SY0-701 Practice Exam 51 — 20 Questions

Question 1

A file server in the accounting department begins renaming documents and dropping ransom notes. The SOC confirms encryption is still in progress, and the server hosts a share used by several finance teams. What should the incident response team do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disconnect the server from the network to contain the spread.. Disconnecting the server from the network is the immediate containment step to prevent the ransomware from encrypting additional files on the share or spreading laterally to other systems. Since encryption is still in progress, isolating the server stops the attacker's process from accessing more files and blocks any command-and-control (C2) communication. This aligns with the NIST incident response framework's containment phase, prioritizing stopping the spread over recovery or notification.

Answer

Restore the file share from backup immediately while the server is still connected.

Answer

Power off the server immediately without any other action.

Answer

Notify users to change their passwords before any technical action is taken.

Question 2

An office wants finance workstations separated from general user PCs, but employees still need to print to a shared printer and access one accounting application. Which change best supports this?

Accepted Answer

Move finance systems to a separate VLAN or subnet and allow only required traffic through filtering rules.. Placing finance systems on a separate VLAN or subnet with a Layer 3 boundary enforces network segmentation, which limits broadcast domains and restricts lateral movement. By configuring access control lists (ACLs) or firewall rules to permit only the required traffic (e.g., SMB/CIFS for printer sharing and specific TCP/UDP ports for the accounting application), the organization achieves a least-privilege network architecture. This approach aligns with the principle of defense-in-depth, reducing the attack surface while maintaining necessary business functionality.

Answer

Place all systems on one VLAN and rely on strong passwords.

Answer

Put the printer in a different building to make it more secure.

Answer

Enable screen lock timers on the finance PCs and keep the network flat.

Question 3

An enterprise is moving from on-prem identity to a SaaS HR platform. Employees should sign in with corporate credentials, and terminated users must lose access quickly without manually creating or deleting SaaS passwords. Which solution best fits?

Accepted Answer

Implement federated SSO with the corporate identity provider and automated provisioning and deprovisioning.. Federated SSO with the corporate identity provider (IdP) allows employees to sign in using their existing corporate credentials via standards like SAML 2.0 or OIDC, eliminating the need for separate SaaS passwords. Automated provisioning and deprovisioning (e.g., via SCIM) ensures that when a user is terminated in the HR platform, their access to the SaaS application is revoked immediately without manual intervention, meeting the requirement for rapid access removal.

Answer

Create a shared HR password for all employees and change it quarterly.

Answer

Use LDAP bind accounts directly against the SaaS platform for every login.

Answer

Require each user to create a separate local SaaS account and store the credentials in a vault.

Question 4

A web server should accept traffic only from a load balancer and a management jump host. The current host firewall allows all inbound ports, and the web service runs as a domain administrator. Which two changes most improve hardening without breaking the required access pattern? Select two.

Accepted Answer

Restrict host firewall rules to required source addresses and ports.. Restricting host firewall rules to only the load balancer and management jump host's source IP addresses and required ports (e.g., HTTP/HTTPS for the load balancer, SSH/RDP for the jump host) enforces the principle of least privilege. This eliminates the risk of exposing unnecessary services to the entire network, which is a common attack vector. The current 'allow all inbound ports' configuration violates basic network segmentation and access control best practices.

Answer

Leave SSH open to every subnet and rely on strong passwords.

Answer

Give the service account local administrator rights so it can restart itself.

Answer

Disable patching during business hours permanently.

Question 5

A finance workstation is suspected of running malware. It is still powered on, the user is logged in, and the network cable is connected. Which two actions best preserve volatile evidence before shutdown? Select two.

Accepted Answer

Capture RAM or a volatile memory image before the system is powered off. Capturing RAM or a volatile memory image preserves data that is lost when the system is powered off, such as running processes, encryption keys, and network connections. This is a fundamental step in forensic incident response to ensure volatile evidence is not destroyed before analysis.

