SY0-701 Practice Exam 52 — 20 Questions

Question 1

A monthly scan finds a critical remote-code-execution issue on an internet-facing VPN appliance. The vendor has released a fix, but the appliance can only be rebooted during the weekend maintenance window in five days. What is the BEST immediate action to lower risk until patching can occur?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a compensating control such as restricting access to trusted source IPs and disabling nonessential remote access features. Applying a compensating control—such as restricting access to trusted source IPs via an ACL and disabling nonessential remote access features like unused VPN protocols or administrative interfaces—immediately reduces the attack surface. This mitigates the risk of exploitation of the remote-code-execution vulnerability on the internet-facing VPN appliance until the vendor patch can be applied during the scheduled maintenance window. The key is to implement network-layer controls that block untrusted sources from reaching the vulnerable service, buying time without requiring a reboot.

Answer

Wait for the weekend because the exploit is not confirmed

Answer

Remove logging from the appliance to improve performance during the wait

Answer

Run another scan every hour and do nothing else

Question 2

An engineering tool runs on an unsupported operating system, but the tool is used only occasionally and can be replaced by a supported cloud service with little workflow impact. Which risk treatment is best?

Accepted Answer

Avoid the risk by retiring the unsupported system and replacing it with the supported service. The best risk treatment for an unsupported operating system that is only used occasionally and can be replaced with minimal workflow impact is to avoid the risk entirely. By retiring the unsupported system and migrating to the supported cloud service, the organization eliminates the security vulnerabilities and compliance issues associated with the outdated OS. This aligns with the risk avoidance strategy, which is preferred when the cost of mitigation is low and the risk is high.

Answer

Accept the risk because the tool is old and still functions

Answer

Transfer the risk to the cloud provider without making changes

Answer

Compensate for the risk by adding more user passwords

Question 3

A laptop is suspected of being compromised, and the responder wants to preserve useful evidence before shutting it down. What should be done first?

Accepted Answer

Capture volatile data such as memory and running processes if possible.. Volatile data (e.g., RAM contents, running processes, network connections) is lost when the laptop is powered off. Capturing this data first preserves critical evidence of the attacker's current activity, such as malware in memory or active network connections, which is essential for forensic analysis. This aligns with the forensic principle of order of volatility, where the most volatile data is collected first.

Answer

Power off the laptop immediately to stop all attacker activity.

Answer

Install a new antivirus product before collecting evidence.

Answer

Reimage the laptop so the user can return to work quickly.

Question 4

An organization is redesigning access for its HR portal. HR staff need to update employee records, managers need to approve leave requests, and payroll staff need access to salary data, but no single user should receive all of those permissions by default. What is the best access model?

Accepted Answer

Create separate roles for HR, managers, and payroll, and grant only the permissions needed for each job function.. Role-Based Access Control (RBAC) assigns permissions based on job functions, ensuring that HR staff, managers, and payroll personnel receive only the privileges necessary for their roles. This enforces the principle of least privilege and prevents any single user from inheriting all permissions by default, which aligns with the organization's security requirement.

Answer

Assign everyone the same portal permissions to simplify administration.

Answer

Give every manager full HR and payroll access so approvals are faster.

Answer

Use one shared administrator account for all HR actions to keep audits simple.

Question 5

A file server suddenly renames documents, creates ransom notes, and users can no longer open their files. Which malware type is most likely involved?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts files and demands payment for decryption. The symptoms—documents being renamed, ransom notes appearing, and users losing access to their files—are classic indicators of ransomware activity, which typically uses strong encryption algorithms like AES or RSA to lock files.

Answer

Spyware

Answer

Rootkit

Answer

Worm

Question 6

Based on the exhibit, which artifact is the strongest evidence that the firewall change was reviewed and approved before implementation?

Accepted Answer

The change request record with CAB approval timestamp and implementation time.. The change request record with a CAB approval timestamp and implementation time provides a clear, auditable trail that the firewall change was formally reviewed and authorized by the Change Advisory Board before it was executed. This aligns with the change management process required for security program oversight, ensuring that changes are not implemented without proper governance.

Answer

The engineer's post-implementation email, because it confirms someone checked the change.

Answer

The firewall logs, because they show the rule was applied successfully on the device.

Answer

The vendor's maintenance notice, because it explains why the rule was needed.

Question 7

A company wants to make sure only approved administrators can view and rotate a shared encryption secret used by several applications. What is the best way to manage that secret?

Accepted Answer

Use a centralized secrets vault or key management system. A centralized secrets vault or key management system (KMS) like HashiCorp Vault or AWS KMS provides role-based access control (RBAC), audit logging, and automatic rotation of secrets. This ensures only approved administrators can view and rotate the shared encryption secret, while applications retrieve it via secure APIs without exposing it in code or files.

