SY0-701 Practice Test 48 — 15 Questions

Question 1

A developer wants to reduce the risk of SQL injection in a new customer search form. Which two changes are the best mitigations? Select two.

Accepted Answer

Use parameterized queries or prepared statements for all database access.. Parameterized queries and prepared statements separate SQL logic from user-supplied data, ensuring that input is treated as a literal value rather than executable code. This prevents attackers from injecting malicious SQL commands into the query string, as the database driver automatically escapes or binds parameters safely. This is the most effective defense against SQL injection attacks.

Answer

Store the database password in the page source so the app can connect faster.

Answer

Disable TLS so the application can inspect requests more easily.

Answer

Allow the application to build SQL statements by concatenating raw user input.

Question 2

A developer requests a 45-day exception to use an unsupported browser plug-in on two engineering workstations so a legacy design tool can finish a customer deliverable. Which three conditions should be required before approving the exception? Select three.

Accepted Answer

Document a business justification that explains why the plug-in is required for the deliverable.. Documenting a business justification provides a formal record of why the exception is necessary, ensuring that the risk of using an unsupported browser plug-in is understood and accepted by management. This aligns with the principle of risk acceptance, where the business need outweighs the security risk for a limited time. Without a clear justification, the exception could be granted without proper oversight, potentially leading to unchecked vulnerabilities.

Answer

Convert the exception into a permanent waiver to avoid repeated review overhead.

Answer

Allow the requestor to self-approve the exception if the project deadline is urgent.

Question 3

A help desk technician reports several workstations are suddenly showing lots of pop-up ads and browser redirects after users installed a free media player. What type of unwanted software is most likely present?

Accepted Answer

Adware. Adware is the most likely culprit because it is a type of unwanted software designed to display intrusive advertisements, often through pop-up ads and browser redirects. The infection vector—users installing a free media player—is a classic distribution method for adware, which bundles itself with legitimate software to generate revenue via ad impressions. Unlike ransomware or rootkits, adware does not encrypt files or hide its presence; it directly manipulates browser sessions to serve ads.

Answer

Ransomware

Answer

Rootkit

Answer

Logic bomb

Question 4

A file contains employee Social Security numbers and bank account details. The company uses the labels Public, Internal, Confidential, and Restricted. Which label is most appropriate?

Accepted Answer

Restricted, because it contains highly sensitive personal and financial information. Social Security numbers and bank account details are classified as personally identifiable information (PII) and financial data, which are subject to strict regulatory requirements (e.g., GDPR, PCI DSS). The 'Restricted' label is designed for the most sensitive data that requires the highest level of access control and encryption, making it the correct choice for this scenario.

Answer

Public, because employees may need to share it with outside vendors

Answer

Internal, because only company staff should see it

Answer

Confidential, because the information is sensitive but not highly regulated

Question 5

A help desk technician receives a phone call from someone claiming to be a contractor. The caller says their MFA app was lost, asks the technician to enroll a new device immediately, and pressures them to ignore policy. What type of attack is this?

Accepted Answer

Vishing. This is a vishing (voice phishing) attack because the attacker uses a phone call to impersonate a contractor and socially engineer the technician into bypassing MFA enrollment policies. Vishing specifically exploits voice communication to manipulate victims, unlike phishing which uses email or malicious links.

Answer

Phishing

Answer

Smishing

Answer

Baiting

Question 6

After restoring a virtual file server from backup, users can open shares, but the accounting application shows the previous day's transactions are missing. Which two steps should the administrator take next? Select two.

Accepted Answer

Verify whether the backup included application-consistent data and transaction logs. The accounting application's missing transactions indicate the backup may not have captured application-consistent data, such as open transaction logs or database writes. Without application consistency (e.g., using Volume Shadow Copy Service or a database-aware backup agent), the restore point may reflect a crash-consistent state where recent transactions were lost. Verifying the backup type ensures the administrator understands whether the data is recoverable from transaction logs or requires a separate application-level restore.

Answer

Leave the server as is because file shares are accessible

Answer

Delete the current backup set to avoid restoring the wrong version again

Answer

Reimage the server immediately without checking the restore point

Question 7

Sales representatives use company-managed smartphones for email, CRM, and document access. If a phone is lost, IT must remove only the corporate apps and work data without erasing the employee's personal photos and contacts. Which control should be used?

Accepted Answer

Use selective wipe through a mobile device management platform.. Mobile Device Management (MDM) platforms support selective wipe, which uses management APIs (e.g., Android Enterprise Work Profile or iOS Managed Open In) to remove only corporate apps, accounts, and data while leaving personal content intact. This satisfies the requirement to protect corporate data without infringing on the employee's personal privacy.

Answer

Perform a full factory reset remotely as soon as any device is reported lost.

Answer

Disable password complexity so the user can regain access more easily after replacement.

Answer

Install a VPN profile and assume corporate data is safe if the network traffic is encrypted.

Question 8

An accounts payable specialist receives an email inside an existing vendor thread that asks for a last-minute bank-account change before a payment run. The wording is professional, the signature matches, and the request is urgent. Which three actions should the specialist take? Select three.

