SY0-701 Practice Exam 51 — 20 Questions

Question 1

Based on the exhibit, which control should be enabled so corporate data stays separated from personal data on company-owned tablets?

Accepted Answer

Enable a work profile or container with selective wipe for corporate data.. Option C is correct because a work profile or container (e.g., Android Work Profile or iOS Managed Open In) creates a separate, encrypted partition for corporate data on the device. This allows IT to perform a selective wipe of only the corporate data without affecting the user's personal apps, photos, or settings, ensuring data separation while preserving user privacy.

Answer

Perform a full-device wipe any time a tablet is lost or reassigned.

Answer

Deploy mobile threat defense scanning on every tablet.

Answer

Disable Bluetooth and the camera on all tablets to stop data leakage.

Question 2

Based on the exhibit, which control option provides the greatest net annual financial benefit for the organization?

Accepted Answer

Option B, because its large reduction in annual loss outweighs the higher implementation cost.. Option B is correct because it provides the greatest net annual financial benefit. The annual loss reduction of $150,000 minus the annual implementation cost of $75,000 yields a net benefit of $75,000, which is higher than any other option. This demonstrates that a larger upfront investment can be justified when the reduction in annualized loss expectancy (ALE) significantly outweighs the control cost.

Answer

Option A, because it reduces loss enough to justify the control cost better than the smaller controls.

Answer

Option C, because transferring the risk is always cheaper than engineering a technical fix.

Answer

Option D, because low upfront cost makes it the most economical option regardless of residual loss.

Question 3

Based on the exhibit, which cloud service model best fits the application's operational and security requirements?

Accepted Answer

Platform as a Service (PaaS), because it offloads OS and runtime maintenance while preserving application control.. The exhibit shows an application that requires the organization to manage the application code and data while offloading the underlying OS, runtime, and middleware maintenance. Platform as a Service (PaaS) provides this exact split: the cloud provider handles the OS patches, runtime updates, and infrastructure scaling, while the organization retains full control over the application deployment and configuration. This matches the requirement of preserving application control without the overhead of managing the guest OS.

Answer

Infrastructure as a Service (IaaS), because it gives full control over the guest operating system.

Answer

Software as a Service (SaaS), because the organization would not need to maintain anything.

Answer

Colocation, because the team can place its own servers in a provider facility and manage everything directly.

Question 4

Based on the exhibit, which control should be installed or expanded to provide the earliest warning of this hazard?

Accepted Answer

Install or expand water-leak sensors under the raised floor and near the pipe path.. Water-leak sensors provide the earliest possible warning of a liquid hazard by detecting moisture before it reaches equipment or causes electrical shorts. In a data center with raised floors and pipe paths, these sensors can be placed directly in the path of potential leaks, triggering alerts immediately upon contact with water. This proactive monitoring is critical for preventing costly downtime and equipment damage.

Answer

Add badge readers to every rack so the servers can be tracked physically.

Answer

Replace the cameras with motion detectors to improve environmental safety.

Answer

Increase automatic screen lock timeouts on all administrative workstations.

Question 5

Based on the exhibit, which cryptographic mechanism provides proof that the update came from the vendor and was not altered?

Accepted Answer

Digital signature, because only the vendor's private key can produce the verified signature.. Option C is correct because a digital signature uses the vendor's private key to sign the update, and the customer verifies it using the vendor's public key. This asymmetric cryptographic mechanism ensures both authenticity (the update came from the vendor) and integrity (the update was not altered), as only the vendor's private key can produce a signature that validates with the corresponding public key.

Answer

Hashing, because matching SHA-256 values alone prove the file came from the vendor.

Answer

Symmetric encryption, because only the vendor and the customer share the secret key.

Answer

Salting, because adding random data makes the update file easier to trust.

Question 6

Based on the exhibit, which finding should be remediated first?

Accepted Answer

Finding A. Finding A indicates a critical vulnerability with a CVSS score of 9.8, which is the highest severity among the findings. Remediation should prioritize the most severe risk to minimize potential impact, as this vulnerability could allow remote code execution without authentication.

Answer

Finding B

Answer

Finding C

Answer

Finding D

Question 7

After reviewing a risk memo, the operations director signs off on continuing to use an older application because the cost of replacement is too high right now. Which risk management action did the director take?

Accepted Answer

Risk acceptance, because management chose to live with the remaining risk.. The operations director chose to continue using the older application despite the identified risk, explicitly because the cost of replacement was too high. This is the definition of risk acceptance: management acknowledges the risk and decides to tolerate the residual risk without implementing additional controls. The director did not transfer, avoid, or mitigate the risk; they accepted it as a cost of business.

Answer

Risk transfer, because the risk was moved to another company.

Answer

Risk avoidance, because the application is still being used.

