SY0-701 Practice Questions 1 — 50 Questions

Question 1

After installing a free PDF-to-Word utility from an unofficial website, a user's laptop starts sending data to an unknown server and the security agent is disabled. Which malware type best fits?

Accepted Answer

Trojan. A Trojan is malware disguised as legitimate software, such as a free PDF-to-Word utility, that performs malicious actions without the user's knowledge. In this scenario, the Trojan exfiltrates data to an unknown server and disables the security agent, which are classic Trojan behaviors—unlike self-replicating worms or passive spyware. The user's intentional download from an unofficial website is the typical infection vector for Trojans.

Answer

Worm

Answer

Spyware

Answer

Rootkit

Question 2

A SOC analyst receives an alert from the EDR system indicating that the process 'C:\Program Files\Vendor\Updater.exe' attempted to modify the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key on a user's workstation. The analyst checks the file hash and finds it matches a known legitimate software updater. Which of the following actions is most appropriate for the analyst to take?

Accepted Answer

Investigate the user's recent activity and check for signs of process hollowing or DLL injection.. The EDR alert indicates a legitimate process (Updater.exe) modifying a critical persistence registry key (Run). Even with a known good hash, the process could be compromised via process hollowing or DLL injection, where malicious code runs under the guise of a trusted executable. Investigating user activity and checking for these attack techniques is the appropriate next step to confirm whether the behavior is benign or indicative of a threat.

Answer

Disable the software updater immediately to prevent further registry modifications.

Answer

Create an exception rule in the EDR to suppress future alerts for this process.

Answer

Isolate the workstation from the network and reimage the system immediately.

Question 3

A vendor-supported legacy application can run only with a deprecated browser plug-in on two engineering workstations for 30 days while a replacement is tested. Management wants to allow the exception without weakening the security program. What is the best action?

Accepted Answer

Document a time-bound exception, record the risk, apply compensating controls, and schedule review before expiration.. It follows the formal exception process required by a mature security program: documenting the exception with a specific time bound (30 days), recording the associated risk, applying compensating controls (such as network segmentation or host-based firewall rules to isolate the deprecated plug-in), and scheduling a review before expiration ensures the risk is managed and the exception does not become permanent. This aligns with the SY0-701 objective of implementing risk management processes, where time-bound exceptions with compensating controls are the standard way to handle legacy dependencies without weakening the overall security posture.

Answer

Approve the exception informally by email and revisit it if problems appear.

Answer

Disable all monitoring on the workstations so the application will function normally.

Answer

Publish the exception as a permanent guideline so other teams can follow it.

Question 4

An order-entry application must survive a single server failure and continue serving users if the primary site becomes unavailable. Management wants automatic failover, but does not want to pay for fully active production capacity in two regions. Which design is best?

Accepted Answer

Use two servers in one site behind a load balancer and maintain an asynchronously replicated warm standby site.. It combines a load-balanced active-passive pair at the primary site with an asynchronously replicated warm standby at a secondary site. This design meets the requirement for automatic failover and continued service after a single server failure or primary site outage, while avoiding the cost of fully active multi-region capacity. Asynchronous replication ensures the standby site is ready to take over without requiring synchronous writes that would add latency or require identical production load.

Answer

Run one server and keep nightly backups in cloud object storage.

Answer

Deploy active-active multi-region capacity with identical production load in both regions.

Answer

Add RAID 1 and a spare power supply to the database server.

Question 5

A vulnerability scan finds two issues: a critical deserialization flaw on a non-production lab server behind a VPN, and a high-severity privilege escalation flaw on the production jump server that administrators use to reach the rest of the environment. Which should be remediated first?

Accepted Answer

The jump server flaw, because it affects a production administrative access point. The jump server flaw must be remediated first because it is a high-severity privilege escalation vulnerability on a production system that administrators use as a gateway to the entire environment. Compromise of this jump server would give an attacker administrative access to all connected production systems, making the business impact far greater than the critical deserialization flaw on an isolated non-production lab server. In risk-based prioritization, severity alone is insufficient; the asset's role, exposure, and potential blast radius must be considered.

Answer

The lab server flaw, because critical severity always comes first

Answer

Neither issue, because VPN access reduces the need for urgent remediation

Answer

The lab server flaw, because non-production systems are always easier to patch later

Question 6

A report generator accepts a user-supplied report name and then passes it into a shell command to convert a file. During testing, a malicious value causes the server to run an unexpected system command. Which two changes best mitigate this issue while keeping the feature usable? Select two.

Accepted Answer

Replace shell command concatenation with a parameterized API or safe library call.. Replacing shell command concatenation with a parameterized API or safe library call prevents command injection by ensuring user input is treated as data, not executable code. This is the most effective mitigation because it eliminates the injection vector entirely, rather than trying to sanitize or validate input that may still be passed to a shell interpreter.

Answer

HTML-encode the report name before inserting it into the shell command.

Answer

Switch the feature from POST to GET so the values are easier to inspect.

