SY0-701 Practice Exam 52 — 20 Questions

Question 1

Based on the exhibit, which security issue should the analyst report first?

Accepted Answer

Exposed service, because VNC and the web admin interface are reachable from untrusted networks.. Option B is correct because the scan reveals that VNC (port 5900) and a web admin interface (port 443 or 8080) are exposed to untrusted networks, such as the internet. This violates the principle of least exposure, as these services are known attack vectors for remote code execution and credential theft. The analyst should prioritize this issue because an exposed service directly increases the attack surface and risk of unauthorized access, whereas other findings may be less immediately critical.

Answer

Outdated component, because the scan did not list software version details.

Answer

Weak permissions, because SSH requires password login only.

Answer

Default credentials, because the server is in the DMZ.

Question 2

Based on the exhibit, which supply-chain threat is most likely?

Accepted Answer

Dependency compromise. The exhibit shows a dependency on a third-party library (e.g., a JavaScript package from a CDN or a software component from an external repository). A dependency compromise occurs when an attacker injects malicious code into that trusted third-party component, which is then pulled into the organization's environment during updates or builds. This is the most likely supply-chain threat because it directly exploits the trust placed in external dependencies.

Answer

Brute-force attack

Answer

SQL injection

Answer

Privilege escalation

Question 3

Based on the exhibit, which tool should the security team use to safely observe the attachment's behavior before delivery to users?

Accepted Answer

Sandboxing, so the file can execute in a controlled environment before release.. Sandboxing allows the security team to execute the attachment in a controlled, isolated environment to observe its behavior (e.g., network connections, file modifications) without risking the production network. This is the correct approach because it safely detonates the file before delivery, enabling detection of malicious activity such as ransomware or trojans. Other tools like DLP, NAC, or SIEM do not provide the dynamic analysis needed to assess the attachment's runtime behavior.

Answer

DLP, so the gateway can block sensitive data from leaving the organization.

Answer

NAC, so the sender's device can be checked before the message is accepted.

Answer

SIEM, so the team can store the attachment and review alerts later.

Question 4

Employees must sign in to several cloud applications with their corporate account, and terminated users should lose access without separate password resets in each app. What is the best solution?

Accepted Answer

Use federation with single sign-on from a central identity provider.. Federation with single sign-on (SSO) from a central identity provider (IdP) allows users to authenticate once using their corporate account, and the IdP issues security tokens (e.g., SAML assertions or OIDC tokens) that each cloud application trusts. When a user is terminated, the administrator disables the account in the IdP, and all applications immediately reject the user's tokens, eliminating the need for separate password resets in each app.

Answer

Create a separate local username and password in every cloud application.

Answer

Store the same shared password in a password manager for all applications.

Answer

Allow each application to authenticate users only by device MAC address.

Question 5

Based on the exhibit, which risk treatment should the security manager recommend first?

Accepted Answer

Mitigate the risk by replacing or isolating the appliance and removing direct internet exposure.. The exhibit shows a legacy file transfer appliance with direct internet exposure and known unpatched vulnerabilities. The most immediate and effective risk treatment is to mitigate the risk by replacing or isolating the appliance and removing its direct internet exposure. This directly reduces the likelihood of exploitation by eliminating the attack surface, which aligns with the principle of defense-in-depth and is the first step before considering acceptance, avoidance, or transfer.

Answer

Accept the risk and document it for the next quarterly review.

Answer

Avoid the risk by permanently shutting down the file transfer service.

Answer

Transfer the risk by purchasing cyber insurance and keeping the current configuration.

Question 6

Based on the exhibit, which vulnerability is being exploited?

Accepted Answer

Authentication bypass. The exhibit shows a URL parameter `?admin=false` being changed to `?admin=true`, which directly toggles an administrative access control flag. This is a classic authentication bypass vulnerability because the application trusts client-supplied input to determine authorization status, allowing an attacker to escalate privileges without valid credentials.

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Answer

Command injection

Question 7

Following a ransomware incident, management wants to verify that backups are usable and that a restored file server will meet recovery expectations before declaring the system trusted again. Which action is best?

Accepted Answer

Perform a documented restore test in an isolated environment and validate the recovered data.. Option B is correct because performing a documented restore test in an isolated environment is the only action that directly validates the integrity and usability of backups, ensuring the restored file server meets recovery point objective (RPO) and recovery time objective (RTO) expectations. This process verifies that the backup data is not corrupted, encrypted, or incomplete, which is critical after a ransomware incident where backups may have been targeted. Without such a test, management cannot confidently declare the system trusted, as logs or retention changes do not prove data recoverability.

Answer

Review the backup job logs and mark the backups as valid.

Answer

Increase the retention period so more restore points are available later.

