SY0-701 Practice Test 50 — 15 Questions

Question 1

Match each control type to the example that best fits it.

Accepted Answer

Preventive: A firewall that blocks unauthorized traffic. Preventive controls block incidents, detective controls identify them, corrective controls restore after incidents, deterrent controls discourage attacks, compensating controls provide alternative measures, and directive controls mandate behaviors.

Answer

Preventive: A warning sign that deters intruders

Answer

Corrective: An IDS that detects an intrusion

Question 2

Match each SOC alert artifact to the most useful investigation pivot. Each pivot should help determine whether the alert is a true incident, a false positive, or part of a broader campaign.

Accepted Answer

IP address: Perform reputation check against known threat feeds.. Each artifact is matched to a pivot that directly aids in verifying the alert's validity, whether by checking reputation, correlating with threat intelligence, or comparing against normal behavior.

Answer

IP address: Conduct WHOIS lookup to verify registration details.

Answer

File hash: Perform memory analysis on the endpoint.

Question 3

Which three of the following are core principles of the CIA triad in information security? (Choose three.)

Accepted Answer

Confidentiality. The CIA triad is the foundational model for information security, consisting of Confidentiality, Integrity, and Availability. Confidentiality ensures data is accessible only to authorized users, often enforced through encryption (e.g., AES-256) and access controls. Integrity guarantees data has not been tampered with, using mechanisms like hashing (SHA-256) or digital signatures. Availability ensures systems and data are accessible when needed, supported by redundancy (RAID, failover clusters) and DDoS mitigation.

Answer

Authentication

Answer

Non-repudiation

Answer

Authorization

Question 4

Match each cryptographic primitive to its main purpose.

Accepted Answer

Symmetric encryption: Uses a single shared key for encryption and decryption.. Symmetric encryption is efficient for large data, asymmetric encryption enables key exchange and signatures, hash functions ensure integrity, MACs combine integrity and authenticity, digital signatures add non-repudiation, and KDFs strengthen passwords for key use.

Answer

Asymmetric encryption: Uses a single shared key for encryption and decryption.

Answer

Hash function: Provides non-repudiation and sender authentication.

Answer

Digital signature: Produces a fixed-size digest for data integrity.

Question 5

Match each security principle to the best workplace example.

Accepted Answer

Least privilege: A user is given access only to files needed for their job.. Each workplace example illustrates a security principle: least privilege grants minimal access, separation of duties divides tasks, defense in depth uses multiple controls, fail safe defaults to safe state, need to know restricts data access, and accountability tracks user actions.

Answer

Least privilege: Two employees must approve a payment.

Answer

Defense in depth: A user is given access only to files needed for their job.

Question 6

Match each governance need to the document type that best fits.
1. All employees must follow rules for acceptable use of company systems.
2. Every company laptop must use full-disk encryption and a 14-character screen-lock PIN.
3. The service desk follows these exact steps to verify a caller before resetting MFA.
4. Admins are encouraged to place non-production test data in approved folders when practical.

Accepted Answer

AUP: All employees must follow rules for acceptable use of company systems.. AUP is a policy for acceptable use; standards are mandatory requirements; procedures are step-by-step instructions; guidelines are recommendations; policy is a high-level directive; baseline defines minimum configurations.

Answer

Policy: All employees must follow rules for acceptable use of company systems.

Answer

Baseline: Every company laptop must use full-disk encryption and a 14-character screen-lock PIN.

Question 7

An organization is implementing a third-party vendor risk management program. Which three of the following should be included as key activities to maintain oversight of vendor security? (Choose three.)

Accepted Answer

Including security requirements in contracts and service-level agreements. Performing due diligence assessments before onboarding new vendors is correct because it allows the organization to evaluate a vendor's security posture, compliance, and risk level before any contractual relationship begins. This proactive step helps identify potential vulnerabilities or gaps that could expose the organization to third-party risks, aligning with the NIST SP 800-161 supply chain risk management framework.

Answer

Providing vendor staff with direct access to internal source code repositories

Answer

Requiring all vendors to use the same password manager as the organization

Answer

Automatically renewing vendor contracts unless a security incident occurs

Question 8

Match each business situation to the best risk treatment. Use each treatment once.

Accepted Answer

Minor error with low probability: Accept. Risk treatment decisions are based on likelihood and impact: accept low risks, avoid high-high risks, mitigate medium risks, and transfer risks that are high likelihood but low impact or low likelihood but high impact.

