SY0-701 Practice Exam 51 — 20 Questions

Question 1

Based on the exhibit, what is the best next request before approving the vendor?

Accepted Answer

Request a current SOC 2 Type II report or equivalent independent operating-effectiveness attestation.. A SOC 2 Type II report provides an independent, third-party attestation of the effectiveness of a vendor's security controls over a period of time (typically 6–12 months). This is the most reliable evidence for verifying that the vendor's operational security controls are working as intended, which is critical before approving a vendor. The internal penetration test summary (Option B) lacks independence and may not cover all relevant controls, while a marketing brochure (Option A) is not a verifiable audit artifact. The shared responsibility matrix (Option C) defines roles but does not attest to control effectiveness.

Answer

Ask for a fresh marketing brochure that describes the vendor's security controls in detail.

Answer

Accept the internal penetration test summary because it proves the controls were tested recently.

Answer

Request only the shared responsibility matrix again, since it covers all security responsibilities.

Question 2

A regulated analytics workload is moving to a public cloud. The business wants the strongest practical tenant isolation without managing physical servers, and it also needs an audit trail for changes made to the cloud environment. Which two design choices best meet those requirements? Select two.

Accepted Answer

Place the workload in a dedicated account, project, or subscription with restricted cross-account access.. Placing the workload in a dedicated account, project, or subscription with restricted cross-account access provides strong logical isolation at the cloud provider's control plane. This approach meets the requirement for tenant isolation without managing physical servers, as it leverages the provider's built-in resource boundaries and IAM policies to prevent unauthorized access between tenants.

Answer

Deploy the workload in a shared public subnet to simplify routing between tenants.

Answer

Assume the cloud provider will record every guest operating system event automatically.

Answer

Disable logging to reduce storage costs because the provider already has all necessary records.

Question 3

A user's laptop suddenly starts renaming many files and showing a ransom note. The laptop is still connected to Wi-Fi. What is the best immediate action?

Accepted Answer

Disconnect the laptop from the network immediately.. Ransomware actively encrypts files and may communicate with a command-and-control (C2) server over the network to exfiltrate data or receive encryption keys. Disconnecting the Wi-Fi immediately stops further C2 communication, prevents lateral movement to other devices, and halts any ongoing data exfiltration. This containment step is critical before any remediation like system imaging or forensic analysis.

Answer

Reboot the laptop to stop the malicious process.

Answer

Delete the ransom note and continue working.

Answer

Change the user's password and wait for more details.

Question 4

A network engineer needs to change an ACL on a production firewall so a new SaaS integration works. The business cannot tolerate an extended outage, and the change must be reversible if testing fails. Which practice best fits?

Accepted Answer

Follow formal change management with approval, testing, and rollback planning. Formal change management ensures the ACL modification is documented, tested in a staging environment, and includes a rollback plan (e.g., reverting to a saved configuration or applying a 'no' command for the specific ACL entry). This minimizes downtime by allowing controlled implementation and immediate reversal if the SaaS integration fails, aligning with the business's zero-tolerance for extended outages.

Answer

Make the change directly during business hours without documentation

Answer

Disable logging temporarily so the firewall change applies faster

Answer

Ask the vendor to modify the firewall remotely without internal review

Question 5

A security analyst is reviewing the source code of a custom web application. The application receives JSON data from users, which includes a 'type' field. The application uses the 'type' field to determine which Java class to instantiate, and then calls a method on that object. The application does not validate or sanitize the 'type' field. An attacker sends a crafted JSON payload that causes the application to instantiate an unexpected class, leading to remote code execution. Which type of vulnerability does this example describe?

Accepted Answer

Insecure deserialization. The application deserializes untrusted JSON data and uses the 'type' field to dynamically instantiate a Java class without validation. This is a classic insecure deserialization vulnerability, where an attacker can supply a malicious class name (e.g., a gadget class like `Runtime` or a custom class) that, when instantiated and its method called, executes arbitrary code on the server. The lack of input sanitization on the 'type' field directly enables remote code execution via object instantiation.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 6

Based on the exhibit, which wireless security change best addresses both unauthorized device access and the risk of a lost laptop connecting to corporate resources?

