SY0-701 Practice Questions 2 — 50 Questions

Question 1

A security architect is designing a defense strategy for a database containing sensitive customer records. The architect implements a network firewall to restrict inbound traffic to only the application server, enforces file-level encryption for the database files, requires multi-factor authentication for all administrative access, and deploys a database activity monitoring system to alert on unusual queries. Which security principle is the architect primarily applying?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Defense in depth. The architect is applying defense in depth by layering multiple independent security controls: a network firewall, file-level encryption, multi-factor authentication, and database activity monitoring. This strategy ensures that if one control fails, others still provide protection, which is the core principle of defense in depth. Each layer addresses a different attack vector, making it significantly harder for an attacker to compromise the database.

Answer

Least privilege

Answer

Separation of duties

Answer

Fail safe

Question 2

A small company is moving its public web app to a new network. The front-end server must be reachable from the internet, the application server should only accept traffic from the front end, and the database must never be reachable from the internet or user VLANs. Which design best meets these requirements with the least exposure?

Accepted Answer

Place the web server in a DMZ, the application server in an internal subnet, and the database in a separate restricted subnet with firewall rules between each tier.. It implements a classic three-tier architecture with network segmentation. The web server in the DMZ is isolated from internal networks but accessible from the internet, the application server in an internal subnet is protected by firewall rules that only allow traffic from the DMZ, and the database in a separate restricted subnet is further isolated with firewall rules that only permit traffic from the application server. This design minimizes exposure by enforcing least privilege and defense in depth, using network-layer segmentation rather than relying solely on host-based controls.

Answer

Place all three servers in the same server VLAN and use host-based firewalls to separate them.

Answer

Place the database in the DMZ so the web and application servers can access it directly without extra firewall rules.

Answer

Place the web server on the user VLAN and use NAT to hide the database server from the internet.

Question 3

A company is redesigning how systems are separated in its office and data center network. Match each network design element to the scenario it best supports. Use each term once.

Accepted Answer

VLAN: Separates broadcast domains logically. VLANs separate broadcast domains, subnets divide IP networks, ACLs filter traffic, DMZs isolate public servers, VPNs provide secure remote access, and NAT translates private to public IPs.

Answer

ACL: Divides IP networks into smaller segments

Answer

NAT: Provides secure remote access over public internet

Question 4

Match each procurement need to the vendor due diligence artifact or control that best fits.
1. Procurement wants independent evidence that a SaaS provider's controls operated effectively during the last year.
2. The team wants to know what files, libraries, and modules were included in a supplier's software build.
3. The business needs a signed agreement that defines how customer data is handled and what the vendor must do if an incident occurs.
4. The procurement team wants answers about MFA, logging, and incident response before onboarding a cloud supplier.

Accepted Answer

SOC 2 Type II: Independent evidence that a SaaS provider's controls operated effectively during the last year.. Each artifact or control directly addresses the procurement need: SOC 2 Type II provides independent audit evidence; SBOM lists software components; DPA is the legal agreement for data handling; security questionnaires gather specific security practices; pen test reports validate controls; BCP ensures continuity.

Answer

Pen test report: Independent evidence that a SaaS provider's controls operated effectively during the last year.

Answer

BCP: A signed agreement that defines how customer data is handled and what the vendor must do if an incident occurs.

Question 5

Based on the exhibit, what security issue is most likely present?

Accepted Answer

Exposed service, because management and streaming ports are listening on all interfaces and allowed from anywhere.. The exhibit shows that both the management interface (TCP 443) and the streaming interface (TCP 554) are bound to 0.0.0.0 (all interfaces) and the firewall rules allow traffic from 0.0.0.0/0 (any source). This exposes the camera's web management and RTSP streaming services to the entire internet, making it vulnerable to unauthorized access, reconnaissance, and potential exploitation. An exposed service of this nature is a common entry point for attackers to compromise IoT devices.

Answer

Weak permissions, because the camera streams video to multiple ports.

Answer

Default credentials, because the admin login is enabled.

Answer

Outdated component, because firmware version 1.0.3 is listed.

