SY0-701 Practice Test 49 — 15 Questions

Question 1

Drag and drop the steps for the TLS 1.3 handshake process into the correct order.

Accepted Answer

Step 1: ClientHello (with key share), Step 2: ServerHello + EncryptedExtensions + Certificate + CertificateVerify + Finished, Step 3: Client Finished. TLS 1.3 reduces round trips; the client and server exchange key shares early, and the server's certificate is sent in the second flight.

Answer

Step 1: ClientHello, Step 2: Client Finished, Step 3: ServerHello + EncryptedExtensions + Certificate + CertificateVerify + Finished

Answer

Step 1: ServerHello + EncryptedExtensions + Certificate + CertificateVerify + Finished, Step 2: ClientHello, Step 3: Client Finished

Answer

Step 1: ServerHello + EncryptedExtensions + Certificate + CertificateVerify + Finished, Step 2: Client Finished, Step 3: ClientHello

Question 2

A user says their files suddenly have a new extension and a note appears demanding payment to restore access. Which type of malware is most likely involved?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts files and appends a new extension, then displays a ransom note demanding payment for decryption. This matches the user's description of files becoming inaccessible with a new extension and a payment demand.

Answer

Adware

Answer

Spam filter

Answer

Screen saver

Question 3

A development team stores container images in a registry before deployment. Security wants to reduce the chance of shipping vulnerable libraries or packages inside the image. What should the team do before release?

Accepted Answer

Scan the image and rebuild it from an approved base image.. Scanning the image for known vulnerabilities (CVEs) and rebuilding it from an approved, hardened base image ensures that only trusted, patched libraries and packages are included. This directly reduces the attack surface by eliminating vulnerable components before the image is deployed to production.

Answer

Run the container as root so startup problems are less likely.

Answer

Open the container port on the host firewall so the image can be reached faster.

Answer

Add more CPU and memory to the cluster to improve image security.

Question 4

A customer portal must keep serving users if one application server fails and also remain available if the primary site becomes unreachable. Management prefers automatic recovery over manual intervention. Which two design choices best satisfy the goal? Select two.

Accepted Answer

Deploy multiple application servers behind a load balancer across separate availability zones.. Deploying multiple application servers behind a load balancer across separate availability zones (A) provides redundancy at the application tier: if one server fails, traffic is automatically redirected to healthy servers. Replicating the database to a standby site with automatic failover (E) ensures that if the primary site becomes unreachable, the database can be promoted to active without manual intervention, meeting the requirement for automatic recovery.

Answer

Use a single high-end server with RAID 10 and a larger power supply.

Answer

Keep only nightly backups and restore manually after an outage.

Answer

Store the database on a local disk array attached to the primary server.

Question 5

A finance manager gets a phone call from someone claiming to be the CEO's assistant, urgently requesting a wire transfer before a board meeting. What type of attack is this?

Accepted Answer

Vishing. B is correct because vishing (voice phishing) uses a phone call to socially engineer the victim into performing a sensitive action, such as a wire transfer. The attacker impersonates a trusted authority (the CEO's assistant) and exploits urgency to bypass normal verification procedures. This is distinct from text-based phishing (smishing) or targeted email attacks (spear phishing).

Answer

Smishing

Answer

Spear phishing

Answer

Watering-hole attack

Question 6

Based on the exhibit, which improvement best aligns the current backup design with the stated recovery targets?

Accepted Answer

Switch to frequent incremental or snapshot backups stored in a separate, immutable location with routine restore tests.. The current backup design lacks off-site, immutable storage and routine restore testing, which are critical to meet recovery point and time objectives (RPO/RTO). Frequent incremental or snapshot backups in a separate, immutable location protect against ransomware and ensure data integrity, while routine restore tests verify that backups are actually recoverable when needed.

Answer

Keep the same design but extend backup retention from 30 days to 90 days.

Answer

Share the backup administrator password in a team chat so any engineer can restore data during an outage.

Answer

Remove backup encryption so restores run faster during an emergency.

Question 7

Drag and drop the steps for a typical digital forensics investigation process in the correct order.

Accepted Answer

Identification, then Preservation, then Collection, then Examination, then Analysis, then Reporting. Digital forensics follows a structured process: identification, preservation, collection, examination, analysis, and reporting.

Answer

Preservation, then Identification, then Collection, then Examination, then Analysis, then Reporting

Answer

Identification, then Collection, then Preservation, then Examination, then Analysis, then Reporting

Answer

Identification, then Preservation, then Collection, then Analysis, then Examination, then Reporting

Question 8

A security team receives a suspicious email attachment and wants to inspect its behavior safely before any user opens it. They also want a tool that can isolate the same threat if it reaches an endpoint. Which two tools or capabilities best fit this need? Select two.

Accepted Answer

EDR remote isolation capability on the endpoint.. A is correct because EDR remote isolation capability allows the security team to immediately disconnect an endpoint from the network if the suspicious attachment is executed, preventing lateral movement and data exfiltration. B is correct because sandboxing the attachment before release to users provides a safe, isolated environment to analyze the file's behavior without risking the production network. Together, these tools address both proactive analysis (sandbox) and reactive containment (EDR isolation).

