SY0-701 Practice Test 47 — 15 Questions

Question 1

A customer portal must keep serving requests if one application server stops responding. The team wants traffic to be sent to whichever healthy server is available. Which design should they implement?

Accepted Answer

A load balancer in front of multiple application servers. A load balancer distributes incoming traffic across multiple application servers and performs health checks (e.g., HTTP GET requests to a /health endpoint) to detect failures. If one server stops responding, the load balancer automatically routes requests only to the remaining healthy servers, ensuring continuous availability. This design directly meets the requirement for fault tolerance and active traffic distribution.

Answer

A RAID 1 array in the application server

Answer

A snapshot of the application server before each update

Answer

A longer password policy for the portal administrators

Question 2

A web application must be reachable from the internet, but its database should be isolated from direct internet access. Which two placements or controls are most appropriate? Select two.

Accepted Answer

Place the web server in a DMZ.. Placing the web server in a DMZ (Option A) allows it to be reachable from the internet while the internal firewall restricts inbound traffic to only necessary ports (e.g., TCP 80/443). Keeping the database on an internal network segment (Option B) and configuring firewall rules to allow traffic only from the web server’s IP address ensures the database is isolated from direct internet access, preventing external attacks on the database service.

Answer

Place both the web server and the database on the same internet-facing subnet.

Answer

Expose the database port to the internet so administrators can connect faster.

Answer

Use the guest wireless VLAN for both systems.

Question 3

A manufacturing company must keep a legacy scheduling application running for 60 days while replacement testing finishes. The application supports production orders, and the business cannot tolerate a shutdown. Which three conditions should be required before approving the temporary exception? Select three.

Accepted Answer

Assign a named risk owner who is authorized to accept the residual risk.. Assigning a named risk owner who is authorized to accept residual risk is a fundamental requirement for any risk exception. This ensures accountability and that a specific individual with the authority to accept the potential consequences of running an unsupported system is identified. Without a designated owner, the exception lacks governance and could lead to unmanaged exposure.

Answer

Rely on the vendor's promise that a better version will be available eventually.

Answer

Approve an unlimited waiver so operations do not need to revisit the issue.

Question 4

A branch office's network closet has repeated unauthorized access issues after staff badge in and hold the door for others. Management wants a control that allows one person through after valid badge use and helps prevent tailgating. Which control is best?

Accepted Answer

A mantrap, because it physically restricts entry to one person at a time.. A mantrap is a physical security control consisting of a small space with two interlocking doors, typically requiring authentication to enter and exit. It ensures that only one person can pass through at a time, effectively preventing tailgating by trapping unauthorized individuals between the doors if they attempt to follow an authorized user.

Answer

Closed-circuit television cameras, because they record the doorway for later review.

Answer

A motion sensor, because it can detect movement inside the room.

Answer

A door closer, because it ensures the door automatically shuts after use.

Question 5

A company wants all corporate laptops to authenticate to Wi-Fi using device certificates instead of shared passwords. It also wants to deny network access to systems that do not meet the baseline requirement for disk encryption and current endpoint protection. Which approach best satisfies both goals?

Accepted Answer

Deploy 802.1X with certificate-based authentication and network access control posture checks.. 802.1X with certificate-based authentication ensures that only devices with valid certificates can authenticate to the Wi-Fi network, eliminating reliance on shared passwords. Network access control (NAC) posture checks then evaluate each device against baseline requirements (e.g., disk encryption, current endpoint protection) and deny access to non-compliant systems. This combination directly satisfies both goals of certificate-only authentication and conditional access based on security posture.

Answer

Use a single WPA2-Personal passphrase and email it to all employees.

Answer

Allow any device to join and rely on antivirus scans after users log in.

Answer

Use MAC address filtering and a captive portal for all internal Wi-Fi users.

Question 6

Several users on the same subnet report intermittent loss of access to the default gateway. A packet capture shows repeated unsolicited ARP replies mapping the gateway IP address to a different MAC address. Traffic is occasionally sent through an unknown workstation. What attack is most likely occurring?

Accepted Answer

ARP poisoning. The attack is ARP poisoning (also known as ARP spoofing). The attacker sends unsolicited ARP replies to associate the gateway's IP address with the attacker's MAC address, causing traffic destined for the gateway to be redirected through the attacker's workstation. This results in intermittent connectivity as the attacker can forward or drop packets, and the repeated unsolicited replies overwrite the legitimate ARP cache entries on the victim hosts.

Answer

DNS cache poisoning

Answer

Replay attack

Answer

Amplification attack

Question 7

A security scan finds a critical patch missing on a public-facing web server. The patch has already been tested in the lab and approved for deployment. What should the operations team do next?

Accepted Answer

Deploy the patch through the normal change process as soon as possible. The patch has already been tested and approved, meaning it is ready for deployment. The operations team should follow the normal change management process to deploy the patch as soon as possible, ensuring the public-facing web server is secured against the critical vulnerability without bypassing organizational controls.

Answer

Ignore the finding because the server is already protected by a firewall

Answer

Mark the vulnerability as accepted risk without notifying the business

Answer

Remove the web server from the asset inventory to prevent the scanner from finding it

Question 8

A Linux web server was compromised through an outdated package. The team isolated the host, captured evidence, removed a malicious cron job, patched the vulnerable package, and confirmed no persistence remains. Which incident response phase are they primarily in now?