Accepted Answer

Verify the request through a known out-of-band contact method for the vendor.. Verifying the request through a known out-of-band contact method (e.g., a phone call to a previously documented vendor number) directly mitigates the risk of business email compromise (BEC). Attackers often hijack or spoof legitimate email threads, so in-band verification (replying within the thread) is unreliable. This aligns with the principle of dual control and independent verification for sensitive financial changes.

Answer

Reply in the same thread because the address and signature look legitimate.

Answer

Process the change immediately to avoid delaying the vendor relationship.

Question 9

After a phishing campaign, 18 employees entered credentials on a fake login page. Management wants a program that both reduces future click rates and provides measurable improvement over time. What should security implement?

Accepted Answer

Simulated phishing with targeted follow-up training and metrics. Simulated phishing campaigns directly address the human factor by providing a controlled, repeatable test that measures click rates over time. When an employee falls for the simulation, targeted follow-up training (e.g., micro-learning modules) reinforces secure behavior, and the metrics (e.g., click-through rate, reporting rate) allow management to track improvement. This aligns with the security program management goal of continuous improvement through measurable security awareness.

Answer

A one-time company email reminding employees to be careful

Answer

An updated password complexity rule for all users

Answer

A banner that all external email is untrusted

Question 10

A server room is sometimes left open while technicians carry equipment in and out. Which control best helps detect and discourage unauthorized entry?

Accepted Answer

A CCTV camera covering the entrance. A CCTV camera covering the entrance provides continuous monitoring and recording of activity, which both detects unauthorized entry in real time and creates a deterrent effect through the awareness of surveillance. Unlike passive measures, it offers forensic evidence and can be integrated with access control systems to alert security personnel of breaches.

Answer

A written reminder poster on the wall

Answer

A brighter color for the server room door

Answer

A larger monitor in the nearby office

Question 11

A business unit asks for a 30-day exception to use an unsupported browser plug-in on two engineering workstations while a replacement is tested. Which three conditions should be required before approval? Select three.

Accepted Answer

A documented business justification for why the plug-in is still needed.. A documented business justification ensures that the exception is necessary and aligns with organizational risk appetite. Without a clear reason, the exception could be granted for convenience rather than critical need, undermining security governance. This justification also provides an audit trail for why an unsupported, potentially vulnerable plug-in is still in use.

Answer

An open-ended waiver so the team can continue if testing slips.

Answer

Verbal approval only, with no written record.

Question 12

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Accepted Answer

Enter global configuration mode, then specify the destination network and subnet mask, then specify the next-hop IP address or exit interface.. Static routes require global config mode and must specify the destination network, subnet mask, and next-hop address or exit interface.

Answer

Specify the destination network and subnet mask, then enter global configuration mode, then specify the next-hop IP address or exit interface.

Answer

Specify the next-hop IP address or exit interface, then enter global configuration mode, then specify the destination network and subnet mask.

Answer

Enter global configuration mode, then specify the next-hop IP address or exit interface, then specify the destination network and subnet mask.

Question 13

A security manager publishes a document that tells help desk staff exactly how to verify identity, reset an admin password, record the ticket number, and close out the request during a maintenance window. What type of governance artifact is this?

Accepted Answer

Procedure. A procedure is a step-by-step, ordered list of tasks required to perform a specific operational activity. The document describes exactly how to verify identity, reset an admin password, record the ticket number, and close out the request, which matches the definition of a procedure in governance frameworks.

Answer

Policy

Answer

Standard

Answer

Guideline

Question 14

Employees use a browser SaaS portal, a native mobile app, and an internal API. The company wants one corporate identity, reduced password reuse, and automated removal of access when HR terminates users. Which two solutions best meet the requirement? Select two.

Accepted Answer

Use federation so the SaaS apps trust the company's identity provider.. Federation (B) allows the SaaS portal, mobile app, and internal API to trust a single corporate identity provider (IdP) using standards like SAML 2.0 or OIDC. This gives employees one set of credentials, reduces password reuse, and enables centralized control. When HR terminates a user, the IdP can revoke access instantly, affecting all federated applications.

Answer

Create separate local usernames and passwords in each application for every employee.

Answer

Store passwords in a shared vault and let users retrieve them when needed.

Answer

Allow the mobile app to authenticate only from remembered devices, without central identity controls.

Question 15

Drag and drop the steps for the RADIUS authentication process into the correct order.

Accepted Answer

User connects to NAS, NAS sends Access-Request, RADIUS server verifies credentials and sends Access-Accept, NAS grants access.. RADIUS uses UDP; the NAS acts as a client to the RADIUS server, which authenticates and authorizes the user.

Answer

NAS sends Access-Request, user connects to NAS, RADIUS server sends Access-Accept, NAS grants access.

Answer

User connects to NAS, RADIUS server sends Access-Accept, NAS sends Access-Request, NAS grants access.

Answer

User connects to NAS, NAS sends Access-Request, NAS grants access, RADIUS server sends Access-Accept.