SY0-701 Practice Test 48 — 15 Questions

Question 1

A server room is sometimes left open while technicians carry equipment in and out. Which control best helps detect and discourage unauthorized entry?

Accepted Answer

A CCTV camera covering the entrance. A CCTV camera covering the entrance provides continuous monitoring and recording of activity, which both detects unauthorized entry in real time and creates a deterrent effect through the awareness of surveillance. Unlike passive measures, it offers forensic evidence and can be integrated with access control systems to alert security personnel of breaches.

Answer

A written reminder poster on the wall

Answer

A brighter color for the server room door

Answer

A larger monitor in the nearby office

Question 2

A business unit asks for a 30-day exception to use an unsupported browser plug-in on two engineering workstations while a replacement is tested. Which three conditions should be required before approval? Select three.

Accepted Answer

A documented business justification for why the plug-in is still needed.. A documented business justification ensures that the exception is necessary and aligns with organizational risk appetite. Without a clear reason, the exception could be granted for convenience rather than critical need, undermining security governance. This justification also provides an audit trail for why an unsupported, potentially vulnerable plug-in is still in use.

Answer

An open-ended waiver so the team can continue if testing slips.

Answer

Verbal approval only, with no written record.

Question 3

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Accepted Answer

Enter global configuration mode, then specify the destination network and subnet mask, then specify the next-hop IP address or exit interface.. Static routes require global config mode and must specify the destination network, subnet mask, and next-hop address or exit interface.

Answer

Specify the destination network and subnet mask, then enter global configuration mode, then specify the next-hop IP address or exit interface.

Answer

Specify the next-hop IP address or exit interface, then enter global configuration mode, then specify the destination network and subnet mask.

Answer

Enter global configuration mode, then specify the next-hop IP address or exit interface, then specify the destination network and subnet mask.

Question 4

A security manager publishes a document that tells help desk staff exactly how to verify identity, reset an admin password, record the ticket number, and close out the request during a maintenance window. What type of governance artifact is this?

Accepted Answer

Procedure. A procedure is a step-by-step, ordered list of tasks required to perform a specific operational activity. The document describes exactly how to verify identity, reset an admin password, record the ticket number, and close out the request, which matches the definition of a procedure in governance frameworks.

Answer

Policy

Answer

Standard

Answer

Guideline

Question 5

Employees use a browser SaaS portal, a native mobile app, and an internal API. The company wants one corporate identity, reduced password reuse, and automated removal of access when HR terminates users. Which two solutions best meet the requirement? Select two.

Accepted Answer

Use federation so the SaaS apps trust the company's identity provider.. Federation (B) allows the SaaS portal, mobile app, and internal API to trust a single corporate identity provider (IdP) using standards like SAML 2.0 or OIDC. This gives employees one set of credentials, reduces password reuse, and enables centralized control. When HR terminates a user, the IdP can revoke access instantly, affecting all federated applications.

Answer

Create separate local usernames and passwords in each application for every employee.

Answer

Store passwords in a shared vault and let users retrieve them when needed.

Answer

Allow the mobile app to authenticate only from remembered devices, without central identity controls.

Question 6

Drag and drop the steps for the RADIUS authentication process into the correct order.

Accepted Answer

User connects to NAS, NAS sends Access-Request, RADIUS server verifies credentials and sends Access-Accept, NAS grants access.. RADIUS uses UDP; the NAS acts as a client to the RADIUS server, which authenticates and authorizes the user.

Answer

NAS sends Access-Request, user connects to NAS, RADIUS server sends Access-Accept, NAS grants access.

Answer

User connects to NAS, RADIUS server sends Access-Accept, NAS sends Access-Request, NAS grants access.

Answer

User connects to NAS, NAS sends Access-Request, NAS grants access, RADIUS server sends Access-Accept.

Question 7

Drag and drop the steps for the TLS 1.3 handshake process into the correct order.

Accepted Answer

Step 1: ClientHello (with key share), Step 2: ServerHello + EncryptedExtensions + Certificate + CertificateVerify + Finished, Step 3: Client Finished. TLS 1.3 reduces round trips; the client and server exchange key shares early, and the server's certificate is sent in the second flight.

Answer

Step 1: ClientHello, Step 2: Client Finished, Step 3: ServerHello + EncryptedExtensions + Certificate + CertificateVerify + Finished

Answer

Step 1: ServerHello + EncryptedExtensions + Certificate + CertificateVerify + Finished, Step 2: ClientHello, Step 3: Client Finished

Answer

Step 1: ServerHello + EncryptedExtensions + Certificate + CertificateVerify + Finished, Step 2: Client Finished, Step 3: ClientHello

Question 8

A user says their files suddenly have a new extension and a note appears demanding payment to restore access. Which type of malware is most likely involved?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts files and appends a new extension, then displays a ransom note demanding payment for decryption. This matches the user's description of files becoming inaccessible with a new extension and a payment demand.

