SY0-701 Practice Test 47 — 15 Questions

Question 1

Drag and drop the steps for the SSH key exchange process in the correct order.

Accepted Answer

1: Client initiates SSH connection, 2: Server sends host key, 3: Diffie-Hellman key exchange, 4: Encryption established. SSH key exchange establishes a secure channel; the server's host key is used to verify identity, and Diffie-Hellman generates a shared secret.

Answer

1: Client initiates, 2: Diffie-Hellman key exchange, 3: Server sends host key, 4: Encryption established

Answer

1: Server sends host key, 2: Client initiates, 3: Diffie-Hellman key exchange, 4: Encryption established

Answer

1: Client initiates, 2: Server sends host key, 3: Encryption established, 4: Diffie-Hellman key exchange

Question 2

A public-facing web service suddenly becomes very slow. NetFlow shows a high volume of small DNS queries leaving attacker-controlled systems and much larger DNS responses arriving at the victim's IP address from many different resolvers. Which attack is taking place?

Accepted Answer

DNS amplification DDoS. This is a DNS amplification DDoS attack. The attacker sends small DNS queries with a spoofed source IP (the victim's IP) to open DNS resolvers, which then send large DNS responses to the victim. The high volume of small queries and much larger responses from many resolvers is the classic signature of an amplification attack, exploiting the UDP protocol's lack of source verification.

Answer

Replay attack

Answer

ARP poisoning

Answer

Session fixation

Question 3

NetFlow shows one workstation opening SMB connections to a dozen internal servers and then attempting many WinRM connections. What is the most likely explanation?

Accepted Answer

The host is likely being used for lateral movement or internal reconnaissance.. SMB connections to many internal servers followed by WinRM attempts is a classic pattern of lateral movement or internal reconnaissance. An attacker or compromised host uses SMB to probe for accessible shares and then leverages WinRM for remote command execution, which is a common technique in post-exploitation frameworks like PsExec or CrackMapExec.

Answer

The workstation is probably downloading a routine operating system update.

Answer

The network is likely suffering from a wireless interference problem.

Answer

The user is likely printing documents to multiple shared printers.

Question 4

After installing a free utility from an unofficial website, a user's laptop starts quietly sending browsing data to an unknown server. What type of malware is most likely present?

Accepted Answer

Spyware. Spyware is designed to covertly collect user data, such as browsing habits, and transmit it to a remote server without consent. The scenario describes a free utility from an unofficial website that quietly exfiltrates browsing data, which is the classic behavior of spyware. Unlike other malware types, spyware focuses on surveillance and data theft rather than system damage or self-replication.

Answer

Ransomware

Answer

Worm

Answer

Rootkit

Question 5

After several unauthorized edits to firewall objects caused a production outage, a security team wants one control that will flag future configuration drift and another that will automatically restore the approved baseline before the next maintenance window. Which two controls best meet that goal? Select two.

Accepted Answer

File integrity monitoring on firewall configuration files and rule exports.. File integrity monitoring (FIM) on firewall configuration files and rule exports (Option A) detects unauthorized changes by computing cryptographic hashes of baseline files and alerting on any deviation. This directly flags configuration drift, meeting the first requirement. Automated configuration management (Option B) can reapply the approved baseline from a version-controlled repository, restoring the correct state before the next maintenance window, satisfying the second requirement.

Answer

A login banner warning administrators that unauthorized changes are monitored.

Answer

Mandatory annual security awareness training for all IT staff.

Answer

Quarterly business impact reviews of the firewall change log.

Question 6

A help desk team needs to update desktops in a call center without interrupting callers during peak hours. What is the best operational approach?

Accepted Answer

Schedule the updates during an approved maintenance window. Scheduling updates during an approved maintenance window ensures that desktops are updated during a period of low activity, minimizing disruption to call center operations. This approach aligns with change management best practices, allowing for controlled deployment and rollback if issues arise, and avoids the performance degradation or reboots that could interrupt active calls.

Answer

Deploy the updates immediately to all desktops at once

Answer

Ask each user to install updates whenever they have time

Answer

Disable update notifications permanently

Question 7

A developer wants to reduce the risk of SQL injection in a new customer search form. Which two changes are the best mitigations? Select two.

Accepted Answer

Use parameterized queries or prepared statements for all database access.. Parameterized queries and prepared statements separate SQL logic from user-supplied data, ensuring that input is treated as a literal value rather than executable code. This prevents attackers from injecting malicious SQL commands into the query string, as the database driver automatically escapes or binds parameters safely. This is the most effective defense against SQL injection attacks.

Answer

Store the database password in the page source so the app can connect faster.

Answer

Disable TLS so the application can inspect requests more easily.

Answer

Allow the application to build SQL statements by concatenating raw user input.

Question 8

A developer requests a 45-day exception to use an unsupported browser plug-in on two engineering workstations so a legacy design tool can finish a customer deliverable. Which three conditions should be required before approving the exception? Select three.

Accepted Answer

Document a business justification that explains why the plug-in is required for the deliverable.. Documenting a business justification provides a formal record of why the exception is necessary, ensuring that the risk of using an unsupported browser plug-in is understood and accepted by management. This aligns with the principle of risk acceptance, where the business need outweighs the security risk for a limited time. Without a clear justification, the exception could be granted without proper oversight, potentially leading to unchecked vulnerabilities.

