SY0-701 Practice Test 49 — 15 Questions

Question 1

A workstation is suspected of running malware and contacting an unknown host. Which two actions belong in the containment phase? Select two.

Accepted Answer

Isolate the workstation from the network.. Isolating the workstation from the network (A) immediately stops the malware's ability to communicate with the command-and-control (C2) server, preventing data exfiltration and further propagation. Blocking the malicious IP or domain at the firewall or proxy (B) is a containment action that prevents any system on the network from reaching the known malicious host, even if other hosts are already compromised. Both actions align with the NIST SP 800-61 containment strategy of stopping the spread and impact of an incident.

Answer

Reimage the workstation immediately before collecting evidence.

Answer

Tell the user to keep working until tomorrow.

Answer

Delete recent logs to reduce noise.

Question 2

Match each network segment to the best use in a small enterprise.

Accepted Answer

Guest Wi-Fi: Used for external users to access the internet without accessing internal resources.. Each segment serves a specific purpose: guest Wi-Fi for external users, DMZ for public services, internal LAN for daily operations, management for device control, data center for core infrastructure, VPN for secure remote access.

Answer

VPN: Used for managing network devices (switches, routers).

Answer

Management: Provides secure remote access to internal network for employees.

Question 3

A SOC analyst reviews one user account and sees several failed logins from a single IP, then a successful login from the same IP, followed by a new inbox forwarding rule to an external address. Which two findings most strongly suggest account compromise? Select two.

Accepted Answer

Repeated failed logins followed by a successful login from the same source IP.. A brute-force attack pattern—multiple failed logins followed by a successful authentication from the same external IP—strongly indicates credential compromise. This sequence suggests the attacker guessed or obtained the password and then successfully logged in. The single source IP ties the failed attempts to the eventual successful session, making it a classic indicator of account takeover.

Answer

The user authenticated during normal business hours.

Answer

The user accessed email from a corporate laptop.

Answer

The password age is 89 days.

Question 4

A user reports that their laptop is showing frequent pop-up ads, the browser homepage keeps changing, and the system has become noticeably slower. What is the most likely immediate containment action?

Accepted Answer

Disconnect the laptop from the network and begin endpoint isolation. The best immediate action is to isolate the laptop from the network. The symptoms suggest malicious or unwanted software may be communicating with outside servers or affecting the browser. Isolation limits further damage, prevents possible spread, and gives responders time to inspect the system safely. This is a standard first containment step when a workstation appears compromised but is still active.

Why others are wrong: Keeping the laptop online risks continued malicious activity. Reimaging too early can destroy evidence needed for root-cause analysis. Simply reinstalling the browser may remove a symptom, but it does not address the possibility of a broader endpoint compromise.

Answer

Keep the laptop online so security tools can continue collecting data

Answer

Immediately reimage the laptop before preserving any evidence

Answer

Ask the user to uninstall the browser and reinstall it manually

Question 5

Match the security need to the best cryptographic solution.

Accepted Answer

Confidentiality: Encryption. Confidentiality uses encryption; integrity uses hashes; authentication uses certificates; non-repudiation uses signatures; access control uses PKI; availability uses redundancy.

Answer

Authentication: Symmetric encryption

Answer

Access control: Hashing

Question 6

After a successful phishing attempt, the security team adds MFA, email sandboxing, endpoint isolation, and immutable backups so that one failed safeguard does not expose the company. Which principle does this best illustrate?

Accepted Answer

Defense in depth. Defense in depth is the best fit because the organization is using several independent safeguards across different layers: user authentication, email inspection, endpoint containment, and backup recovery. The idea is that a single compromise, such as one successful phishing email, should not lead directly to full compromise. Security+ expects you to recognize layered protection as a strategy, not just list individual tools.

Why others are wrong: Need-to-know concerns restricting information to only those who require it for their job. Availability is one of the CIA triad objectives, but it is not a layered security strategy. Compensating control refers to an alternative measure used because the preferred control is unavailable or impractical; here the organization is not replacing one missing control, but strengthening multiple defenses at once.

Answer

Need-to-know

Answer

Availability

Answer

Compensating control

Question 7

Match each control type to the example that best fits it.

Accepted Answer

Preventive: A firewall that blocks unauthorized traffic. Preventive controls block incidents, detective controls identify them, corrective controls restore after incidents, deterrent controls discourage attacks, compensating controls provide alternative measures, and directive controls mandate behaviors.

Answer

Preventive: A warning sign that deters intruders

Answer

Corrective: An IDS that detects an intrusion

Question 8

Match each SOC alert artifact to the most useful investigation pivot. Each pivot should help determine whether the alert is a true incident, a false positive, or part of a broader campaign.