Answer

Store it in a shared spreadsheet

Answer

Put it directly in application source code

Answer

Email the secret only to trusted administrators

Question 8

A small internal reporting server has a low-severity vulnerability. Fixing it now would require several hours of downtime, while the business impact of exploitation is considered low. What is the BEST risk treatment for this situation?

Accepted Answer

Accept the risk after documenting the decision. The best risk treatment is to accept the risk because the vulnerability is low-severity, the business impact of exploitation is low, and the cost of remediation (several hours of downtime) exceeds the potential loss. Documenting the acceptance ensures auditability and informed management approval, which is a standard practice in risk management frameworks like NIST SP 800-37.

Answer

Transfer the risk to a third party

Answer

Avoid the risk by shutting down the server permanently

Answer

Mitigate the risk by immediately replacing the server

Question 9

A finance laptop is opened to review an invoice attachment. EDR then shows winword.exe launching powershell.exe with hidden, no-profile, and base64-encoded arguments. No executable is written to disk, network beacons begin from memory, and after a reboot the activity disappears unless the document is opened again. What type of malware behavior is most likely?

Accepted Answer

Fileless attack, because malicious code runs in memory and leaves little or no executable artifact on disk.. The scenario describes malicious code that executes entirely in memory without writing an executable to disk, which is the defining characteristic of a fileless attack. Winword.exe launching PowerShell with hidden, no-profile, and base64-encoded arguments is a classic technique to load and execute payloads directly in memory, bypassing traditional file-based detection. The fact that activity disappears after reboot unless the document is reopened confirms that no persistent artifact remains on disk, further supporting fileless behavior.

Answer

Worm behavior, because the infection would self-replicate across systems through the network.

Answer

Rootkit behavior, because the malware is hidden from normal user-mode tools.

Answer

Ransomware, because the user opened an invoice attachment before the suspicious activity started.

Question 10

A project team needs to use an unapproved file-sharing application for two weeks because the approved platform cannot support an external client collaboration feature. What is the best security action?

Accepted Answer

Approve a documented temporary exception with compensating controls and a review date. It follows the principle of risk acceptance through a formal exception process. By documenting a temporary exception with compensating controls (e.g., data encryption, access logging, and usage monitoring) and setting a review date, the organization maintains security oversight while addressing the legitimate business need. This approach aligns with the SY0-701 domain of Security Program Management, which emphasizes balancing security with operational requirements through managed risk.

Answer

Deny the request permanently and avoid discussing the business need

Answer

Immediately rewrite the policy so all users may use the unapproved application

Answer

Ask the team to create a detailed step-by-step procedure for using the application

Question 11

The help desk needs a document that tells analysts exactly how to verify a caller, reset a password, and record the ticket when a user is locked out. What type of document is this?

Accepted Answer

Procedure. A procedure is the correct type of document because it provides step-by-step instructions for performing a specific task, such as verifying a caller's identity, resetting a password, and recording a ticket. Unlike a policy, which states high-level rules, a procedure details the exact actions to take in a given scenario, making it ideal for help desk operations.

Answer

Policy

Answer

Standard

Answer

Guideline

Question 12

A company wants guest Wi-Fi to reach only the internet, employee laptops to reach internal apps, and payment servers to remain isolated from both. What is the best design approach?

Accepted Answer

Use separate network segments with firewall rules between guest, employee, and payment zones.. Network segmentation using separate VLANs or subnets with firewall rules enforces isolation between guest Wi-Fi, employee laptops, and payment servers. This design ensures that guest traffic can only reach the internet, employee traffic can access internal apps, and payment servers are completely isolated from both, meeting the principle of least privilege and reducing the attack surface.

Answer

Place all systems on one flat network and rely on antivirus.

Answer

Put all systems behind a single VPN so every device is treated the same.

Answer

Use a larger internet circuit so the payment servers are harder to attack.

Question 13

An organization is implementing a new Security Information and Event Management (SIEM) system. Which three of the following are primary capabilities that a SIEM provides to support security operations? (Choose three.)

Accepted Answer

Real-time alerting based on predefined security rules and anomalies. A SIEM system's primary capabilities include aggregating and correlating log data from diverse sources (servers, firewalls, endpoints) to detect patterns indicative of security incidents. It provides real-time alerting by applying predefined correlation rules and anomaly detection algorithms to streaming log events. Additionally, SIEM solutions offer long-term log storage and retention, which is essential for compliance audits (e.g., PCI DSS, HIPAA) and post-incident forensic analysis.

Answer

Blocking malicious network traffic at the perimeter firewall

Answer

Performing vulnerability scans on internal hosts and applications

Answer

Automated patching of operating system vulnerabilities across the enterprise

Question 14

After a ransomware event, management wants proof that last night's backups can actually support business operations before they declare recovery complete. What is the best action?

Accepted Answer

Perform a test restore into an isolated environment and validate the files or application work correctly.. Performing a test restore into an isolated environment directly validates that the backup data is intact, the restore process works, and the restored files or applications function as expected. This provides management with the proof they need to confirm business operations can resume, which is the core requirement after a ransomware event.