Accepted Answer

Move the SSID to WPA2-Enterprise or WPA3-Enterprise with 802.1X, device certificates, and MDM-based compliance checks.. WPA2-Enterprise or WPA3-Enterprise with 802.1X, device certificates, and MDM-based compliance checks provides mutual authentication and per-user, per-session encryption. This eliminates the risk of a lost laptop connecting to corporate resources (since device certificates can be revoked) and prevents unauthorized device access through certificate-based authentication and MDM compliance enforcement, unlike shared PSK which cannot be individually revoked.

Answer

Increase the PSK length and rotate it every 30 days.

Answer

Hide the SSID and enable MAC address filtering on the access points.

Answer

Keep the current wireless design and rely on a VPN client for all remote access.

Question 7

An employee gets a text message saying their mobile carrier will suspend service unless they tap a link and verify their account details. What type of attack is this?

Accepted Answer

Smishing, because the attacker is using SMS messages to trick the user. This is smishing because the attacker uses SMS (Short Message Service) as the delivery vector to send a fraudulent message that tricks the recipient into clicking a malicious link. Smishing is a form of social engineering that exploits the trust users place in text-based communications from known entities like mobile carriers, often leading to credential theft or malware installation.

Answer

Vishing, because the attacker is using a voice call to pressure the user

Answer

Baiting, because the attacker is offering a free service upgrade

Answer

Tailgating, because the attacker is trying to enter a building behind someone else

Question 8

A critical patch must be applied to a retail point-of-sale server. What is the best way to reduce business disruption?

Accepted Answer

Schedule the patch during an approved maintenance window.. Scheduling the patch during an approved maintenance window is the best practice to minimize business disruption because it allows the organization to plan for downtime during low-activity periods, coordinate with stakeholders, and ensure rollback procedures are in place. For a retail point-of-sale (POS) server, applying a critical patch outside of business hours prevents transaction interruptions and potential revenue loss, aligning with change management policies that prioritize availability and security.

Answer

Apply the patch during the busiest business hours to make the change sooner.

Answer

Skip the patch and rely on hope that the issue will not be exploited.

Answer

Turn off all backups so the patch process runs faster.

Question 9

Based on the exhibit, which issue should be remediated first by the operations team?

A small company has limited maintenance windows and can address only one of several findings this week.

Accepted Answer

vpn-gw01, because it is internet-facing, exploitable now, and a fix is available.. Vpn-gw01 is internet-facing, has an active exploit (CVSS score indicating current exploitation), and a vendor patch is available. In risk management, the highest priority is given to assets that are exposed to the internet, currently exploitable, and have a known fix, as this combination presents the most urgent threat to the organization's security posture.

Answer

db-lab02, because high-severity findings always outrank medium and critical findings.

Answer

printsrv03, because it is internet-facing and has no vendor patch available.

Answer

None of these, because the team should wait for the next quarterly review before changing anything.

Question 10

A company wants to make sure it can recover quickly after ransomware, even if the production network is unavailable. Which backup approach is the best choice?

Accepted Answer

Keep an offline copy of backups that is disconnected from production systems.. An offline (air-gapped) backup, such as a tape stored in a safe or a disconnected external drive, ensures that ransomware cannot encrypt or delete the backup data. This approach guarantees recoverability even when the production network is completely compromised or unavailable, aligning with the 3-2-1 backup rule (three copies, two media types, one offsite/offline).

Answer

Store backups only on the same file server so they are easy to access.

Answer

Use a single monthly backup and never test restores to save time.

Answer

Save backups in the same cloud account using the same admin credentials.

Question 11

Based on the exhibit, which network redesign would best limit lateral movement between user endpoints and building systems after a workstation compromise?