Answer

Shut the workstation down immediately and restart it cleanly

Answer

Run a disk defragmentation utility to prepare for imaging

Answer

Uninstall the suspected malware before collecting any evidence

Question 6

Based on the exhibit, what is the best next request before approving the vendor?

Accepted Answer

Request a current SOC 2 Type II report or equivalent independent operating-effectiveness attestation.. A SOC 2 Type II report provides an independent, third-party attestation of the effectiveness of a vendor's security controls over a period of time (typically 6–12 months). This is the most reliable evidence for verifying that the vendor's operational security controls are working as intended, which is critical before approving a vendor. The internal penetration test summary (Option B) lacks independence and may not cover all relevant controls, while a marketing brochure (Option A) is not a verifiable audit artifact. The shared responsibility matrix (Option C) defines roles but does not attest to control effectiveness.

Answer

Ask for a fresh marketing brochure that describes the vendor's security controls in detail.

Answer

Accept the internal penetration test summary because it proves the controls were tested recently.

Answer

Request only the shared responsibility matrix again, since it covers all security responsibilities.

Question 7

The help desk needs a document that tells analysts exactly how to verify a caller, reset a password, and record the ticket when a user is locked out. What type of document is this?

Accepted Answer

Procedure. A procedure is the correct type of document because it provides step-by-step instructions for performing a specific task, such as verifying a caller's identity, resetting a password, and recording a ticket. Unlike a policy, which states high-level rules, a procedure details the exact actions to take in a given scenario, making it ideal for help desk operations.

Answer

Policy

Answer

Standard

Answer

Guideline

Question 8

A company wants guest Wi-Fi to reach only the internet, employee laptops to reach internal apps, and payment servers to remain isolated from both. What is the best design approach?

Accepted Answer

Use separate network segments with firewall rules between guest, employee, and payment zones.. Network segmentation using separate VLANs or subnets with firewall rules enforces isolation between guest Wi-Fi, employee laptops, and payment servers. This design ensures that guest traffic can only reach the internet, employee traffic can access internal apps, and payment servers are completely isolated from both, meeting the principle of least privilege and reducing the attack surface.

Answer

Place all systems on one flat network and rely on antivirus.

Answer

Put all systems behind a single VPN so every device is treated the same.

Answer

Use a larger internet circuit so the payment servers are harder to attack.

Question 9

A user's laptop suddenly starts renaming many files and showing a ransom note. The laptop is still connected to Wi-Fi. What is the best immediate action?

Accepted Answer

Disconnect the laptop from the network immediately.. Ransomware actively encrypts files and may communicate with a command-and-control (C2) server over the network to exfiltrate data or receive encryption keys. Disconnecting the Wi-Fi immediately stops further C2 communication, prevents lateral movement to other devices, and halts any ongoing data exfiltration. This containment step is critical before any remediation like system imaging or forensic analysis.

Answer

Reboot the laptop to stop the malicious process.

Answer

Delete the ransom note and continue working.

Answer

Change the user's password and wait for more details.

Question 10

A network engineer needs to change an ACL on a production firewall so a new SaaS integration works. The business cannot tolerate an extended outage, and the change must be reversible if testing fails. Which practice best fits?

Accepted Answer

Follow formal change management with approval, testing, and rollback planning. Formal change management ensures the ACL modification is documented, tested in a staging environment, and includes a rollback plan (e.g., reverting to a saved configuration or applying a 'no' command for the specific ACL entry). This minimizes downtime by allowing controlled implementation and immediate reversal if the SaaS integration fails, aligning with the business's zero-tolerance for extended outages.

Answer

Make the change directly during business hours without documentation

Answer

Disable logging temporarily so the firewall change applies faster

Answer

Ask the vendor to modify the firewall remotely without internal review

Question 11

A security analyst is reviewing the source code of a custom web application. The application receives JSON data from users, which includes a 'type' field. The application uses the 'type' field to determine which Java class to instantiate, and then calls a method on that object. The application does not validate or sanitize the 'type' field. An attacker sends a crafted JSON payload that causes the application to instantiate an unexpected class, leading to remote code execution. Which type of vulnerability does this example describe?