Answer

Convert the exception into a permanent waiver to avoid repeated review overhead.

Answer

Allow the requestor to self-approve the exception if the project deadline is urgent.

Question 9

A help desk technician reports several workstations are suddenly showing lots of pop-up ads and browser redirects after users installed a free media player. What type of unwanted software is most likely present?

Accepted Answer

Adware. Adware is the most likely culprit because it is a type of unwanted software designed to display intrusive advertisements, often through pop-up ads and browser redirects. The infection vector—users installing a free media player—is a classic distribution method for adware, which bundles itself with legitimate software to generate revenue via ad impressions. Unlike ransomware or rootkits, adware does not encrypt files or hide its presence; it directly manipulates browser sessions to serve ads.

Answer

Ransomware

Answer

Rootkit

Answer

Logic bomb

Question 10

A file contains employee Social Security numbers and bank account details. The company uses the labels Public, Internal, Confidential, and Restricted. Which label is most appropriate?

Accepted Answer

Restricted, because it contains highly sensitive personal and financial information. Social Security numbers and bank account details are classified as personally identifiable information (PII) and financial data, which are subject to strict regulatory requirements (e.g., GDPR, PCI DSS). The 'Restricted' label is designed for the most sensitive data that requires the highest level of access control and encryption, making it the correct choice for this scenario.

Answer

Public, because employees may need to share it with outside vendors

Answer

Internal, because only company staff should see it

Answer

Confidential, because the information is sensitive but not highly regulated

Question 11

A help desk technician receives a phone call from someone claiming to be a contractor. The caller says their MFA app was lost, asks the technician to enroll a new device immediately, and pressures them to ignore policy. What type of attack is this?

Accepted Answer

Vishing. This is a vishing (voice phishing) attack because the attacker uses a phone call to impersonate a contractor and socially engineer the technician into bypassing MFA enrollment policies. Vishing specifically exploits voice communication to manipulate victims, unlike phishing which uses email or malicious links.

Answer

Phishing

Answer

Smishing

Answer

Baiting

Question 12

After restoring a virtual file server from backup, users can open shares, but the accounting application shows the previous day's transactions are missing. Which two steps should the administrator take next? Select two.

Accepted Answer

Verify whether the backup included application-consistent data and transaction logs. The accounting application's missing transactions indicate the backup may not have captured application-consistent data, such as open transaction logs or database writes. Without application consistency (e.g., using Volume Shadow Copy Service or a database-aware backup agent), the restore point may reflect a crash-consistent state where recent transactions were lost. Verifying the backup type ensures the administrator understands whether the data is recoverable from transaction logs or requires a separate application-level restore.

Answer

Leave the server as is because file shares are accessible

Answer

Delete the current backup set to avoid restoring the wrong version again

Answer

Reimage the server immediately without checking the restore point

Question 13

Sales representatives use company-managed smartphones for email, CRM, and document access. If a phone is lost, IT must remove only the corporate apps and work data without erasing the employee's personal photos and contacts. Which control should be used?

Accepted Answer

Use selective wipe through a mobile device management platform.. Mobile Device Management (MDM) platforms support selective wipe, which uses management APIs (e.g., Android Enterprise Work Profile or iOS Managed Open In) to remove only corporate apps, accounts, and data while leaving personal content intact. This satisfies the requirement to protect corporate data without infringing on the employee's personal privacy.

Answer

Perform a full factory reset remotely as soon as any device is reported lost.

Answer

Disable password complexity so the user can regain access more easily after replacement.

Answer

Install a VPN profile and assume corporate data is safe if the network traffic is encrypted.

Question 14

An accounts payable specialist receives an email inside an existing vendor thread that asks for a last-minute bank-account change before a payment run. The wording is professional, the signature matches, and the request is urgent. Which three actions should the specialist take? Select three.

Accepted Answer

Verify the request through a known out-of-band contact method for the vendor.. Verifying the request through a known out-of-band contact method (e.g., a phone call to a previously documented vendor number) directly mitigates the risk of business email compromise (BEC). Attackers often hijack or spoof legitimate email threads, so in-band verification (replying within the thread) is unreliable. This aligns with the principle of dual control and independent verification for sensitive financial changes.

Answer

Reply in the same thread because the address and signature look legitimate.

Answer

Process the change immediately to avoid delaying the vendor relationship.

Question 15

After a phishing campaign, 18 employees entered credentials on a fake login page. Management wants a program that both reduces future click rates and provides measurable improvement over time. What should security implement?

Accepted Answer

Simulated phishing with targeted follow-up training and metrics. Simulated phishing campaigns directly address the human factor by providing a controlled, repeatable test that measures click rates over time. When an employee falls for the simulation, targeted follow-up training (e.g., micro-learning modules) reinforces secure behavior, and the metrics (e.g., click-through rate, reporting rate) allow management to track improvement. This aligns with the security program management goal of continuous improvement through measurable security awareness.

Answer

A one-time company email reminding employees to be careful

Answer

An updated password complexity rule for all users

Answer

A banner that all external email is untrusted