Accepted Answer

Separate workstations, phones, badge readers, and cameras into different VLANs with ACLs or firewall rules between them.. Segmenting workstations, phones, badge readers, and cameras into separate VLANs with ACLs or firewall rules between them enforces micro-segmentation. This prevents a compromised workstation from directly initiating lateral movement to building systems (e.g., cameras or badge readers) by restricting inter-VLAN traffic at Layer 3/4, limiting the blast radius of an attack.

Answer

Move every device into a single flat subnet so internal routing is simpler.

Answer

Keep the design unchanged and rely on antivirus on the workstations to block access to the cameras.

Answer

Put all traffic through the guest Wi-Fi VLAN to isolate it from the corporate network.

Question 12

A stateless firewall sits between a DMZ subnet 10.10.10.0/24 and an internal subnet 10.10.20.0/24. Only the web server at 10.10.10.25 should be allowed to initiate TCP sessions to the app server at 10.10.20.20 on port 8443. All other DMZ-to-internal traffic must remain blocked. Which ACL entry is the best fit on the DMZ-facing interface?

Accepted Answer

permit tcp host 10.10.10.25 host 10.10.20.20 eq 8443 followed by deny ip any any. It explicitly permits only the web server at 10.10.10.25 to initiate TCP sessions to the app server at 10.10.20.20 on port 8443, then denies all other traffic. Since the firewall is stateless, it cannot track session state, so the ACL must be applied on the DMZ-facing interface to control outbound-initiated traffic from the DMZ to the internal subnet. The permit statement uses the 'host' keyword for precise source and destination, followed by an explicit deny all to block any other DMZ-to-internal traffic.

Answer

deny tcp 10.10.10.0/24 10.10.20.0/24 eq 8443 followed by permit ip any any

Answer

permit tcp host 10.10.20.20 host 10.10.10.25 eq 8443 followed by deny ip any any

Answer

permit ip 10.10.10.0/24 10.10.20.0/24 followed by deny ip any any

Question 13

Finance staff receive an email from the 'CFO' using a lookalike domain. The message requests an urgent gift-card purchase, says the recipient must keep it confidential, and pressures them to skip normal approval steps. What attack is this most likely?

Accepted Answer

Business email compromise using executive impersonation and urgency.. This scenario describes a business email compromise (BEC) attack where the threat actor impersonates an executive (the CFO) using a lookalike domain to trick a finance employee into making an unauthorized gift-card purchase. The use of urgency, confidentiality, and pressure to bypass normal approval processes are classic BEC social engineering tactics, not technical exploits.

Answer

Watering-hole attack targeting employees through a compromised website.

Answer

Smishing attempt delivered through a text message to a mobile phone.

Answer

Credential stuffing against the CFO's mailbox using previously leaked passwords.

Question 14

A legacy payroll server contains a critical vulnerability. The vendor says a patch is 45 days away, and the system must remain available for payroll processing. Which risk treatment is the best short-term choice?

Accepted Answer

Mitigate the risk with compensating controls such as segmentation, restricted access, and monitoring.. Compensating controls like network segmentation, strict access controls, and enhanced monitoring can reduce the risk of exploitation while keeping the legacy payroll server operational. This approach directly addresses the need for availability during the 45-day patch window, aligning with the principle of defense-in-depth for unpatched systems.

Answer

Accept the risk until the patch arrives because the server is needed for payroll processing.

Answer

Avoid the risk by permanently decommissioning the server this week.

Answer

Transfer the risk by purchasing support coverage and waiting for the patch.

Question 15

A small enterprise is rebuilding its public customer portal. The web front end must be reachable from the internet, the application tier should never be directly exposed, and the database must remain private even if the web server is compromised. Which two design changes best meet those goals? Select two.

Accepted Answer

Place the web front end in a DMZ behind a firewall rule allowing only HTTPS from the internet.. Placing the web front end in a DMZ behind a firewall rule that permits only HTTPS (TCP/443) from the internet ensures the public-facing component is isolated from internal networks. This design prevents direct inbound access to the application or database tiers, reducing the attack surface while still allowing legitimate web traffic.

