SY0-701 Practice Test 50 — 15 Questions

Question 1

Based on the exhibit, what type of malware is most likely present?

Accepted Answer

Ransomware, because the files are being renamed and recovery copies are being deleted.. The exhibit shows files being renamed with a new extension and recovery copies (shadow copies) being deleted via vssadmin.exe. This is a classic ransomware behavior: encrypting user files and removing Volume Shadow Copy backups to prevent recovery without the attacker's key. Ransomware specifically targets document files and system restore points to maximize extortion leverage.

Answer

Adware, because documents are no longer opening correctly.

Answer

Rootkit, because the system is using a command-line utility.

Answer

Spyware, because the attacker wants to read user documents.

Question 2

Based on the exhibit, which access design change best reduces fraud risk without stopping the payroll process?

Exhibit:
Payroll application roles:
- HR-Editor: can update employee records
- Payroll-Approver: can release payment batches
- Audit-Reader: can view reports only

Current assignment:
User Lisa has both HR-Editor and Payroll-Approver because she "handles payroll end to end."
Management wants to reduce the chance of one person creating and approving a fraudulent payment.

Accepted Answer

Split duties so record updates and payment approval require separate roles or separate accounts.. Option B is correct because it enforces separation of duties (SoD) by ensuring that no single user can both create and approve a payment. Splitting the HR-Editor and Payroll-Approver roles into separate accounts or requiring separate users for record updates and payment approval directly mitigates the fraud risk of a single insider creating a fake employee record and then approving a fraudulent payment batch. This aligns with the principle of least privilege and the NIST SP 800-53 AC-5 control for separation of duties, without halting the payroll workflow.

Answer

Keep both roles assigned but require a manager to review the batch after payment completes.

Answer

Remove the audit role and let payroll staff self-review their own work to save time.

Answer

Use a single shared payroll account so the workflow never pauses for approvals.

Question 3

Based on the exhibit, which action is required to keep the backups restorable after the key-encryption key rotation?

Accepted Answer

Rewrap or keep access to the old KEK version until existing DEKs are migrated.. When a key-encryption key (KEK) is rotated, existing data-encryption keys (DEKs) that were wrapped with the old KEK version become unreadable unless the old KEK is retained or the DEKs are re-wrapped with the new KEK. Option B ensures that backups remain restorable by either keeping the old KEK version accessible or migrating DEKs to the new KEK, maintaining the chain of trust for decryption.

Answer

Delete vault-kek-v1 immediately so only the newest key remains active.

Answer

Re-encrypt the entire backup repository with a single shared password.

Answer

Export vault-kek-v2 into the backup files so each object stores the new key directly.

Question 4

Based on the exhibit, which capability should be added so the SaaS app automatically creates, updates, and disables user accounts as directory changes occur?

Accepted Answer

Add SCIM provisioning between the directory and the SaaS application.. SCIM (System for Cross-domain Identity Management) is the standard protocol designed to automate user provisioning and deprovisioning between an identity provider (like a directory) and a service provider (like a SaaS app). By adding SCIM provisioning, the SaaS app can automatically create, update, and disable user accounts in response to changes in the directory, eliminating the need for manual account management.

Answer

Require MFA on the SaaS login page and leave account provisioning manual.

Answer

Change the password rotation interval to every 30 days for all users.

Answer

Store credentials in a shared spreadsheet so the help desk can disable access faster.

Question 5

Based on the exhibit, which change best moves the ERP recovery design toward meeting both recovery targets?

Accepted Answer

Add a warm standby database with 15-minute log shipping and scheduled failover tests.. Option B is correct because adding a warm standby database with 15-minute log shipping significantly reduces the recovery point objective (RPO) to near-zero and, combined with scheduled failover tests, ensures the recovery time objective (RTO) is met. This directly addresses the gap between the current backup-only approach and the required recovery targets, as log shipping provides near-continuous data protection and failover testing validates the recovery process.

Answer

Increase the full backup frequency to every night and keep the same recovery process.

Answer

Move backup media to the same server to reduce transfer time.

Answer

Eliminate differential backups and rely only on weekly full backups.

Question 6

Which two statements describe authorization? Select two.

Accepted Answer

It determines what a user can access after sign-in. Authorization determines the resources and actions a user can access after successful authentication. It enforces access control policies, such as those defined by RBAC or ACLs, ensuring users only interact with permitted data or systems. This aligns with the NIST definition of authorization as the process of granting or denying rights to a user.

Answer

It proves a user is who they claim to be

Answer

It records every packet a device sends

Answer

It replaces the need for authentication

Question 7

Procurement is reviewing a new payroll SaaS provider. The business wants independent evidence that the vendor's controls were designed and operating effectively over the last six months. Which document should the security team request?

Accepted Answer

A SOC 2 Type II report from an independent auditor.. A SOC 2 Type II report provides independent assurance that a service organization's controls are not only designed appropriately (Type I) but also operating effectively over a specified period, typically six to twelve months. This aligns directly with the procurement team's requirement for evidence of control effectiveness over the last six months, making it the correct choice for evaluating a SaaS vendor's security posture.

Answer

A software patch list showing recent updates installed on the vendor's servers.

Answer

A penetration test screenshot showing one web application vulnerability was fixed.

Answer

An internal email from the vendor's security manager stating that controls are mature.

Question 8

Several employees in a branch office report that their laptops automatically connected to a network named "CorpWiFi" even though they were away from the office. Shortly afterward, a few users saw a captive portal asking them to re-enter company credentials. Which threat best explains this situation?