Accepted Answer

Insecure deserialization. The application deserializes untrusted JSON data and uses the 'type' field to dynamically instantiate a Java class without validation. This is a classic insecure deserialization vulnerability, where an attacker can supply a malicious class name (e.g., a gadget class like `Runtime` or a custom class) that, when instantiated and its method called, executes arbitrary code on the server. The lack of input sanitization on the 'type' field directly enables remote code execution via object instantiation.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 12

Based on the exhibit, which wireless security change best addresses both unauthorized device access and the risk of a lost laptop connecting to corporate resources?

Accepted Answer

Move the SSID to WPA2-Enterprise or WPA3-Enterprise with 802.1X, device certificates, and MDM-based compliance checks.. WPA2-Enterprise or WPA3-Enterprise with 802.1X, device certificates, and MDM-based compliance checks provides mutual authentication and per-user, per-session encryption. This eliminates the risk of a lost laptop connecting to corporate resources (since device certificates can be revoked) and prevents unauthorized device access through certificate-based authentication and MDM compliance enforcement, unlike shared PSK which cannot be individually revoked.

Answer

Increase the PSK length and rotate it every 30 days.

Answer

Hide the SSID and enable MAC address filtering on the access points.

Answer

Keep the current wireless design and rely on a VPN client for all remote access.

Question 13

A critical patch must be applied to a retail point-of-sale server. What is the best way to reduce business disruption?

Accepted Answer

Schedule the patch during an approved maintenance window.. Scheduling the patch during an approved maintenance window is the best practice to minimize business disruption because it allows the organization to plan for downtime during low-activity periods, coordinate with stakeholders, and ensure rollback procedures are in place. For a retail point-of-sale (POS) server, applying a critical patch outside of business hours prevents transaction interruptions and potential revenue loss, aligning with change management policies that prioritize availability and security.

Answer

Apply the patch during the busiest business hours to make the change sooner.

Answer

Skip the patch and rely on hope that the issue will not be exploited.

Answer

Turn off all backups so the patch process runs faster.

Question 14

Based on the exhibit, which issue should be remediated first by the operations team?

A small company has limited maintenance windows and can address only one of several findings this week.

Accepted Answer

vpn-gw01, because it is internet-facing, exploitable now, and a fix is available.. Vpn-gw01 is internet-facing, has an active exploit (CVSS score indicating current exploitation), and a vendor patch is available. In risk management, the highest priority is given to assets that are exposed to the internet, currently exploitable, and have a known fix, as this combination presents the most urgent threat to the organization's security posture.

Answer

db-lab02, because high-severity findings always outrank medium and critical findings.

Answer

printsrv03, because it is internet-facing and has no vendor patch available.

Answer

None of these, because the team should wait for the next quarterly review before changing anything.

Question 15

A company wants to make sure it can recover quickly after ransomware, even if the production network is unavailable. Which backup approach is the best choice?

Accepted Answer

Keep an offline copy of backups that is disconnected from production systems.. An offline (air-gapped) backup, such as a tape stored in a safe or a disconnected external drive, ensures that ransomware cannot encrypt or delete the backup data. This approach guarantees recoverability even when the production network is completely compromised or unavailable, aligning with the 3-2-1 backup rule (three copies, two media types, one offsite/offline).

Answer

Store backups only on the same file server so they are easy to access.

Answer

Use a single monthly backup and never test restores to save time.

Answer

Save backups in the same cloud account using the same admin credentials.

Question 16

Based on the exhibit, which network redesign would best limit lateral movement between user endpoints and building systems after a workstation compromise?

Accepted Answer

Separate workstations, phones, badge readers, and cameras into different VLANs with ACLs or firewall rules between them.. Segmenting workstations, phones, badge readers, and cameras into separate VLANs with ACLs or firewall rules between them enforces micro-segmentation. This prevents a compromised workstation from directly initiating lateral movement to building systems (e.g., cameras or badge readers) by restricting inter-VLAN traffic at Layer 3/4, limiting the blast radius of an attack.