Answer

Put the database on the same subnet as the web front end so internal calls have lower latency.

Answer

Allow the database to accept connections from the internet if strong passwords are used.

Answer

Disable all inbound filtering on the DMZ so troubleshooting is simpler.

Question 16

A records manager learns that emails related to a harassment investigation are scheduled for deletion next week under the retention policy. Legal issues a hold because the case may go to court. What should the records manager do?

Accepted Answer

Suspend deletion until the legal hold is lifted. A legal hold overrides standard retention policies because it preserves electronically stored information (ESI) that may be relevant to litigation. The records manager must immediately suspend deletion to avoid spoliation, which could result in legal sanctions. This aligns with the eDiscovery process and the duty to preserve evidence once litigation is reasonably anticipated.

Answer

Delete the emails after creating a summary report

Answer

Archive the emails permanently in the same mailbox

Answer

Anonymize the sender names and keep the messages

Question 17

A public website is overwhelmed by a flood of DNS responses arriving from many open resolvers after the attacker sends small forged queries to those resolvers. The target bandwidth is saturated and the source IPs vary widely. What kind of attack is being used?

Accepted Answer

DNS amplification DDoS. B is correct because this scenario describes a DNS amplification DDoS attack. The attacker sends small forged DNS queries with a spoofed source IP (the victim's IP) to open resolvers, which respond with much larger DNS replies. The flood of amplified responses saturates the victim's bandwidth, and the varying source IPs make mitigation difficult. This matches the description of a reflection/amplification attack using DNS.

Answer

SYN flood

Answer

Replay attack

Answer

Man-in-the-middle attack

Question 18

A company is enhancing its network security posture. The security team deploys a system that passively monitors network traffic, analyzes packets for signs of malicious activity, and generates alerts when suspicious patterns are detected. This system does not actively block or modify any traffic. Which type of security control does this system BEST represent?

Accepted Answer

Detective control. This system is a detective control because it passively monitors network traffic, analyzes packets for signs of malicious activity, and generates alerts without actively blocking or modifying traffic. Detective controls are designed to identify and report security incidents after they occur or as they happen, which aligns with the described behavior of an Intrusion Detection System (IDS). Unlike preventive controls, it does not enforce policy or stop threats in real time.

Answer

Preventive control

Answer

Corrective control

Answer

Deterrent control

Question 19

An HR analyst must send a salary file to an external auditor. The auditor only needs names, departments, and salary totals, not Social Security numbers or bank account details. Which two actions should the analyst take first? Select two.

Accepted Answer

Remove unnecessary sensitive fields before sharing. Removing unnecessary sensitive fields (like Social Security numbers and bank account details) before sharing the file reduces the risk of exposing personally identifiable information (PII) and aligns with the principle of data minimization. This step ensures that only the required data (names, departments, salary totals) is transmitted, which is a foundational security control before any data transfer occurs.

Answer

Upload the file to a public link and send the URL by email

Answer

Rename the file to a less obvious name and send it normally

Answer

Save the file locally on a USB drive and hand-deliver it

Question 20

An organization is redesigning access for a finance application. Employees should be able to approve expense reports only within their assigned job roles, and every approval must be traceable to the individual user who performed it. Which access model best fits this requirement?

Accepted Answer

Role-based access control, because permissions are assigned by job function and tied to named users.. Role-based access control (RBAC) is the correct choice because it assigns permissions based on job functions (e.g., 'Finance Approver') and links those permissions to named user accounts. This ensures that only employees in the appropriate role can approve expense reports, and each approval action is logged against the specific user, providing non-repudiation and traceability.

Answer

Mandatory access control, because a central authority labels each expense report by sensitivity.

Answer

Discretionary access control, because individual employees decide who can approve expenses.

Answer

Rule-based access control, because approval rights are determined only by the time of day.