Accepted Answer

IP address: Perform reputation check against known threat feeds.. Each artifact is matched to a pivot that directly aids in verifying the alert's validity, whether by checking reputation, correlating with threat intelligence, or comparing against normal behavior.

Answer

IP address: Conduct WHOIS lookup to verify registration details.

Answer

File hash: Perform memory analysis on the endpoint.

Question 9

Which three of the following are core principles of the CIA triad in information security? (Choose three.)

Accepted Answer

Availability. The CIA triad is the foundational model for information security, consisting of Confidentiality, Integrity, and Availability. Confidentiality ensures data is accessible only to authorized users, often enforced through encryption (e.g., AES-256) and access controls. Integrity guarantees data has not been tampered with, using mechanisms like hashing (SHA-256) or digital signatures. Availability ensures systems and data are accessible when needed, supported by redundancy (RAID, failover clusters) and DDoS mitigation.

Answer

Authorization

Answer

Non-repudiation

Answer

Authentication

Question 10

Match each cryptographic primitive to its main purpose.

Accepted Answer

Symmetric encryption: Uses a single shared key for encryption and decryption.. Symmetric encryption is efficient for large data, asymmetric encryption enables key exchange and signatures, hash functions ensure integrity, MACs combine integrity and authenticity, digital signatures add non-repudiation, and KDFs strengthen passwords for key use.

Answer

Asymmetric encryption: Uses a single shared key for encryption and decryption.

Answer

Hash function: Provides non-repudiation and sender authentication.

Answer

Digital signature: Produces a fixed-size digest for data integrity.

Question 11

Match each security principle to the best workplace example.

Accepted Answer

Least privilege: A user is given access only to files needed for their job.. Each workplace example illustrates a security principle: least privilege grants minimal access, separation of duties divides tasks, defense in depth uses multiple controls, fail safe defaults to safe state, need to know restricts data access, and accountability tracks user actions.

Answer

Least privilege: Two employees must approve a payment.

Answer

Defense in depth: A user is given access only to files needed for their job.

Question 12

Match each governance need to the document type that best fits.
1. All employees must follow rules for acceptable use of company systems.
2. Every company laptop must use full-disk encryption and a 14-character screen-lock PIN.
3. The service desk follows these exact steps to verify a caller before resetting MFA.
4. Admins are encouraged to place non-production test data in approved folders when practical.

Accepted Answer

AUP: All employees must follow rules for acceptable use of company systems.. AUP is a policy for acceptable use; standards are mandatory requirements; procedures are step-by-step instructions; guidelines are recommendations; policy is a high-level directive; baseline defines minimum configurations.

Answer

Policy: All employees must follow rules for acceptable use of company systems.

Answer

Baseline: Every company laptop must use full-disk encryption and a 14-character screen-lock PIN.

Question 13

An organization is implementing a third-party vendor risk management program. Which three of the following should be included as key activities to maintain oversight of vendor security? (Choose three.)

Accepted Answer

Including security requirements in contracts and service-level agreements. Performing due diligence assessments before onboarding new vendors is correct because it allows the organization to evaluate a vendor's security posture, compliance, and risk level before any contractual relationship begins. This proactive step helps identify potential vulnerabilities or gaps that could expose the organization to third-party risks, aligning with the NIST SP 800-161 supply chain risk management framework.

Answer

Automatically renewing vendor contracts unless a security incident occurs

Answer

Providing vendor staff with direct access to internal source code repositories

Answer

Requiring all vendors to use the same password manager as the organization

Question 14

Match each business situation to the best risk treatment. Use each treatment once.

Accepted Answer

Minor error with low probability: Accept. Risk treatment decisions are based on likelihood and impact: accept low risks, avoid high-high risks, mitigate medium risks, and transfer risks that are high likelihood but low impact or low likelihood but high impact.

Answer

Minor error with low probability: Transfer

Answer

Catastrophic event with high probability: Mitigate

Question 15

Match each vendor-risk concern to the contractual control that best addresses it.
1. The company wants the right to review the vendor's controls and supporting records after the contract is signed.
2. The company wants to know when the vendor will use subcontractors that may touch its data.
3. The company wants written notice within 24 hours if the vendor suffers an incident affecting company data.
4. The company wants assurance that the vendor's controls are independently assessed each year.

Accepted Answer

Vendor control review: Right to audit. Right to audit allows reviewing controls; subcontractor clause requires notification; incident clause mandates timely breach notification; independent assessment ensures annual audits; DPA covers data protection; SLA defines service levels.

Answer

Vendor control review: Subcontractor clause

Answer

Incident notification: Data protection agreement