Question 6

A security analyst is reviewing the session management implementation of a web application. The application generates session tokens by computing the MD5 hash of the concatenation of the username and the current server timestamp rounded to the nearest hour. An attacker has obtained a valid session token for her own account and discovers that she can forge tokens for other users by simply substituting the username in the hash calculation with a known target username. Which type of attack is the web application most vulnerable to?

Accepted Answer

Session prediction. The session token is generated using MD5(username + timestamp rounded to the nearest hour). Since the attacker knows her own token and can compute the hash for any username with the same timestamp, she can predict tokens for other users. This is a classic session prediction vulnerability, as the token generation lacks sufficient entropy and relies on predictable inputs.

Answer

Session hijacking via cross-site scripting (XSS)

Answer

Session replay attack

Answer

Session fixation

Question 7

In a virtualized environment, several workloads share the same physical host and the same IP subnet. After one payroll VM is compromised, the security team wants to prevent that VM from freely scanning or reaching the other workloads on the host. Which control best addresses this lateral-movement risk?

Accepted Answer

Microsegmentation with policy rules applied per workload or per VM. Microsegmentation allows granular security policies to be applied per workload or per VM, even within the same subnet and on the same hypervisor. By enforcing firewall rules at the virtual switch or hypervisor level, it prevents a compromised payroll VM from scanning or communicating laterally with other VMs on the same host, directly addressing the lateral-movement risk.

Answer

Expanding the subnet mask so all workloads are easier to reach

Answer

Creating a shared administrator account for all virtual machines

Answer

Disabling DHCP and forcing every VM to use a static IP address

Question 8

A security analyst at a hospital is reviewing user permissions in the electronic health record (EHR) system. The analyst discovers that all nursing staff accounts are members of the 'Administrators' group, which grants full read and write access to all patient records, as well as the ability to modify system configuration settings. The nursing staff's job responsibilities only require viewing and updating records for patients currently assigned to them. Which security principle is most directly violated by this configuration?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. In this case, nursing staff only need read and write access to records of currently assigned patients, but membership in the 'Administrators' group grants full read/write access to all patient records and the ability to modify system configuration settings, which far exceeds their job requirements. This directly violates least privilege by providing excessive, unnecessary privileges that increase the risk of unauthorized access or accidental misconfiguration.

Answer

Defense in depth

Answer

Non-repudiation

Answer

Availability

Question 9

A tester enters a crafted search term into an internal web application and sees no error message, but the page response always delays by exactly five seconds when the input includes a single quote followed by a conditional sleep function. The returned results look normal, so the tester repeats the request several times and the timing remains consistent. Which attack is most likely being attempted?

Accepted Answer

Time-based blind SQL injection, because the attacker is inferring database behavior from delayed responses.. The consistent five-second delay triggered by a single quote followed by a conditional sleep function (e.g., ' OR SLEEP(5)) indicates a time-based blind SQL injection. The tester is inferring database behavior from response timing because the application does not display error messages or output differences, but the database executes a sleep command when the injected SQL is syntactically valid. This technique exploits the database's ability to conditionally pause execution, allowing an attacker to extract data bit by bit based on true/false conditions.

Answer

Reflected cross-site scripting, because the tester's input is being echoed back into the response.

Answer

Command injection, because the application is pausing while executing system-level sleep commands.

Answer

Session fixation, because the tester is manipulating how the application handles user input over time.

Question 10

A development team updates a third-party software library used by its web application. After the release, new deployments begin making unexpected outbound connections to an unfamiliar domain. What type of threat is most likely?

Accepted Answer

Dependency compromise. Dependency compromise. This scenario describes a supply chain attack where a third-party library has been maliciously altered or replaced, causing the web application to make unauthorized outbound connections to an attacker-controlled domain. Such compromises often occur when developers unknowingly integrate a tampered version of a library from a compromised repository or via a typosquatting attack, leading to data exfiltration or command-and-control (C2) communication.

Answer

Phishing

Answer

Rootkit infection

Answer

Password spraying

Question 11

A security analyst notices that a phishing campaign is targeting employees with emails that appear to be from the company's IT support team. The emails contain a link to a website that mimics the corporate password reset portal. Which of the following controls would be MOST effective in preventing users from reaching the malicious website, assuming the link uses HTTPS?