Answer

Risk mitigation, because the replacement cost was too high.

Question 8

Based on the exhibit, which document type should define the exact encryption algorithm and minimum key length for all company laptops?

Accepted Answer

Standard. A Standard defines mandatory, specific technical requirements such as the exact encryption algorithm (e.g., AES-256) and minimum key length (e.g., 256 bits) that must be enforced on all company laptops. Policies are high-level statements of intent, while Standards provide the measurable, enforceable criteria to implement that intent. In this context, the encryption algorithm and key length are precise technical specifications, not general guidance or step-by-step instructions.

Answer

Policy

Answer

Procedure

Answer

Guideline

Question 9

Based on the exhibit, which governance artifact is being described?

Accepted Answer

Baseline, because it defines the approved minimum configuration that systems must meet.. The exhibit describes a baseline because it specifies the approved minimum configuration settings that systems must meet, such as requiring AES-256 encryption, disabling weak protocols like SSL and TLS 1.0, and enforcing a minimum password length of 14 characters. These are mandatory security thresholds, not broad intent, step-by-step instructions, or optional standards.

Answer

Policy, because it states broad organizational intent without requiring specific settings.

Answer

Standard, because it defines mandatory requirements but does not describe a step-by-step process.

Answer

Procedure, because it explains the exact sequence an administrator should follow to secure the device.

Question 10

Based on the exhibit, which document should be created or updated to make these settings mandatory and measurable?

Endpoint baseline draft:
- Full-disk encryption should be enabled on all corporate laptops.
- Screen lock should activate after 15 minutes of inactivity.
- Users should choose strong passwords.

Related documents:
Policy: Acceptable Use Policy
Standard: none
Procedure: Laptop imaging steps
Guideline: Suggested hardening tips

Accepted Answer

Create or update a standard because it defines mandatory, specific minimum requirements.. A standard defines mandatory, specific minimum requirements that must be met, such as 'full-disk encryption enabled' and 'screen lock after 15 minutes.' Unlike policies (high-level intent) or guidelines (suggestions), a standard provides measurable criteria that can be audited and enforced. Creating or updating a standard makes the endpoint baseline settings mandatory and measurable.

Answer

Update the policy because policies are always the most detailed technical documents.

Answer

Update the procedure because procedures are the best place for corporate requirements.

Answer

Update the guideline because guidelines are the strongest way to enforce compliance.

Question 11

A firewall rule change was implemented directly in production to allow a new vendor IP range. Within minutes, several internal services became unreachable because the rule order changed unexpectedly. Which change-management practice would have most likely prevented this outage?

Accepted Answer

Testing the change in a staging environment and approving it through a peer-reviewed change process before production.. Option A is correct because implementing the change in a staging environment first allows validation of the rule order and its impact on traffic flow without affecting production. A peer-reviewed change process ensures that the rule insertion point (e.g., before a deny-all or after a permit statement) is verified, preventing the accidental reordering that caused the outage. This aligns with the change-management principle of testing in a representative environment before production deployment.

Answer

Applying the rule during business hours so the team can respond faster if something breaks.

Answer

Making the change first in production because that is the only environment that matters.

Answer

Documenting the outage after the vendor confirms their IP range is valid.

Question 12

Several employees reported a text message that looked like it came from the VPN support team and linked to a fake sign-in page. Management wants to reduce future success of these attacks and improve how quickly users report suspicious messages. What should the security team implement?

Accepted Answer

Run role-based smishing simulations and provide a simple reporting workflow. Option B is correct because smishing simulations train users to recognize phishing SMS attacks in a controlled environment, directly reducing susceptibility. A simple reporting workflow (e.g., a dedicated email address or button in the messaging app) lowers the friction for users to report suspicious messages, enabling faster incident response. This combination addresses both the reduction of attack success and the improvement of reporting speed.

Answer

Send one annual lecture to all staff and close the ticket

Answer

Disable text messaging for every employee mobile device

Answer

Require managers to approve every external message before users open it

Question 13

A security analyst detects unusual outbound traffic from a workstation to an external IP address known for command and control. The analyst has verified the alert and wants to contain the threat. According to the NIST SP 800-61 incident response process, which of the following steps should the analyst take FIRST?

Accepted Answer

Disconnect the workstation from the network. According to NIST SP 800-61, the first step in containment during incident response is to prevent further damage by isolating the compromised system. Disconnecting the workstation from the network immediately stops the outbound command-and-control traffic, preventing data exfiltration and further compromise. This aligns with the 'containment' phase before any analysis or remediation occurs.

Answer

Perform a forensic analysis of the workstation

Answer

Reimage the workstation

Answer

Alert the system administrator

Question 14

A help desk technician needs temporary access to read one shared folder to troubleshoot a printer issue. Which access choice best follows least privilege?