Answer

Hide the server error messages so attackers cannot see the failure details.

Question 7

An IDS raises an alert for a possible SQL injection attack against an internal reporting portal. The web server logs show the source IP belongs to the company's vulnerability scanner, and the requests match the scanner's normal test pattern. What is the most appropriate analyst action?

Accepted Answer

Mark the alert as a likely false positive after verifying the scanner schedule and source IP.. The IDS alert matches the known behavior of the company's vulnerability scanner, which is a legitimate and scheduled security tool. Verifying the scanner schedule and source IP confirms the traffic is authorized, making the alert a false positive. Analysts should correlate IDS alerts with asset inventories and change management records to avoid unnecessary incident response actions.

Answer

Treat the alert as a confirmed breach and begin password resets for all portal users.

Answer

Block the scanner IP permanently to prevent future alerts from the same host.

Answer

Quarantine the reporting server because IDS alerts always indicate active exploitation.

Question 8

A SOC analyst receives an alert from the VPN appliance and identity platform. In the last 10 minutes, a user account had 14 failed VPN logons from one country, then one successful login from a different country. The user calls the help desk and says they have not used their account today. What should the analyst do first?

Accepted Answer

Disable the user account and revoke active sessions or tokens while escalating the event as a suspected account compromise.. The combination of multiple failed logins from one country followed by a successful login from a different country, combined with the user's denial of activity, is a classic indicator of account compromise (e.g., credential stuffing or token theft). Disabling the account and revoking active sessions/tokens immediately stops the attacker's access, preventing further lateral movement or data exfiltration, while escalation ensures proper incident response. This aligns with the CompTIA incident response process: identification, containment, eradication, and recovery.

Answer

Block the foreign IP address at the firewall and wait for more alerts before acting.

Answer

Reset the user password and close the alert because the new password will stop the attack.

Answer

Reimage the user’s laptop immediately to remove any possible malware before taking other steps.

Question 9

An employee receives a text message saying their payroll account is locked and asks them to tap a link and enter a one-time passcode. What type of attack is this?

Accepted Answer

Smishing. Smishing (SMS phishing) is the correct classification because the attack vector is a text message (SMS) that lures the recipient into tapping a link and entering a one-time passcode. Unlike generic phishing which uses email, smishing specifically exploits SMS trust and the limited screen real estate of mobile devices to bypass security awareness.

Answer

Phishing

Answer

Vishing

Answer

Baiting

Question 10

After a user installs a free PDF converter from an unofficial website, the laptop starts making periodic outbound connections to an unknown server, the browser homepage changes, and a new program launches at logon. What is the most likely malware type?

Accepted Answer

Trojan. The user downloaded and installed a program that appears legitimate (a PDF converter) but performs malicious actions: making outbound connections, changing browser settings, and adding a startup program. This is the classic behavior of a Trojan horse, which disguises itself as useful software to trick users into installing it, then executes hidden malicious functions. Unlike worms, Trojans do not self-replicate, and unlike ransomware or rootkits, the described symptoms focus on unauthorized remote access and persistence rather than file encryption or deep OS concealment.

Answer

Worm

Answer

Rootkit

Answer

Ransomware

Question 11

Before contracting with a cloud-based payroll provider, the security team requests a security questionnaire, proof of controls, and an independent audit report. What activity is this?

Accepted Answer

Third-party due diligence, because the team is evaluating vendor risk before onboarding.. The security team's request for a security questionnaire, proof of controls, and an independent audit report before contracting with a cloud-based payroll provider is a classic example of third-party due diligence. This process evaluates the vendor's security posture, compliance, and risk level before onboarding, ensuring that sensitive payroll data is protected. It is a proactive risk management activity, not a reactive test or training exercise.

Answer

Business continuity testing, because the team is checking recovery procedures.

Answer

Security awareness training, because the vendor is being taught safe behavior.

Answer

Data classification, because the team is labeling the payroll data type.

Question 12

A security analyst in the SOC observes a sudden spike in failed authentication attempts from a single external IP address targeting multiple user accounts over the last 30 minutes. After confirming the logs are accurate, which of the following actions should the analyst take FIRST according to standard incident response procedures?

Accepted Answer

Escalate the incident to the incident response team.. According to standard incident response procedures (NIST SP 800-61), the first step after confirming an anomaly is to escalate the incident to the incident response team. This ensures that a coordinated, documented, and legally defensible response is initiated, rather than taking unilateral action that could destroy evidence or disrupt legitimate services. The SOC analyst's role is to detect and validate, not to independently execute containment measures without authorization.

Answer

Block the IP address at the firewall immediately.

Answer

Disable all user accounts that were targeted.

Answer

Capture a memory dump of all affected servers.

Question 13

Based on the exhibit, what is the best-supported conclusion for the SOC analyst?