Accepted Answer

Implement a URL filtering policy on the company's web proxy.. A URL filtering policy on the company's web proxy is the most effective control because it can block access to the malicious website based on its domain, category, or reputation, regardless of whether the link uses HTTPS. Since the proxy can perform SSL/TLS inspection (decrypting the HTTPS traffic) or use domain reputation lists, it prevents users from even reaching the phishing site. This directly addresses the core issue of users navigating to a known or suspicious URL.

Answer

Deploy an email security gateway that performs sandboxing of attachments.

Answer

Enable multi-factor authentication on all corporate accounts.

Answer

Conduct a security awareness training session on phishing.

Question 12

A security engineer writes a script that computes SHA-256 hashes of critical server configuration files every night and sends an alert if any hash value has changed since the previous night. Which security goal is this control primarily designed to protect?

Accepted Answer

Integrity. The script computes SHA-256 hashes of configuration files and compares them nightly to detect any unauthorized or accidental changes. This directly protects the integrity of the files by ensuring they have not been modified, which is the core security goal of integrity. Confidentiality and availability are not addressed by hash comparison.

Answer

Confidentiality

Answer

Availability

Answer

Authentication

Question 13

A team deploys an e-commerce application on an IaaS virtual machine. The cloud provider secures the datacenter, hardware, and hypervisor. The company wants to reduce the chance that attackers exploit outdated software on the VM itself. Which responsibility remains with the company?

Accepted Answer

Patch and harden the guest operating system and application running on the VM.. In an IaaS model, the cloud provider is responsible for the security of the cloud (datacenter, hardware, hypervisor), while the customer is responsible for security in the cloud. This includes patching and hardening the guest OS and application on the VM. The company must manage vulnerabilities in the software stack it controls to prevent exploitation of outdated components.

Answer

Replace the cloud provider’s physical security controls with on-site guards.

Answer

Install new firmware on the physical host server maintained by the provider.

Answer

Set the data center’s perimeter access badge policy.

Question 14

A company runs payroll and HR application servers on the same VLAN because a redesign is not possible this quarter. Security wants to reduce lateral movement if one workload is compromised, but the team cannot renumber the environment or add new physical firewalls. Which control best fits the requirement?

Accepted Answer

Implement microsegmentation with host-based or distributed firewall rules between workloads. Microsegmentation using host-based or distributed firewall rules (e.g., via a hypervisor firewall or host firewall policies) allows the security team to enforce zero-trust east-west traffic controls between the payroll and HR servers without changing the VLAN, subnet, or adding physical firewalls. This directly reduces lateral movement by restricting communication to only what is necessary, even though both workloads share the same Layer 2 broadcast domain.

Answer

Move the servers into a single larger subnet so internal routing is simplified

Answer

Place the servers behind a network address translation device to hide their IP addresses

Answer

Rely on password rotation and MFA for administrative logins only

Question 15

An operations team manages Linux servers over SSH. The security team wants to stop direct management access from employee laptops, reduce lateral movement if one admin endpoint is compromised, and keep a log of every administrative session. Which two design choices best fit? Select two.

Accepted Answer

Require administrators to connect to a bastion host or jump server before reaching the Linux servers.. A bastion host (jump server) acts as a single, hardened entry point that administrators must connect to before reaching internal Linux servers. This eliminates direct SSH access from employee laptops, reducing the attack surface and preventing lateral movement if an admin endpoint is compromised. The bastion host can also enforce centralized logging of all administrative sessions, meeting the security team's requirement for session recording.

Answer

Let all corporate laptops connect directly to SSH on the servers if MFA is enabled.

Answer

Expose SSH to the internet because key-based authentication is already strong.

Answer

Use split tunneling for admin traffic so management packets can bypass the VPN.

Question 16

Based on the exhibit, what best describes the additional measures applied to the legacy system?