Accepted Answer

Give the technician read-only access to the single shared folder needed for the ticket.. Option B is correct because it grants the technician only the minimum permissions (read-only) to the specific resource (single shared folder) required to troubleshoot the printer issue. This adheres to the principle of least privilege by limiting access scope and duration, reducing the risk of unauthorized changes or data exposure.

Answer

Grant the technician full control of the entire file server for one day.

Answer

Add the technician to the domain admins group until the issue is resolved.

Answer

Allow the technician to use any account in the department for convenience.

Question 15

Based on the exhibit, which malware type is most likely involved?

Accepted Answer

Ransomware, because files were encrypted and recovery options were intentionally removed.. The exhibit shows that files have been encrypted with a '.locked' extension and that recovery options like System Restore and Volume Shadow Copy have been removed or disabled. This is a classic indicator of ransomware, which encrypts user data and then demands payment for decryption, often deleting backup files to prevent recovery without the attacker's key.

Answer

Trojan, because the malware was likely disguised as a legitimate file.

Answer

Spyware, because the attacker is trying to monitor user activity quietly.

Answer

Rootkit, because the attacker is hiding from the operating system.

Question 16

Based on the exhibit, which finding should the security team remediate first?

Accepted Answer

WEB01 because it is internet-facing and has a critical exploitable vulnerability. WEB01 is internet-facing and has a critical exploitable vulnerability, meaning an attacker can directly compromise it from the public internet with minimal effort. This represents the highest risk because it combines high likelihood (exploit available) with high impact (full compromise of a public-facing server). Remediating this first aligns with the principle of prioritizing externally exposed systems with known critical flaws over internal or less severe issues.

Answer

LAP09 because user devices are always the easiest to patch

Answer

PRN01 because firmware issues can affect many users

Answer

FILE02 because internal servers are always more important than public ones

Question 17

Based on the exhibit, which indicator should defenders prioritize for detecting future activity from this campaign?

Accepted Answer

The TLS certificate fingerprint that remains constant across samples.. Option C is correct because a TLS certificate fingerprint that remains constant across samples provides a stable, attacker-controlled indicator that is difficult for adversaries to change without incurring cost or operational friction. Unlike domain names or user agents, which can be rotated easily, TLS certificates require the attacker to generate or compromise a new private key and certificate, making the fingerprint a persistent and reliable detection signature for defenders.

Answer

The daily-changing domain names used by the campaign.

Answer

The executable file hash that remains constant across samples.

Answer

The changing user agent string seen on each host.

Question 18

Based on the exhibit, which item is the strongest evidence that quarterly privileged access reviews occurred?

Accepted Answer

Signed access review spreadsheet with reviewer, date, and exceptions.. A signed access review spreadsheet with reviewer, date, and exceptions provides direct, non-repudiable evidence that a formal review of privileged access was completed. Unlike logs or policies, it explicitly documents the reviewer's identity, the date of review, and any exceptions, satisfying audit requirements for quarterly privileged access reviews.

Answer

SIEM export of administrator logins.

Answer

Help desk ticket for a password reset.

Answer

Screenshot of the access review policy.

Question 19

Based on the exhibit, which metric best shows that employees are recognizing and escalating phishing attempts more quickly?

Accepted Answer

Median report time, because it shows how quickly users notify security after spotting a phish.. The median report time directly measures the speed at which employees notify the security team after identifying a phishing simulation email. A decreasing median report time indicates that users are recognizing phishing attempts more quickly and escalating them, which is the key behavioral change this metric captures. Unlike click rate, which only measures failure, report time measures the positive action of reporting.

Answer

Click rate, because a lower click rate is the only useful awareness metric.

Answer

Training completion rate, because it proves every employee attended the awareness session.

Answer

Number of simulation emails sent, because a larger campaign is always a better metric.

Question 20

Based on the exhibit, which network redesign would best limit lateral movement between user endpoints and building systems after a workstation compromise?

Accepted Answer

Separate workstations, phones, badge readers, and cameras into different VLANs with ACLs or firewall rules between them.. Option B is correct because segmenting workstations, phones, badge readers, and cameras into separate VLANs with ACLs or firewall rules between them enforces micro-segmentation. This prevents a compromised workstation from directly initiating lateral movement to building systems (e.g., cameras or badge readers) by restricting inter-VLAN traffic at Layer 3/4, limiting the blast radius of an attack.

Answer

Move every device into a single flat subnet so internal routing is simpler.

Answer

Keep the design unchanged and rely on antivirus on the workstations to block access to the cameras.

Answer

Put all traffic through the guest Wi-Fi VLAN to isolate it from the corporate network.

SY0-701 Practice Exam 51 — 20 Questions

Exhibit

SY0-701 Practice Exam 51 — 20 Questions

Exhibit