Accepted Answer

Eradication, because malicious artifacts and the underlying weakness are being removed.. The team has already identified the compromise, isolated the host, and removed the malicious cron job. Patching the vulnerable package addresses the root cause, which is the core of the Eradication phase. Confirming no persistence remains verifies that the eradication was successful, making this the current phase.

Answer

Identification, because the team is still confirming that the event happened.

Answer

Containment, because the host was isolated from the network.

Answer

Lessons learned, because the server has already been secured.

Question 9

A cloud-hosted image-processing API accepts a URL parameter so it can download a picture and generate a thumbnail. Logs show a user submitting `http://169.254.169.254/latest/meta-data/` and receiving instance credentials in the response. Which attack is being used?

Accepted Answer

Server-side request forgery (SSRF). The attack is Server-Side Request Forgery (SSRF) because the cloud-hosted API is tricked into making a request to the internal metadata service at the link-local address 169.254.169.254. This endpoint is only accessible from within the cloud provider's network and exposes instance credentials, which the attacker then receives in the response. SSRF exploits the server's ability to make outbound requests to internal or restricted resources.

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Question 10

Drag and drop the steps for the SSH key exchange process in the correct order.

Accepted Answer

1: Client initiates SSH connection, 2: Server sends host key, 3: Diffie-Hellman key exchange, 4: Encryption established. SSH key exchange establishes a secure channel; the server's host key is used to verify identity, and Diffie-Hellman generates a shared secret.

Answer

1: Client initiates, 2: Diffie-Hellman key exchange, 3: Server sends host key, 4: Encryption established

Answer

1: Server sends host key, 2: Client initiates, 3: Diffie-Hellman key exchange, 4: Encryption established

Answer

1: Client initiates, 2: Server sends host key, 3: Encryption established, 4: Diffie-Hellman key exchange

Question 11

A public-facing web service suddenly becomes very slow. NetFlow shows a high volume of small DNS queries leaving attacker-controlled systems and much larger DNS responses arriving at the victim's IP address from many different resolvers. Which attack is taking place?

Accepted Answer

DNS amplification DDoS. This is a DNS amplification DDoS attack. The attacker sends small DNS queries with a spoofed source IP (the victim's IP) to open DNS resolvers, which then send large DNS responses to the victim. The high volume of small queries and much larger responses from many resolvers is the classic signature of an amplification attack, exploiting the UDP protocol's lack of source verification.

Answer

Replay attack

Answer

ARP poisoning

Answer

Session fixation

Question 12

NetFlow shows one workstation opening SMB connections to a dozen internal servers and then attempting many WinRM connections. What is the most likely explanation?

Accepted Answer

The host is likely being used for lateral movement or internal reconnaissance.. SMB connections to many internal servers followed by WinRM attempts is a classic pattern of lateral movement or internal reconnaissance. An attacker or compromised host uses SMB to probe for accessible shares and then leverages WinRM for remote command execution, which is a common technique in post-exploitation frameworks like PsExec or CrackMapExec.

Answer

The workstation is probably downloading a routine operating system update.

Answer

The network is likely suffering from a wireless interference problem.

Answer

The user is likely printing documents to multiple shared printers.

Question 13

After installing a free utility from an unofficial website, a user's laptop starts quietly sending browsing data to an unknown server. What type of malware is most likely present?

Accepted Answer

Spyware. Spyware is designed to covertly collect user data, such as browsing habits, and transmit it to a remote server without consent. The scenario describes a free utility from an unofficial website that quietly exfiltrates browsing data, which is the classic behavior of spyware. Unlike other malware types, spyware focuses on surveillance and data theft rather than system damage or self-replication.

Answer

Ransomware

Answer

Worm

Answer

Rootkit

Question 14

After several unauthorized edits to firewall objects caused a production outage, a security team wants one control that will flag future configuration drift and another that will automatically restore the approved baseline before the next maintenance window. Which two controls best meet that goal? Select two.

Accepted Answer

File integrity monitoring on firewall configuration files and rule exports.. File integrity monitoring (FIM) on firewall configuration files and rule exports (Option A) detects unauthorized changes by computing cryptographic hashes of baseline files and alerting on any deviation. This directly flags configuration drift, meeting the first requirement. Automated configuration management (Option B) can reapply the approved baseline from a version-controlled repository, restoring the correct state before the next maintenance window, satisfying the second requirement.

Answer

A login banner warning administrators that unauthorized changes are monitored.

Answer

Mandatory annual security awareness training for all IT staff.

Answer

Quarterly business impact reviews of the firewall change log.

Question 15

A help desk team needs to update desktops in a call center without interrupting callers during peak hours. What is the best operational approach?

Accepted Answer

Schedule the updates during an approved maintenance window. Scheduling updates during an approved maintenance window ensures that desktops are updated during a period of low activity, minimizing disruption to call center operations. This approach aligns with change management best practices, allowing for controlled deployment and rollback if issues arise, and avoids the performance degradation or reboots that could interrupt active calls.

Answer

Deploy the updates immediately to all desktops at once

Answer

Ask each user to install updates whenever they have time

Answer

Disable update notifications permanently