SY0-701 Practice Exam 52 — 20 Questions

Question 1

An HR analyst must send a salary file to an external auditor. The auditor only needs names, departments, and salary totals, not Social Security numbers or bank account details. Which two actions should the analyst take first? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove unnecessary sensitive fields before sharing. Removing unnecessary sensitive fields (like Social Security numbers and bank account details) before sharing the file reduces the risk of exposing personally identifiable information (PII) and aligns with the principle of data minimization. This step ensures that only the required data (names, departments, salary totals) is transmitted, which is a foundational security control before any data transfer occurs.

Answer

Upload the file to a public link and send the URL by email

Answer

Rename the file to a less obvious name and send it normally

Answer

Save the file locally on a USB drive and hand-deliver it

Question 2

An organization is redesigning access for its HR portal. HR staff need to update employee records, managers need to approve leave requests, and payroll staff need access to salary data, but no single user should receive all of those permissions by default. What is the best access model?

Accepted Answer

Create separate roles for HR, managers, and payroll, and grant only the permissions needed for each job function.. Role-Based Access Control (RBAC) assigns permissions based on job functions, ensuring that HR staff, managers, and payroll personnel receive only the privileges necessary for their roles. This enforces the principle of least privilege and prevents any single user from inheriting all permissions by default, which aligns with the organization's security requirement.

Answer

Assign everyone the same portal permissions to simplify administration.

Answer

Give every manager full HR and payroll access so approvals are faster.

Answer

Use one shared administrator account for all HR actions to keep audits simple.

Question 3

A file server suddenly renames documents, creates ransom notes, and users can no longer open their files. Which malware type is most likely involved?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts files and demands payment for decryption. The symptoms—documents being renamed, ransom notes appearing, and users losing access to their files—are classic indicators of ransomware activity, which typically uses strong encryption algorithms like AES or RSA to lock files.

Answer

Spyware

Answer

Rootkit

Answer

Worm

Question 4

A customer-facing website must stay available if one of two application servers fails. Which design should the team implement?

Accepted Answer

A load balancer in front of multiple application servers. A load balancer distributes incoming traffic across multiple application servers, providing high availability and fault tolerance. If one server fails, the load balancer automatically redirects traffic to the remaining healthy server(s), ensuring the website remains accessible. This design directly addresses the requirement for continued availability despite a single server failure.

Answer

A single server with a larger power supply

Answer

A daily screenshot of the website

Answer

A more restrictive password policy

Question 5

Based on the exhibit, which artifact is the strongest evidence that the firewall change was reviewed and approved before implementation?

Accepted Answer

The change request record with CAB approval timestamp and implementation time.. The change request record with a CAB approval timestamp and implementation time provides a clear, auditable trail that the firewall change was formally reviewed and authorized by the Change Advisory Board before it was executed. This aligns with the change management process required for security program oversight, ensuring that changes are not implemented without proper governance.

Answer

The engineer's post-implementation email, because it confirms someone checked the change.

Answer

The firewall logs, because they show the rule was applied successfully on the device.

Answer

The vendor's maintenance notice, because it explains why the rule was needed.

Question 6

A company wants to make sure only approved administrators can view and rotate a shared encryption secret used by several applications. What is the best way to manage that secret?

Accepted Answer

Use a centralized secrets vault or key management system. A centralized secrets vault or key management system (KMS) like HashiCorp Vault or AWS KMS provides role-based access control (RBAC), audit logging, and automatic rotation of secrets. This ensures only approved administrators can view and rotate the shared encryption secret, while applications retrieve it via secure APIs without exposing it in code or files.

Answer

Store it in a shared spreadsheet

Answer

Put it directly in application source code

Answer

Email the secret only to trusted administrators

Question 7

A small internal reporting server has a low-severity vulnerability. Fixing it now would require several hours of downtime, while the business impact of exploitation is considered low. What is the BEST risk treatment for this situation?

Accepted Answer

Accept the risk after documenting the decision. The best risk treatment is to accept the risk because the vulnerability is low-severity, the business impact of exploitation is low, and the cost of remediation (several hours of downtime) exceeds the potential loss. Documenting the acceptance ensures auditability and informed management approval, which is a standard practice in risk management frameworks like NIST SP 800-37.

Answer

Transfer the risk to a third party

Answer

Avoid the risk by shutting down the server permanently

Answer

Mitigate the risk by immediately replacing the server

Question 8

A finance laptop is opened to review an invoice attachment. EDR then shows winword.exe launching powershell.exe with hidden, no-profile, and base64-encoded arguments. No executable is written to disk, network beacons begin from memory, and after a reboot the activity disappears unless the document is opened again. What type of malware behavior is most likely?

