the logic bomb had not yet met its trigger condition; once triggered, it executed the script to delete files. This contrasts with other malware types that require active propagation, continuous monitoring, or kernel-level hiding.

Answer

Worm that is automatically propagating to other endpoints

Answer

Spyware that is secretly collecting keystrokes and screenshots

Answer

Rootkit that is hiding itself in the kernel to maintain stealth

Question 14

An attacker calls the service desk claiming to be a traveling contractor whose phone was stolen. They know the contractor's manager name and ask for an MFA reset to a new number 'just for today.' Which control would best reduce the success of this attack?

Accepted Answer

Require a callback to a previously verified number and ticket approval before reset.. Option B is correct because it introduces two verification factors that directly counter the social engineering vector: a callback to a previously verified number ensures the requestor is reachable at a known trusted contact point, and ticket approval creates an audit trail and requires secondary authorization. This combination prevents an attacker from simply claiming an identity and requesting a change without independent confirmation, which is the core weakness the attacker exploits.

Answer

Trust any caller who can provide a manager's name and employee ID.

Answer

Remove MFA so users are less likely to get locked out while traveling.

Answer

Use caller ID alone to confirm the person is legitimate.

Question 15

An EDR alert shows a Windows workstation used certutil.exe to download an encoded script, then created a scheduled task named UpdateCheck that runs every 15 minutes. The machine is also making short HTTPS connections to the same external IP. What is the best description of what the attacker is doing?

Accepted Answer

Living-off-the-land abuse with persistence through a scheduled task is occurring.. Option B is correct because the attacker is using certutil.exe, a native Windows tool, to download an encoded script (living-off-the-land), and then creating a scheduled task named UpdateCheck to maintain persistence by running every 15 minutes. This combination of abusing trusted binaries and establishing a recurring task is a classic indicator of LOTL abuse with persistence.

Answer

A buffer overflow exploit is likely corrupting memory in the operating system.

Answer

The evidence most strongly suggests a drive-by download from a compromised browser session.

Answer

A man-in-the-middle attack is intercepting and modifying the TLS session.

SY0-701 Practice Test 47 — 15 Questions

Exhibit

SY0-701 Practice Test 47 — 15 Questions

Exhibit