Answer

Create a new full backup immediately after the incident and trust that one instead.

Question 8

Following a ransomware incident, management wants proof that the organization can actually recover from its backups before declaring the backups trustworthy. What should the security team do next?

Accepted Answer

Restore a backup into an isolated test environment and validate the result.. Option B is correct because the only way to prove that backups are trustworthy after a ransomware incident is to perform a full restoration into an isolated test environment and validate the integrity, completeness, and functionality of the recovered data. Simply checking that backup jobs completed successfully (Option A) does not verify that the backup data is uncorrupted, free from ransomware, or restorable in a real scenario. A controlled restore test provides tangible evidence that the recovery process works and the data is usable, which is the core requirement of management’s request for proof of recoverability.

Answer

Check that the backup job completed successfully during the last seven days.

Answer

Increase the backup retention period to reduce the chance of future loss.

Answer

Compress the backup files further so they take up less storage.

Question 9

In a virtualized environment, several workloads share the same physical host and the same IP subnet. After one payroll VM is compromised, the security team wants to prevent that VM from freely scanning or reaching the other workloads on the host. Which control best addresses this lateral-movement risk?

Accepted Answer

Microsegmentation with policy rules applied per workload or per VM. Microsegmentation allows granular security policies to be applied per workload or per VM, even within the same subnet and on the same hypervisor. By enforcing firewall rules at the virtual switch or hypervisor level, it prevents a compromised payroll VM from scanning or communicating laterally with other VMs on the same host, directly addressing the lateral-movement risk.

Answer

Expanding the subnet mask so all workloads are easier to reach

Answer

Creating a shared administrator account for all virtual machines

Answer

Disabling DHCP and forcing every VM to use a static IP address

Question 10

Leadership wants to compare two controls for protecting a customer portal. Option A costs $40,000 and reduces annual loss expectancy from $120,000 to $30,000. Option B costs $15,000 and reduces annual loss expectancy to $70,000. Which analysis method best supports this decision?

Accepted Answer

Quantitative risk analysis. Quantitative risk analysis uses monetary values and numerical data to calculate risk, making it the best method to compare the cost-benefit of Option A (ALE reduction from $120,000 to $30,000 with a $40,000 cost) versus Option B (ALE reduction to $70,000 with a $15,000 cost). By computing the annualized loss expectancy (ALE) and comparing the cost of each control against the reduction in expected loss, leadership can determine which option provides a better return on investment. This approach directly supports the decision because it provides objective, dollar-based metrics for comparison.

Answer

Qualitative risk analysis

Answer

Business impact analysis

Answer

Risk acceptance

Question 11

Match each incident response action to its primary purpose during a suspected endpoint compromise.

Question 12

Match each control type to the most fitting example in a branch office.

Question 13

Match each incident response activity to the phase of the incident response lifecycle it best represents. Use each option once.

1. A SOC analyst disables a compromised account, isolates the workstation from the network, and preserves volatile evidence.
2. The team images the infected system, removes the malicious persistence mechanism, and patches the exploited vulnerability.
3. After restoring services, the team reviews timeline gaps, detection delays, and control failures with management.
4. Before the attack occurs, the team verifies contact lists, playbooks, escalation paths, and backup credentials.
5. The team confirms suspicious authentication logs, endpoint alerts, and unusual outbound traffic indicate an active compromise.

Question 14

Match each detection pattern to the most likely security issue. Each item has one best match.

Question 15

Match each audit request to the best evidence artifact.
1. Auditors want proof that managers reviewed privileged access last quarter.
2. Auditors want evidence that an emergency firewall change was approved before implementation.
3. Auditors want to verify that annual security training was completed by staff.
4. Auditors want to confirm that records were deleted after the retention period expired.

Question 16

Match each procurement or oversight need to the best vendor due diligence artifact or clause. Use each item once.

Question 17

Match each awareness-program metric to the interpretation the security team should use.
1. 8% of users clicked the simulated phishing link.
2. 34% of users reported the simulation using the report-phish button.
3. The median time from message delivery to first user report was 12 minutes.
4. 96% of staff completed the annual awareness module.

Question 18

Match each security monitoring artifact from the SOC alert queue to the best investigation focus.

Question 19

Match each vendor-risk concern to the contractual control that best addresses it.
1. The company wants the right to review the vendor's controls and supporting records after the contract is signed.
2. The company wants to know when the vendor will use subcontractors that may touch its data.
3. The company wants written notice within 24 hours if the vendor suffers an incident affecting company data.
4. The company wants assurance that the vendor's controls are independently assessed each year.

Question 20

Match each risk-register description to the correct risk term. Use each term once.

SY0-701 Practice Exam 52 — 20 Questions

Exhibit

SY0-701 Practice Exam 52 — 20 Questions

Exhibit