Accepted Answer

The host is likely using DNS tunneling or DNS-based command and control.. The exhibit shows a high volume of DNS queries to multiple unusual domains with long subdomain strings, which is a classic indicator of DNS tunneling or DNS-based command and control (C2). DNS tunneling encodes data in DNS queries and responses, allowing attackers to exfiltrate data or communicate with a C2 server while bypassing traditional network controls. The SOC analyst should recognize this pattern as anomalous DNS activity rather than normal web browsing.

Answer

The traffic is normal web browsing to a content delivery network.

Answer

The issue is most likely ARP spoofing on the local switch port.

Answer

The evidence most strongly indicates a password spraying campaign.

Question 14

A web form stores a user's comment and later displays it to other users. A tester submits and the script runs in the browser. What vulnerability is this?

Accepted Answer

Cross-site scripting. The tester's input is executed in the browser, which is the classic symptom of a stored (persistent) cross-site scripting (XSS) vulnerability. The web form fails to sanitize or encode user-supplied data before storing it and later rendering it in other users' browsers, allowing arbitrary JavaScript to run in the security context of the application's origin.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Command injection

Question 15

A desktop engineering team asks for the document that specifies the exact minimum encryption setting, screen-lock timer, and password length for company laptops. Which type of document should they follow?

Accepted Answer

Standard, because it defines mandatory uniform requirements for a specific control baseline.. A standard defines mandatory, uniform technical requirements for a specific control baseline, such as exact encryption settings (e.g., AES-256), screen-lock timer (e.g., 15 minutes), and password length (e.g., 14 characters). Unlike a policy, which states high-level intent, a standard provides the precise, enforceable configuration that the desktop engineering team must implement on company laptops.

Answer

Policy, because it states the organization's general intent and high-level direction.

Answer

Procedure, because it gives the organization-wide security purpose statement.

Answer

Guideline, because it provides optional suggestions that every laptop must obey.

Question 16

A security manager is leading a risk assessment for the organization. The team identifies a legacy application that contains a known critical vulnerability. The vendor has discontinued support and no patch is available. The manager calculates that the annualized loss expectancy (ALE) for exploiting this vulnerability is $50,000. Implementing a third-party web application firewall (WAF) as a compensating control would cost $80,000 per year. The organization's leadership decides that accepting the risk is the most cost-effective approach. Which of the following documents should the security manager update to formally record this risk acceptance decision and obtain the necessary sign-off?

Accepted Answer

Risk register. The risk register is the correct document to update because it formally tracks identified risks, their assessed impact, and the chosen risk response (acceptance). Recording the decision to accept the $50,000 ALE risk and obtaining sign-off ensures auditability and accountability, which is a key requirement in risk management frameworks like NIST SP 800-37.

Answer

Business impact analysis (BIA)

Answer

Security baseline configuration document

Answer

Incident response plan

Question 17

A hardening script is pushed to a production web server and, within minutes, the application stops accepting secure connections. The team discovers the script disabled a required TLS setting that the legacy application still needs. What should have been in place to reduce the impact of this change?

Accepted Answer

A documented change window with testing in a staging environment and a rollback plan.. A documented change window with testing in a staging environment and a rollback plan ensures that changes are validated before production deployment. In this scenario, the hardening script disabled a required TLS setting (e.g., TLS 1.0 or a specific cipher suite) that the legacy application depended on. Testing in staging would have caught the incompatibility, and a rollback plan would allow reverting the change quickly, minimizing downtime.

Answer

A longer password policy for administrators so they can log in after the outage.

Answer

Disabling all logging during the change so the application can restart faster.

Answer

Replacing the web server hardware to ensure the TLS settings are applied correctly.

Question 18

Match each control type to the best description.

Accepted Answer

Administrative: Policies, procedures, and rules. Control types are categorized by nature: administrative involves rules, technical involves technology, physical involves tangible barriers, logical involves software-based access, operational involves processes, and legal/regulatory involves compliance.

Answer

Technical: Physical locks and fences

Answer

Logical: Hardware security modules

Answer

Operational: Software-based authentication

Question 19

A SOC analyst reviews an EDR alert on a Windows workstation. PowerShell was launched by a scheduled task, downloaded an encoded command from an external server, and then spawned rundll32.exe. No suspicious executable was written to disk. Which type of threat best fits this activity?

Accepted Answer

Fileless attack. The attack is fileless because it executes entirely in memory without writing a malicious executable to disk. PowerShell downloads an encoded command from an external server and spawns rundll32.exe to run code via DLL execution, leveraging living-off-the-land binaries (LOLBins) to evade traditional antivirus and disk-based detection.

Answer

Trojan

Answer

Rootkit

Answer

Worm

Question 20

Match each design requirement to the best security architecture control. Use each control once.

Accepted Answer

Layered security: Defense in depth. Defense in depth uses layered controls, least privilege minimizes risk, separation of duties prevents fraud, fail secure avoids insecure states, secure defaults reduce misconfiguration, and complete mediation ensures consistent enforcement.

Answer

Avoid insecure state: Defense in depth

Answer

Reduce misconfiguration: Least privilege

Answer

Enforce consistently: Separation of duties