Answer

Adware

Answer

Spam filter

Answer

Screen saver

Question 9

A development team stores container images in a registry before deployment. Security wants to reduce the chance of shipping vulnerable libraries or packages inside the image. What should the team do before release?

Accepted Answer

Scan the image and rebuild it from an approved base image.. Scanning the image for known vulnerabilities (CVEs) and rebuilding it from an approved, hardened base image ensures that only trusted, patched libraries and packages are included. This directly reduces the attack surface by eliminating vulnerable components before the image is deployed to production.

Answer

Run the container as root so startup problems are less likely.

Answer

Open the container port on the host firewall so the image can be reached faster.

Answer

Add more CPU and memory to the cluster to improve image security.

Question 10

A customer portal must keep serving users if one application server fails and also remain available if the primary site becomes unreachable. Management prefers automatic recovery over manual intervention. Which two design choices best satisfy the goal? Select two.

Accepted Answer

Deploy multiple application servers behind a load balancer across separate availability zones.. Deploying multiple application servers behind a load balancer across separate availability zones (A) provides redundancy at the application tier: if one server fails, traffic is automatically redirected to healthy servers. Replicating the database to a standby site with automatic failover (E) ensures that if the primary site becomes unreachable, the database can be promoted to active without manual intervention, meeting the requirement for automatic recovery.

Answer

Use a single high-end server with RAID 10 and a larger power supply.

Answer

Keep only nightly backups and restore manually after an outage.

Answer

Store the database on a local disk array attached to the primary server.

Question 11

A finance manager gets a phone call from someone claiming to be the CEO's assistant, urgently requesting a wire transfer before a board meeting. What type of attack is this?

Accepted Answer

Vishing. B is correct because vishing (voice phishing) uses a phone call to socially engineer the victim into performing a sensitive action, such as a wire transfer. The attacker impersonates a trusted authority (the CEO's assistant) and exploits urgency to bypass normal verification procedures. This is distinct from text-based phishing (smishing) or targeted email attacks (spear phishing).

Answer

Smishing

Answer

Spear phishing

Answer

Watering-hole attack

Question 12

Based on the exhibit, which improvement best aligns the current backup design with the stated recovery targets?

Accepted Answer

Switch to frequent incremental or snapshot backups stored in a separate, immutable location with routine restore tests.. The current backup design lacks off-site, immutable storage and routine restore testing, which are critical to meet recovery point and time objectives (RPO/RTO). Frequent incremental or snapshot backups in a separate, immutable location protect against ransomware and ensure data integrity, while routine restore tests verify that backups are actually recoverable when needed.

Answer

Keep the same design but extend backup retention from 30 days to 90 days.

Answer

Share the backup administrator password in a team chat so any engineer can restore data during an outage.

Answer

Remove backup encryption so restores run faster during an emergency.

Question 13

Drag and drop the steps for a typical digital forensics investigation process in the correct order.

Accepted Answer

Identification, then Preservation, then Collection, then Examination, then Analysis, then Reporting. Digital forensics follows a structured process: identification, preservation, collection, examination, analysis, and reporting.

Answer

Preservation, then Identification, then Collection, then Examination, then Analysis, then Reporting

Answer

Identification, then Collection, then Preservation, then Examination, then Analysis, then Reporting

Answer

Identification, then Preservation, then Collection, then Analysis, then Examination, then Reporting

Question 14

A security team receives a suspicious email attachment and wants to inspect its behavior safely before any user opens it. They also want a tool that can isolate the same threat if it reaches an endpoint. Which two tools or capabilities best fit this need? Select two.

Accepted Answer

EDR remote isolation capability on the endpoint.. A is correct because EDR remote isolation capability allows the security team to immediately disconnect an endpoint from the network if the suspicious attachment is executed, preventing lateral movement and data exfiltration. B is correct because sandboxing the attachment before release to users provides a safe, isolated environment to analyze the file's behavior without risking the production network. Together, these tools address both proactive analysis (sandbox) and reactive containment (EDR isolation).

Answer

DLP monitoring to prevent accidental data leakage.

Answer

A WAF filtering web requests to the application.

Answer

Port mirroring on a switch for traffic review.

Question 15

A network analyst reviews packet captures from a subnet where users intermittently lose access to the gateway. Which two findings would most strongly indicate ARP spoofing? Select two.

Accepted Answer

Repeated unsolicited ARP replies map the gateway IP to a different MAC address.. ARP spoofing involves an attacker sending forged ARP replies to associate the gateway's IP address with the attacker's MAC address. Repeated unsolicited ARP replies mapping the gateway IP to a different MAC address is a classic indicator, as legitimate ARP replies are normally solicited by requests. This causes traffic intended for the gateway to be redirected to the attacker, enabling interception or disruption.

Answer

Extra DNS traffic appears during the lunch hour.

Answer

A switch port negotiates a slower speed than usual.

Answer

The wireless network name appears in a site survey.