Answer

Move every device into a single flat subnet so internal routing is simpler.

Answer

Keep the design unchanged and rely on antivirus on the workstations to block access to the cameras.

Answer

Put all traffic through the guest Wi-Fi VLAN to isolate it from the corporate network.

Question 17

A stateless firewall sits between a DMZ subnet 10.10.10.0/24 and an internal subnet 10.10.20.0/24. Only the web server at 10.10.10.25 should be allowed to initiate TCP sessions to the app server at 10.10.20.20 on port 8443. All other DMZ-to-internal traffic must remain blocked. Which ACL entry is the best fit on the DMZ-facing interface?

Accepted Answer

permit tcp host 10.10.10.25 host 10.10.20.20 eq 8443 followed by deny ip any any. It explicitly permits only the web server at 10.10.10.25 to initiate TCP sessions to the app server at 10.10.20.20 on port 8443, then denies all other traffic. Since the firewall is stateless, it cannot track session state, so the ACL must be applied on the DMZ-facing interface to control outbound-initiated traffic from the DMZ to the internal subnet. The permit statement uses the 'host' keyword for precise source and destination, followed by an explicit deny all to block any other DMZ-to-internal traffic.

Answer

deny tcp 10.10.10.0/24 10.10.20.0/24 eq 8443 followed by permit ip any any

Answer

permit tcp host 10.10.20.20 host 10.10.10.25 eq 8443 followed by deny ip any any

Answer

permit ip 10.10.10.0/24 10.10.20.0/24 followed by deny ip any any

Question 18

Finance staff receive an email from the 'CFO' using a lookalike domain. The message requests an urgent gift-card purchase, says the recipient must keep it confidential, and pressures them to skip normal approval steps. What attack is this most likely?

Accepted Answer

Business email compromise using executive impersonation and urgency.. This scenario describes a business email compromise (BEC) attack where the threat actor impersonates an executive (the CFO) using a lookalike domain to trick a finance employee into making an unauthorized gift-card purchase. The use of urgency, confidentiality, and pressure to bypass normal approval processes are classic BEC social engineering tactics, not technical exploits.

Answer

Watering-hole attack targeting employees through a compromised website.

Answer

Smishing attempt delivered through a text message to a mobile phone.

Answer

Credential stuffing against the CFO's mailbox using previously leaked passwords.

Question 19

A legacy payroll server contains a critical vulnerability. The vendor says a patch is 45 days away, and the system must remain available for payroll processing. Which risk treatment is the best short-term choice?

Accepted Answer

Mitigate the risk with compensating controls such as segmentation, restricted access, and monitoring.. Compensating controls like network segmentation, strict access controls, and enhanced monitoring can reduce the risk of exploitation while keeping the legacy payroll server operational. This approach directly addresses the need for availability during the 45-day patch window, aligning with the principle of defense-in-depth for unpatched systems.

Answer

Accept the risk until the patch arrives because the server is needed for payroll processing.

Answer

Avoid the risk by permanently decommissioning the server this week.

Answer

Transfer the risk by purchasing support coverage and waiting for the patch.

Question 20

A company is enhancing its network security posture. The security team deploys a system that passively monitors network traffic, analyzes packets for signs of malicious activity, and generates alerts when suspicious patterns are detected. This system does not actively block or modify any traffic. Which type of security control does this system BEST represent?

Accepted Answer

Detective control. This system is a detective control because it passively monitors network traffic, analyzes packets for signs of malicious activity, and generates alerts without actively blocking or modifying traffic. Detective controls are designed to identify and report security incidents after they occur or as they happen, which aligns with the described behavior of an Intrusion Detection System (IDS). Unlike preventive controls, it does not enforce policy or stop threats in real time.

Answer

Preventive control

Answer

Corrective control

Answer

Deterrent control