Accepted Answer

Evil twin access point impersonating the legitimate wireless network. The scenario describes an evil twin attack where a rogue access point broadcasts the SSID "CorpWiFi" to trick laptops into automatically connecting. Once connected, the attacker presents a fake captive portal to harvest credentials. This exploits the fact that client devices often prioritize known SSIDs without verifying the authenticity of the access point, relying solely on the network name.

Answer

Bluetooth pairing abuse from a nearby device

Answer

DNS poisoning caused by a compromised resolver

Answer

NFC relay attack against the laptops' login process

Question 9

Several Windows servers were built from the same image, and all of them use the same local Administrator password. What is the best operational hardening change?

Accepted Answer

Implement a tool that automatically sets unique local admin passwords on each server.. Option B is correct because using a tool like Local Administrator Password Solution (LAPS) automates the rotation of unique, complex passwords for each server's local administrator account. This eliminates the risk of lateral movement if one server's credentials are compromised, as each machine has a distinct password stored securely in Active Directory.

Answer

Keep the shared password but store it in a spreadsheet with restricted access.

Answer

Remove all administrator accounts from the servers.

Answer

Change the password manually once a year on one server only.

Question 10

The SOC has contained a mailbox compromise by resetting the password and revoking active sessions. Investigation shows the attacker created an automatic forwarding rule and added an OAuth consent grant. What should happen next to eradicate the threat?

Accepted Answer

Remove the malicious forwarding rule and review or revoke suspicious OAuth app grants.. Option C is correct because the immediate next step after containment is to remove the attacker's persistence mechanisms. The malicious forwarding rule (which exfiltrates emails via SMTP) and the OAuth consent grant (which provides persistent API access) must be removed to fully eradicate the threat. Simply resetting the password and revoking sessions does not remove these backdoors, as OAuth grants persist independently of user credentials.

Answer

Notify all employees to be more careful with email before taking any technical steps.

Answer

Delete the mailbox and create a new account for the user immediately.

Answer

Restore the user's messages from backup and reopen access without further review.

Question 11

Which two practices help protect encryption keys? Select two.

Accepted Answer

Store keys in a hardware security module. A hardware security module (HSM) is a dedicated, tamper-resistant hardware device designed to securely generate, store, and manage cryptographic keys. By keeping keys inside the HSM, they never exist in plaintext in system memory or on disk, and operations like signing or decryption occur within the HSM's secure boundary, preventing extraction even if the host is compromised.

Answer

Put keys in an unencrypted text file on a server

Answer

Reuse the same key across many systems forever

Answer

Send keys through a public chat room

Question 12

Which document should define mandatory settings such as full-disk encryption, a 10-minute screen-lock timeout, and removal of local administrator rights on company laptops?

Accepted Answer

Standard, because it defines specific required configurations that must be followed.. Option B is correct because a standard defines mandatory, specific technical configurations that must be uniformly applied across all company laptops. The question lists concrete settings (full-disk encryption, 10-minute screen-lock timeout, removal of local admin rights) that are not open to interpretation, which aligns precisely with the role of a security standard in enforcing baseline compliance.

Answer

Policy, because it explains the general direction but not the exact settings.

Answer

Procedure, because it lists the steps an end user should take every day.

Answer

Guideline, because it offers flexible recommendations rather than mandatory rules.

Question 13

Based on the exhibit, which architecture best meets the goal of keeping the order service running if one application server fails?

Accepted Answer

Run the application servers active-active behind the load balancer.. Option B is correct because an active-active architecture behind a load balancer ensures that if one application server fails, the load balancer automatically redirects traffic to the remaining healthy server(s). This provides high availability and fault tolerance without manual intervention, keeping the order service running continuously.

Answer

Use one active server with a warm standby server that is started manually during outages.

Answer

Store the application binaries on RAID 1 disks to prevent service interruption.

Answer

Take nightly backups of the application servers and restore them after a failure.

Question 14

Based on the exhibit, which authentication method best meets the stated remote-admin requirement?

Accepted Answer

FIDO2 hardware security key, because it resists phishing and does not depend on SMS or email delivery.. The remote-admin requirement emphasizes phishing resistance and independence from SMS or email delivery, which are vulnerable to interception or social engineering. FIDO2 hardware security keys use public-key cryptography and origin-bound credentials, making them phishing-resistant and eliminating reliance on potentially compromised communication channels. This aligns with the stated requirement better than the other options.

Answer

SMS one-time code, because it is widely supported and easy for users to adopt.

Answer

Email one-time link, because it can be delivered to any mailbox quickly.

Answer

Authenticator app TOTP code, because it adds a second factor without special hardware.

Question 15

Based on the exhibit, which change would best reduce the attack surface of the public web server while preserving remote administration from the internal network?

Accepted Answer

Move WEB01 into a DMZ and allow only the reverse proxy or load balancer to reach it on HTTPS, with admin access limited to the jump host.. Moving WEB01 into a DMZ and restricting inbound HTTPS traffic to only the reverse proxy or load balancer minimizes the server's exposure to the internet while still allowing external users to access the web application. Admin access from the internal network is preserved by limiting it to a jump host, which provides a controlled, audited entry point. This architecture follows the principle of least privilege and network segmentation, reducing the attack surface without sacrificing necessary functionality.

Answer

Assign WEB01 a public IP address directly and remove the firewall rules.

Answer

Place WEB01 on the same VLAN as user workstations so the firewall can inspect traffic more easily.

Answer

Keep the server where it is and add outbound web filtering to stop exploitation attempts.