SY0-701 Practice Test 49 — 15 Questions

Question 1

Based on the exhibit, what should the administrator do next?

Accepted Answer

Re-download the update from the trusted source and verify the hash again.. Option B is correct because if the hash of a downloaded file does not match the vendor-published hash, the file is likely corrupted or tampered with. The administrator should delete the corrupted file, re-download it from the trusted source, and recompute the hash to ensure integrity before installation. This follows the principle of verifying file integrity via cryptographic hashing (e.g., SHA-256) before applying updates.

Answer

Install the update because a longer hash means the file is newer.

Answer

Rename the file to match the vendor’s naming convention and retry installation.

Answer

Disable SHA-256 verification because patch files often change after download.

Question 2

Based on the exhibit, what should the records manager do next?

Accepted Answer

Suspend deletion and preserve all related records until the legal hold is formally lifted.. Option D is correct because when a legal hold is in effect, it overrides any standard retention or deletion policies. The records manager must suspend all deletion activities and preserve all related records until the legal hold is formally lifted, as failure to do so could result in spoliation of evidence and legal penalties.

Answer

Delete the records on schedule because the retention period is still the primary rule.

Answer

Move the records to long-term archive and continue the normal deletion schedule.

Answer

Print the records, delete the digital copies, and keep the paper copies instead.

Question 3

Which action is the best example of accounting in AAA?

Accepted Answer

The system records the username, timestamp, and files opened during the session.. Accounting in AAA (Authentication, Authorization, and Accounting) focuses on tracking user activities and resource usage. Option B correctly describes this by specifying the recording of username, timestamp, and files accessed, which are typical audit log entries used for monitoring and compliance.

Answer

The system checks a password and a one-time code before allowing access.

Answer

The system grants access to the finance folder after the user is approved.

Answer

The system forces the user to change their password after 90 days.

Question 4

Based on the exhibit, what type of threat is the security team most likely seeing on the workstation?

Accepted Answer

Fileless malware. The security team is most likely seeing fileless malware because the exhibit shows a PowerShell command that injects malicious code directly into memory (e.g., using Invoke-Mimikatz or a reflective DLL injection technique) without writing a persistent executable to disk. Fileless malware operates in-memory, leveraging legitimate system tools like PowerShell, WMI, or .NET to evade traditional signature-based antivirus detection, which matches the scenario described.

Answer

Trojan

Answer

Worm

Answer

Rootkit

Question 5

Based on the exhibit, what type of social engineering attack is the caller using?

Accepted Answer

Vishing, because the attacker is using a phone call to pressure the target.. The caller is using a phone call to impersonate a trusted figure (the CEO) and create urgency to pressure the target into violating security policy. This matches the definition of vishing (voice phishing), which relies on social engineering over voice channels to extract sensitive information or actions.

Answer

Ransomware, because the caller is asking for money.

Answer

SQL injection, because the caller is asking for account details.

Answer

Tailgating, because the attacker mentions an executive assistant.

Question 6

Based on the exhibit, which additional control is the best fit to prevent employees from copying sensitive reports to removable media?

Accepted Answer

Implement endpoint device control or DLP rules to restrict removable media use.. Endpoint device control or DLP (Data Loss Prevention) rules are specifically designed to monitor, block, or restrict the use of removable media such as USB drives. By implementing such controls, an organization can enforce policies that prevent sensitive data from being copied to unauthorized external storage devices, directly addressing the threat of data exfiltration via removable media.

Answer

Block all internet access on finance laptops except for the accounting website.

Answer

Increase the password complexity requirements for finance users.

Answer

Add more antivirus signatures to the endpoint protection platform.

Question 7

Based on the exhibit, which attack is the developer most likely observing?

Accepted Answer

Server-side request forgery (SSRF). The developer is most likely observing a server-side request forgery (SSRF) attack because the log shows the application making an outbound HTTP request to an internal IP address (10.0.0.1) initiated by user-supplied input (the 'url' parameter). SSRF occurs when an attacker manipulates the server to send crafted requests to internal or external resources, bypassing access controls. The exhibit's pattern of a server-side request to a private IP range directly indicates SSRF, not client-side or database attacks.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

CSRF

Question 8

Based on the exhibit, which backup protection change best improves ransomware resilience and protects the backup media if it is stolen?

Accepted Answer

Add an immutable offline or air-gapped copy with separate backup credentials and regular restore testing.. Option B is correct because implementing an immutable, offline or air-gapped backup copy with separate credentials ensures that even if an attacker compromises the primary backup system or steals the media, they cannot modify or delete the backups. Regular restore testing verifies the integrity and recoverability of the data, which is critical for ransomware resilience. This approach aligns with the 3-2-1 backup rule and NIST SP 800-184 guidance for cyber recovery.

Answer

Enable backup encryption only, because encrypted backups cannot be read if stolen.

Answer

Move the USB drive into a different cabinet inside the same server room.

Answer

Reduce the retention period so backups consume less storage space.

Question 9

Based on the exhibit, which change best improves accountability while still allowing emergency access?

A finance team uses the following shared account on a jump host:

07:55:12  Account=FIN-ADMIN  Action=ApproveInvoice   Host=JUMP-02  IP=10.30.8.21
07:56:03  Account=FIN-ADMIN  Action=ChangeVendorBank Host=JUMP-02  IP=10.30.8.21
07:57:44  Account=FIN-ADMIN  Action=ExportReport     Host=JUMP-02  IP=10.30.8.21

Note: FIN-ADMIN is used by three finance managers during after-hours support.