Accepted Answer

Fileless attack, because malicious code runs in memory and leaves little or no executable artifact on disk.. The scenario describes malicious code that executes entirely in memory without writing an executable to disk, which is the defining characteristic of a fileless attack. Winword.exe launching PowerShell with hidden, no-profile, and base64-encoded arguments is a classic technique to load and execute payloads directly in memory, bypassing traditional file-based detection. The fact that activity disappears after reboot unless the document is reopened confirms that no persistent artifact remains on disk, further supporting fileless behavior.

Answer

Worm behavior, because the infection would self-replicate across systems through the network.

Answer

Rootkit behavior, because the malware is hidden from normal user-mode tools.

Answer

Ransomware, because the user opened an invoice attachment before the suspicious activity started.

Question 9

A project team needs to use an unapproved file-sharing application for two weeks because the approved platform cannot support an external client collaboration feature. What is the best security action?

Accepted Answer

Approve a documented temporary exception with compensating controls and a review date. It follows the principle of risk acceptance through a formal exception process. By documenting a temporary exception with compensating controls (e.g., data encryption, access logging, and usage monitoring) and setting a review date, the organization maintains security oversight while addressing the legitimate business need. This approach aligns with the SY0-701 domain of Security Program Management, which emphasizes balancing security with operational requirements through managed risk.

Answer

Deny the request permanently and avoid discussing the business need

Answer

Immediately rewrite the policy so all users may use the unapproved application

Answer

Ask the team to create a detailed step-by-step procedure for using the application

Question 10

A file server suddenly shows many encrypted files with a new extension, and endpoint tools report that Volume Shadow Copy Service was disabled minutes earlier. A note on the desktop demands payment in cryptocurrency. What should the security team do first?

Accepted Answer

Isolate the affected systems from the network and preserve evidence.. Isolating the affected systems from the network and preserving evidence is the correct first step because it prevents the ransomware from spreading to other systems via SMB or other network protocols, and it preserves the forensic artifacts (e.g., the ransom note, encrypted files, and Volume Shadow Copy Service logs) needed for incident response and potential decryption. Disabling VSS is a common ransomware tactic to prevent file recovery, so immediate containment is critical before any remediation.

Answer

Pay the ransom immediately to restore access quickly.

Answer

Reimage the server immediately without documenting the event.

Answer

Disable antivirus alerts so staff can work without distractions.

Question 11

An organization is implementing a new Security Information and Event Management (SIEM) system. Which three of the following are primary capabilities that a SIEM provides to support security operations? (Choose three.)

Accepted Answer

Real-time alerting based on predefined security rules and anomalies. A SIEM system's primary capabilities include aggregating and correlating log data from diverse sources (servers, firewalls, endpoints) to detect patterns indicative of security incidents. It provides real-time alerting by applying predefined correlation rules and anomaly detection algorithms to streaming log events. Additionally, SIEM solutions offer long-term log storage and retention, which is essential for compliance audits (e.g., PCI DSS, HIPAA) and post-incident forensic analysis.

Answer

Performing vulnerability scans on internal hosts and applications

Answer

Blocking malicious network traffic at the perimeter firewall

Answer

Automated patching of operating system vulnerabilities across the enterprise

Question 12

A help desk receives an email from an employee asking to urgently reset MFA because they are traveling and locked out. The sender address matches the employee's name but uses a slightly different domain. What is the best action for the help desk agent?

Accepted Answer

Use a separate, known-good contact method to verify the request before making any change.. The email's domain mismatch is a classic indicator of a phishing or social engineering attempt. The help desk must verify the request through a separate, known-good communication channel (e.g., a phone call to the employee's official number or an in-person verification) before resetting MFA, as MFA reset bypasses a critical authentication control. This aligns with the principle of out-of-band verification to prevent unauthorized account takeover.

Answer

Reset MFA immediately because the request appears to come from the employee.

Answer

Reply to the email and ask the employee to confirm the request in writing.

Answer

Forward the message to everyone in IT so another technician can decide what to do.

Question 13

After a ransomware event, management wants proof that last night's backups can actually support business operations before they declare recovery complete. What is the best action?

Accepted Answer

Perform a test restore into an isolated environment and validate the files or application work correctly.. Performing a test restore into an isolated environment directly validates that the backup data is intact, the restore process works, and the restored files or applications function as expected. This provides management with the proof they need to confirm business operations can resume, which is the core requirement after a ransomware event.

Answer

Increase the backup retention period without testing the backups.

Answer

Copy the backup set to a new storage bucket and assume it is usable.

Answer

Run a vulnerability scan against the backup server.

Question 14

After a workstation hardening baseline is updated, the security team wants to confirm that finance laptops actually match the new settings. Which control is the best way to verify this?

Accepted Answer

Run a configuration compliance scan against the updated baseline. A configuration compliance scan compares the current settings of the finance laptops against the updated hardening baseline. This automated process checks specific registry keys, file permissions, service states, and security policy settings (e.g., via SCAP or CIS benchmarks) to verify alignment. It provides objective, measurable evidence of compliance, unlike subjective user feedback or assumptions.