Answer

Minor error with low probability: Transfer

Answer

Catastrophic event with high probability: Mitigate

Question 9

Match each vendor-risk concern to the contractual control that best addresses it.
1. The company wants the right to review the vendor's controls and supporting records after the contract is signed.
2. The company wants to know when the vendor will use subcontractors that may touch its data.
3. The company wants written notice within 24 hours if the vendor suffers an incident affecting company data.
4. The company wants assurance that the vendor's controls are independently assessed each year.

Accepted Answer

Vendor control review: Right to audit. Right to audit allows reviewing controls; subcontractor clause requires notification; incident clause mandates timely breach notification; independent assessment ensures annual audits; DPA covers data protection; SLA defines service levels.

Answer

Vendor control review: Subcontractor clause

Answer

Incident notification: Data protection agreement

Question 10

Which three of the following are characteristics of the principle of least privilege? (Choose three.)

Accepted Answer

Privileges are reviewed and revoked when no longer needed. The principle of least privilege dictates that users should only have the minimum permissions necessary to complete their job functions, which reduces the attack surface and limits potential damage from compromised accounts. Administrative accounts should be reserved exclusively for administrative tasks to prevent accidental or malicious misuse of elevated privileges. Regularly reviewing and revoking privileges ensures that access rights remain aligned with current job requirements, preventing privilege creep.

Answer

Users are given full control over all shared folders

Answer

Privileges are granted permanently once assigned

Answer

All users have equal access to all system resources

Question 11

Which three of the following are commonly used to enforce separation of duties? (Choose three.)

Accepted Answer

Using a dual-control process where two keys are needed to access a safe. Separation of duties is a security principle that prevents any single individual from having excessive control over critical processes. Requiring two different people to authorize a financial transaction ensures that no one person can both initiate and approve a payment, reducing fraud risk. Splitting the ability to create user accounts and assign privileges to different roles ensures that a single administrator cannot grant themselves unauthorized access. Using a dual-control process where two keys are needed to access a safe physically enforces that two people must be present, preventing unilateral access to sensitive assets.

Answer

Giving one person full responsibility for both IT security audits and daily operations

Answer

Configuring a single user to manage both backup and restoration of data

Answer

Allowing a single administrator to both approve and implement system changes

Question 12

Match each control type to the most fitting example in a branch office.

Accepted Answer

Preventive: Requiring keycard access to the server room. Preventive controls block incidents; detective controls identify them; corrective controls restore operations; deterrent controls discourage attacks; compensating controls provide alternative protection; physical controls secure physical access.

Answer

Detective: Requiring keycard access to the server room

Answer

Corrective: Placing visible security cameras in the lobby

Question 13

A security team is reviewing vulnerabilities in a web application. Which three of the following are common web application vulnerabilities that should be addressed? (Choose three.)

Accepted Answer

Cross-site scripting (XSS). Cross-site scripting (XSS) is a common web application vulnerability where an attacker injects malicious scripts into web pages viewed by other users, often through input fields or URL parameters. SQL injection occurs when an application improperly sanitizes user input in SQL queries, allowing attackers to manipulate the database. XML external entity (XXE) injection exploits poorly configured XML parsers to process external entities, leading to data disclosure or server-side request forgery. These three are consistently listed in the OWASP Top 10 as critical web application flaws.

Answer

ARP poisoning

Answer

DNS cache poisoning

Answer

Evil twin attack

Question 14

Match each cryptographic concept to its best purpose.

Accepted Answer

Confidentiality: Protects data from unauthorized disclosure. Confidentiality protects secrecy, integrity prevents tampering, authentication confirms identity, non-repudiation ensures proof of origin, availability ensures uptime, and accountability enables audit trails.

Answer

Confidentiality: Verifies the identity of a user

Answer

Integrity: Protects data from unauthorized disclosure

Question 15

Based on the exhibit, what should the security team add before approving the vendor's requested change?

Accepted Answer

A contract clause requiring prior written approval for new subprocessors and flow-down security obligations.. The exhibit shows the vendor requesting a change to use a new subprocessor for data storage. The security team must ensure that the vendor's contract includes a clause requiring prior written approval for new subprocessors and that security obligations flow down to them. This directly addresses the risk of unauthorized data handling by third parties, which is a key concern in vendor risk management.

Answer

A broader employee awareness training requirement for the vendor's staff.

Answer

A larger cyber insurance policy to cover possible losses if the vendor is breached.

Answer

A request for the vendor to send monthly screenshots of its backup jobs.