Accepted Answer

Replace the shared account with named user accounts, role-based access, and a separate break-glass account for rare emergencies.. Option B is correct because replacing the shared account with named user accounts ensures individual accountability through unique credentials and audit trails, while a separate break-glass account provides emergency access without compromising security. This aligns with the principle of least privilege and non-repudiation, as each finance manager's actions are logged under their own identity, and the break-glass account can be tightly controlled and monitored for rare use.

Answer

Require the shared account password to be changed every 24 hours.

Answer

Enable automatic account lockout after five failed logons.

Answer

Restrict the jump host by MAC address and subnet only.

Question 10

Based on the exhibit, which change best meets the requirement that guest devices can reach the internet but must not reach any internal subnets or printer VLANs?

Accepted Answer

Move guests into a dedicated guest zone with outbound NAT and default-deny rules to internal networks.. Option B is correct because placing guest devices in a dedicated guest zone with outbound NAT allows them to access the internet while default-deny rules to internal subnets and printer VLANs enforce network segmentation. This approach uses firewall policies to explicitly block RFC 1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from guest traffic, ensuring no Layer 3 connectivity to internal resources.

Answer

Add more allow rules for the printer VLAN so guests can print without changing routing.

Answer

Place guest and corporate devices on the same VLAN and rely on the wireless password for separation.

Answer

Allow guest traffic to reach internal DNS and DHCP servers across all RFC1918 subnets.

Question 11

Based on the exhibit, which change should be made first to secure remote administration of the network device?

Accepted Answer

Disable Telnet and allow SSHv2 only for remote administration.. Telnet transmits all data, including credentials, in cleartext, making it vulnerable to interception. SSHv2 provides encrypted remote administration and is the secure replacement for Telnet. Disabling Telnet and enabling only SSHv2 is the immediate and necessary first step to secure remote device management.

Answer

Enable FTP so administrators can upload and download configuration files securely.

Answer

Open the management interface to any internet host as long as the password is complex.

Answer

Use one shared local administrator account for all network engineers.

Question 12

Based on the exhibit, which document type should the service desk use for the locked-account workflow?

Accepted Answer

Procedure, because it lists the exact steps analysts must follow in sequence.. A procedure document is the correct choice because it provides a step-by-step sequence of actions that service desk analysts must follow to unlock an account. The locked-account workflow requires precise, ordered steps (e.g., verifying identity, checking lockout status, resetting the account) to ensure consistency and security, which aligns with the definition of a procedure.

Answer

Policy, because it states broad rules for account access.

Answer

Standard, because it defines the minimum password requirements for all users.

Answer

Guideline, because it gives flexible suggestions for handling locked accounts.

Question 13

Based on the exhibit, which improvement best addresses the biggest cryptographic risk?

TLS inventory:
- edge-vpn01 and edge-vpn02 present the same certificate and private key
- private key file stored in a shared SMB folder
- admins copy the key manually during maintenance
- compromise of either gateway would expose the file path to the same share

Accepted Answer

Place the private key in an HSM or cloud key vault and issue unique keys or certificates per gateway.. Option A is correct because the biggest cryptographic risk is the shared private key stored in an SMB share, which violates the principle of least privilege and creates a single point of compromise. Using a Hardware Security Module (HSM) or cloud key vault ensures the private key is never exposed in plaintext, and issuing unique keys per gateway eliminates the risk that compromising one gateway exposes the key for all others. This directly addresses the core issue of key confidentiality and isolation.

Answer

Increase the certificate expiration to five years to reduce renewal work.

Answer

Keep copying the same key everywhere so failover is easier to manage.

Answer

Disable certificate validation to avoid user-facing outages.

Question 14

Based on the exhibit, which wireless security change best addresses both unauthorized device access and the risk of a lost laptop connecting to corporate resources?

Accepted Answer

Move the SSID to WPA2-Enterprise or WPA3-Enterprise with 802.1X, device certificates, and MDM-based compliance checks.. Option B is correct because WPA2-Enterprise or WPA3-Enterprise with 802.1X, device certificates, and MDM-based compliance checks provides mutual authentication and per-user, per-session encryption. This eliminates the risk of a lost laptop connecting to corporate resources (since device certificates can be revoked) and prevents unauthorized device access through certificate-based authentication and MDM compliance enforcement, unlike shared PSK which cannot be individually revoked.

Answer

Increase the PSK length and rotate it every 30 days.

Answer

Hide the SSID and enable MAC address filtering on the access points.

Answer

Keep the current wireless design and rely on a VPN client for all remote access.

Question 15

Based on the exhibit, what type of malware behavior is most likely occurring?

Accepted Answer

Fileless attack, because PowerShell was launched in memory with no new payload written to disk.. The exhibit shows PowerShell being launched in memory with no new payload written to disk, which is the hallmark of a fileless attack. Fileless malware exploits legitimate system tools like PowerShell to execute malicious code directly in memory, evading traditional signature-based detection that relies on scanning files on disk.

Answer

Ransomware, because the endpoint made an outbound connection after opening a document.

Answer

Spyware, because the laptop made an encrypted outbound connection.

Answer

Worm activity, because the laptop communicated with an external IP address.

SY0-701 Practice Test 49 — 15 Questions

Exhibit

SY0-701 Practice Test 49 — 15 Questions

Exhibit