Answer

Ask users whether they think their laptops are secure

Answer

Assume the baseline was applied because the change ticket was approved

Answer

Delete the old baseline so there is only one policy to reference

Question 15

A legacy reporting application cannot be modified this quarter, but users still need access from the corporate network. Security adds a hardened jump server, tighter monitoring, and manual approval for each session because MFA cannot be built into the app yet. What type of control is this?

Accepted Answer

Compensating control. A compensating control is an alternative security measure implemented when the primary control cannot be applied due to technical or operational constraints. In this scenario, the legacy application cannot be modified to support MFA, so the organization deploys a hardened jump server, enhanced monitoring, and manual session approval as compensating controls to reduce risk. These controls do not eliminate the vulnerability but provide an equivalent level of protection until the application can be updated.

Answer

Detective control

Answer

Corrective control

Answer

Deterrent control

Question 16

A SOC analyst detects that a user's workstation is sending large volumes of data to an unusual external IP address during non-business hours. The analyst has already isolated the workstation by disconnecting it from the network. What is the NEXT step in the incident response process?

Accepted Answer

Perform a forensic analysis of the workstation to collect evidence. After isolating the workstation, the next step in the incident response process is to perform forensic analysis to collect evidence. This aligns with the NIST SP 800-61 framework, where containment (isolation) is followed by eradication and recovery, but evidence collection must occur before any destructive actions like reimaging. The forensic analysis preserves volatile data (e.g., memory, network connections) and non-volatile data (e.g., disk artifacts) to determine the scope and cause of the data exfiltration.

Answer

Reimage the workstation to remove any malware

Answer

Reset the user's password to prevent further unauthorized access

Answer

Notify law enforcement immediately

Question 17

A Linux server is being prepared for production as a database host. The build team notices that a graphical desktop environment, an unused FTP service, and an open mail submission port are present on the image, even though none of them are required. The organization wants future builds to be consistent and easy to verify. What is the best approach?

Accepted Answer

Create and enforce a hardened build standard that removes unnecessary services and ports, then validate future servers against it.. It establishes a hardened baseline configuration that removes unnecessary services (e.g., FTP on port 21) and closes unused ports (e.g., mail submission port 587), ensuring consistency and simplifying verification. This aligns with the principle of minimizing attack surface by disabling all non-essential components before production deployment. A hardened build standard also enables automated compliance checks (e.g., using CIS benchmarks or OpenSCAP) to validate future servers against the defined secure state.

Answer

Leave the image unchanged so troubleshooting remains easier for administrators.

Answer

Use the image only for development and skip security review for production.

Answer

Add another firewall rule set and keep every installed service in place.

Question 18

A security analyst discovers that an attacker maintained persistent access to a corporate network for six months, moving laterally between systems and exfiltrating sensitive data. The attacker used custom malware that evaded antivirus and established multiple backdoors. Which of the following best describes this type of threat actor and their campaign?

Accepted Answer

Advanced persistent threat (APT). The scenario describes a threat actor that maintained stealthy, long-term access to a network, moved laterally, and exfiltrated data over six months using custom malware that evaded antivirus. This aligns with the definition of an Advanced Persistent Threat (APT), which is a sophisticated, well-resourced adversary that conducts prolonged, targeted campaigns to achieve specific objectives, often espionage or data theft.

Answer

Insider threat

Answer

Zero‑day exploit

Answer

Denial of service (DoS) attack

Question 19

A Linux operations team needs to run a nightly script that restarts one service and archives its logs on 60 servers. Security does not want an administrator to log in interactively, and the script should have only the permissions needed for that job. What is the best approach?

Accepted Answer

Create a dedicated service account with only the delegated rights needed, and run the script as a scheduled job.. It follows the principle of least privilege by creating a dedicated service account with only the specific rights needed to restart the service and archive logs. Running the script as a scheduled job (e.g., via cron) eliminates the need for interactive login, satisfying the security requirement. This approach minimizes the attack surface and ensures the job runs automatically without exposing administrative credentials.

Answer

Use the root account so the job never fails.

Answer

Store an administrator's SSH key inside the script.

Answer

Have an operator log in and run the commands manually each night.

Question 20

A payroll application allows the same user to create a vendor and approve a payment. The security team wants to reduce fraud without adding unnecessary complexity. Which principle should they apply?

Accepted Answer

Separation of duties, so no single person can complete the entire high-risk workflow.. Separation of duties (option A) is the correct principle because it prevents a single user from both creating a vendor and approving a payment, which would allow that user to commit fraud by setting up a fake vendor and authorizing a payment to it. By splitting these high-risk tasks between two or more people, the organization enforces a dual-control mechanism that reduces the risk of internal fraud without adding complex technical controls. This aligns with the security team's goal of reducing fraud while avoiding unnecessary complexity.

Answer

Job rotation, so employees periodically switch responsibilities to learn each other’s tasks.

Answer

Defense in depth, so multiple technical tools inspect every payment form.

Answer

Least privilege, so the payroll user can create and approve only this one vendor payment.