Answer

Increase the backup retention period without testing the backups.

Answer

Copy the backup set to a new storage bucket and assume it is usable.

Answer

Run a vulnerability scan against the backup server.

Question 15

After a workstation hardening baseline is updated, the security team wants to confirm that finance laptops actually match the new settings. Which control is the best way to verify this?

Accepted Answer

Run a configuration compliance scan against the updated baseline. A configuration compliance scan compares the current settings of the finance laptops against the updated hardening baseline. This automated process checks specific registry keys, file permissions, service states, and security policy settings (e.g., via SCAP or CIS benchmarks) to verify alignment. It provides objective, measurable evidence of compliance, unlike subjective user feedback or assumptions.

Answer

Ask users whether they think their laptops are secure

Answer

Assume the baseline was applied because the change ticket was approved

Answer

Delete the old baseline so there is only one policy to reference

Question 16

A legacy reporting application cannot be modified this quarter, but users still need access from the corporate network. Security adds a hardened jump server, tighter monitoring, and manual approval for each session because MFA cannot be built into the app yet. What type of control is this?

Accepted Answer

Compensating control. A compensating control is an alternative security measure implemented when the primary control cannot be applied due to technical or operational constraints. In this scenario, the legacy application cannot be modified to support MFA, so the organization deploys a hardened jump server, enhanced monitoring, and manual session approval as compensating controls to reduce risk. These controls do not eliminate the vulnerability but provide an equivalent level of protection until the application can be updated.

Answer

Detective control

Answer

Corrective control

Answer

Deterrent control

Question 17

A SOC analyst detects that a user's workstation is sending large volumes of data to an unusual external IP address during non-business hours. The analyst has already isolated the workstation by disconnecting it from the network. What is the NEXT step in the incident response process?

Accepted Answer

Perform a forensic analysis of the workstation to collect evidence. After isolating the workstation, the next step in the incident response process is to perform forensic analysis to collect evidence. This aligns with the NIST SP 800-61 framework, where containment (isolation) is followed by eradication and recovery, but evidence collection must occur before any destructive actions like reimaging. The forensic analysis preserves volatile data (e.g., memory, network connections) and non-volatile data (e.g., disk artifacts) to determine the scope and cause of the data exfiltration.

Answer

Reimage the workstation to remove any malware

Answer

Reset the user's password to prevent further unauthorized access

Answer

Notify law enforcement immediately

Question 18

A Linux server is being prepared for production as a database host. The build team notices that a graphical desktop environment, an unused FTP service, and an open mail submission port are present on the image, even though none of them are required. The organization wants future builds to be consistent and easy to verify. What is the best approach?

Accepted Answer

Create and enforce a hardened build standard that removes unnecessary services and ports, then validate future servers against it.. It establishes a hardened baseline configuration that removes unnecessary services (e.g., FTP on port 21) and closes unused ports (e.g., mail submission port 587), ensuring consistency and simplifying verification. This aligns with the principle of minimizing attack surface by disabling all non-essential components before production deployment. A hardened build standard also enables automated compliance checks (e.g., using CIS benchmarks or OpenSCAP) to validate future servers against the defined secure state.

Answer

Leave the image unchanged so troubleshooting remains easier for administrators.

Answer

Use the image only for development and skip security review for production.

Answer

Add another firewall rule set and keep every installed service in place.

Question 19

A security analyst discovers that an attacker maintained persistent access to a corporate network for six months, moving laterally between systems and exfiltrating sensitive data. The attacker used custom malware that evaded antivirus and established multiple backdoors. Which of the following best describes this type of threat actor and their campaign?

Accepted Answer

Advanced persistent threat (APT). The scenario describes a threat actor that maintained stealthy, long-term access to a network, moved laterally, and exfiltrated data over six months using custom malware that evaded antivirus. This aligns with the definition of an Advanced Persistent Threat (APT), which is a sophisticated, well-resourced adversary that conducts prolonged, targeted campaigns to achieve specific objectives, often espionage or data theft.

Answer

Insider threat

Answer

Zero‑day exploit

Answer

Denial of service (DoS) attack

Question 20

A Linux operations team needs to run a nightly script that restarts one service and archives its logs on 60 servers. Security does not want an administrator to log in interactively, and the script should have only the permissions needed for that job. What is the best approach?

Accepted Answer

Create a dedicated service account with only the delegated rights needed, and run the script as a scheduled job.. It follows the principle of least privilege by creating a dedicated service account with only the specific rights needed to restart the service and archive logs. Running the script as a scheduled job (e.g., via cron) eliminates the need for interactive login, satisfying the security requirement. This approach minimizes the attack surface and ensures the job runs automatically without exposing administrative credentials.

Answer

Use the root account so the job never fails.

Answer

Store an administrator's SSH key inside the script.

Answer

Have an operator log in and run the commands manually each night.