Answer

DLP monitoring to prevent accidental data leakage.

Answer

A WAF filtering web requests to the application.

Answer

Port mirroring on a switch for traffic review.

Question 9

A network analyst reviews packet captures from a subnet where users intermittently lose access to the gateway. Which two findings would most strongly indicate ARP spoofing? Select two.

Accepted Answer

Repeated unsolicited ARP replies map the gateway IP to a different MAC address.. ARP spoofing involves an attacker sending forged ARP replies to associate the gateway's IP address with the attacker's MAC address. Repeated unsolicited ARP replies mapping the gateway IP to a different MAC address is a classic indicator, as legitimate ARP replies are normally solicited by requests. This causes traffic intended for the gateway to be redirected to the attacker, enabling interception or disruption.

Answer

Extra DNS traffic appears during the lunch hour.

Answer

A switch port negotiates a slower speed than usual.

Answer

The wireless network name appears in a site survey.

Question 10

A workstation is suspected of running malware and contacting an unknown host. Which two actions belong in the containment phase? Select two.

Accepted Answer

Isolate the workstation from the network.. Isolating the workstation from the network (A) immediately stops the malware's ability to communicate with the command-and-control (C2) server, preventing data exfiltration and further propagation. Blocking the malicious IP or domain at the firewall or proxy (B) is a containment action that prevents any system on the network from reaching the known malicious host, even if other hosts are already compromised. Both actions align with the NIST SP 800-61 containment strategy of stopping the spread and impact of an incident.

Answer

Reimage the workstation immediately before collecting evidence.

Answer

Tell the user to keep working until tomorrow.

Answer

Delete recent logs to reduce noise.

Question 11

Match each network segment to the best use in a small enterprise.

Accepted Answer

Guest Wi-Fi: Used for external users to access the internet without accessing internal resources.. Each segment serves a specific purpose: guest Wi-Fi for external users, DMZ for public services, internal LAN for daily operations, management for device control, data center for core infrastructure, VPN for secure remote access.

Answer

VPN: Used for managing network devices (switches, routers).

Answer

Management: Provides secure remote access to internal network for employees.

Question 12

A SOC analyst reviews one user account and sees several failed logins from a single IP, then a successful login from the same IP, followed by a new inbox forwarding rule to an external address. Which two findings most strongly suggest account compromise? Select two.

Accepted Answer

Repeated failed logins followed by a successful login from the same source IP.. A brute-force attack pattern—multiple failed logins followed by a successful authentication from the same external IP—strongly indicates credential compromise. This sequence suggests the attacker guessed or obtained the password and then successfully logged in. The single source IP ties the failed attempts to the eventual successful session, making it a classic indicator of account takeover.

Answer

The user authenticated during normal business hours.

Answer

The user accessed email from a corporate laptop.

Answer

The password age is 89 days.

Question 13

A user reports that their laptop is showing frequent pop-up ads, the browser homepage keeps changing, and the system has become noticeably slower. What is the most likely immediate containment action?

Accepted Answer

Disconnect the laptop from the network and begin endpoint isolation. The best immediate action is to isolate the laptop from the network. The symptoms suggest malicious or unwanted software may be communicating with outside servers or affecting the browser. Isolation limits further damage, prevents possible spread, and gives responders time to inspect the system safely. This is a standard first containment step when a workstation appears compromised but is still active.

Why others are wrong: Keeping the laptop online risks continued malicious activity. Reimaging too early can destroy evidence needed for root-cause analysis. Simply reinstalling the browser may remove a symptom, but it does not address the possibility of a broader endpoint compromise.

Answer

Keep the laptop online so security tools can continue collecting data

Answer

Immediately reimage the laptop before preserving any evidence

Answer

Ask the user to uninstall the browser and reinstall it manually

Question 14

Match the security need to the best cryptographic solution.

Accepted Answer

Confidentiality: Encryption. Confidentiality uses encryption; integrity uses hashes; authentication uses certificates; non-repudiation uses signatures; access control uses PKI; availability uses redundancy.

Answer

Authentication: Symmetric encryption

Answer

Access control: Hashing

Question 15

After a successful phishing attempt, the security team adds MFA, email sandboxing, endpoint isolation, and immutable backups so that one failed safeguard does not expose the company. Which principle does this best illustrate?

Accepted Answer

Defense in depth. Defense in depth is the best fit because the organization is using several independent safeguards across different layers: user authentication, email inspection, endpoint containment, and backup recovery. The idea is that a single compromise, such as one successful phishing email, should not lead directly to full compromise. Security+ expects you to recognize layered protection as a strategy, not just list individual tools.

Why others are wrong: Need-to-know concerns restricting information to only those who require it for their job. Availability is one of the CIA triad objectives, but it is not a layered security strategy. Compensating control refers to an alternative measure used because the preferred control is unavailable or impractical; here the organization is not replacing one missing control, but strengthening multiple defenses at once.

Answer

Need-to-know

Answer

Availability

Answer

Compensating control