Accepted Answer

Compensating controls, because they reduce risk when the preferred security controls are not possible.. The exhibit shows a legacy system that cannot support modern authentication protocols like Kerberos or NTLMv2. The additional measures—such as network segmentation, strict firewall rules, and an application-layer gateway—are compensating controls. They reduce risk by enforcing security in the network layer since the preferred control (upgrading the OS or application to support strong authentication) is not feasible.

Answer

Preventive controls, because they stop every possible compromise completely.

Answer

Corrective controls, because they repair the controller after an incident occurs.

Answer

Deterrent controls, because they mainly scare attackers away from trying.

Question 17

Based on the exhibit, which action should the incident response team take next to eradicate the threat?

Accepted Answer

Reimage the endpoint from a known-good build and reset potentially exposed credentials.. The exhibit indicates a confirmed compromise (e.g., a scheduled task establishing outbound C2 traffic). Eradication requires removing all traces of the attacker's foothold, which is best achieved by reimaging the endpoint from a known-good build. Additionally, any credentials that may have been exposed during the compromise must be reset to prevent lateral movement or re-entry.

Answer

Return the workstation to the user since the outbound connection was blocked.

Answer

Delete only the scheduled task and reconnect the host to monitor for more alerts.

Answer

Close the incident because memory capture has already preserved the evidence.

Question 18

A security analyst observes a pattern where an account exhibits multiple failed login attempts from an IP address in a foreign country, followed by a successful login from the same account but from a different IP address in another foreign country minutes later. The analyst wants to deploy a control that can automatically detect and alert on this type of anomalous user behavior, even if the individual login events are not blocked by existing rules. Which of the following security controls is BEST suited for this task?

Accepted Answer

User Behavior Analytics (UBA). User Behavior Analytics (UBA) is the best control because it uses machine learning to establish a baseline of normal user behavior (e.g., typical login locations, times, and IP ranges) and then detects anomalies such as a rapid sequence of failed logins from one foreign country followed by a successful login from another foreign country. Unlike static rules, UBA can identify this pattern as suspicious even if each individual login event is not blocked by existing rules, triggering an alert for further investigation.

Answer

Geofencing

Answer

Account lockout policy

Answer

SIEM correlation rules

Question 19

A security architect is designing the network security for a web application hosted in a public cloud environment such as AWS. The application uses an Application Load Balancer (ALB) that distributes traffic to a fleet of web servers. The web servers must only accept traffic from the ALB, and all other inbound traffic must be blocked. The ALB itself needs to accept HTTP/HTTPS traffic from anywhere on the internet. Which of the following cloud security controls should the architect configure on the web servers' network interface to best meet this requirement, assuming the cloud provider offers both stateful and stateless network filtering options?

Accepted Answer

A stateful security group that allows inbound traffic from the ALB's security group only.. A stateful security group in AWS can reference another security group as a source, allowing inbound traffic only from instances associated with the ALB's security group. This ensures that web servers accept traffic exclusively from the ALB, while the ALB itself can accept HTTP/HTTPS from the internet via its own security group rules. Stateful filtering automatically allows return traffic, simplifying rule management and meeting the requirement precisely.

Answer

A stateless network ACL that allows inbound traffic from the ALB's subnet only.

Answer

A web application firewall (WAF) that inspects all traffic for SQL injection.

Answer

A host-based firewall on each web server that allows traffic from the ALB's private IP address.

Question 20

Users on one VLAN report that their traffic to the default gateway is intermittently slow and sometimes reaches the wrong device. A packet capture shows unsolicited ARP replies claiming to be the gateway. Which two actions are the best mitigations on managed switches? Select two.

Accepted Answer

enable DHCP snooping so trusted IP-to-MAC bindings can be validated. DHCP snooping creates a trusted database of IP-to-MAC bindings by monitoring DHCP messages. This database is then used by Dynamic ARP Inspection (DAI) to validate ARP packets, ensuring that only legitimate gateway addresses are accepted. Without DHCP snooping, DAI has no reliable source of truth to compare against, making it ineffective against ARP spoofing attacks.

Answer

change the default gateway IP address on the subnet

Answer

disable spanning tree protocol to reduce switching delays

Answer

replace private addressing with NAT on every endpoint