SY0-701 Practice Exam 53 — 20 Questions

Question 1

Based on the exhibit, what should the team do next after the account has been contained?

Accepted Answer

Remove mailbox persistence, revoke all tokens and app consent, then monitor for reentry.. After containing a compromised account (e.g., disabling it or resetting its password), the attacker may still have established persistence mechanisms such as mailbox forwarding rules, OAuth app consent grants, or session tokens that survive a password reset. Removing these artifacts and revoking all tokens and app consents ensures the attacker cannot regain access via delegated permissions or persistent mailbox rules. Monitoring for reentry is critical to detect any residual access or new compromise attempts.

Answer

Close the incident because the password reset removed the attacker from the environment.

Answer

Reimage the user's laptop before reviewing mailbox settings.

Answer

Restore the mailbox from backup to remove the forwarding rule and keep the user productive.

Question 2

A vulnerability scan finds that an old print server still has SMBv1 enabled. The business says the vendor will not support a patch for at least two months, but the server must stay online. What is the best temporary mitigation?

Accepted Answer

Move the server to a restricted network segment and allow SMB access only from required hosts.. Network segmentation is the most effective temporary mitigation when a patch is unavailable. By moving the print server to a restricted VLAN or firewall zone and applying an access control list (ACL) that permits SMB traffic only from known, required hosts, you reduce the attack surface and prevent widespread exploitation of SMBv1 vulnerabilities (e.g., EternalBlue). This approach follows the principle of least privilege and containment, buying time until the vendor releases a patch.

Answer

Turn off endpoint logging to reduce performance impact until the vendor releases a patch.

Answer

Increase the password length requirement for all users and keep the server on the same network.

Answer

Schedule a weekly reboot to clear any malicious sessions and reduce the chance of exploitation.

Question 3

Based on the exhibit, what is the best security change to address the exposed management access on the cloud VM?

Accepted Answer

Restrict SSH through a bastion host or VPN and remove direct internet access to the VM.. Exposing SSH directly to the internet on a cloud VM creates a significant attack surface, allowing brute-force and credential-stuffing attacks. A bastion host (jump box) or VPN provides a controlled, authenticated entry point, while removing direct internet access to the VM ensures management traffic is isolated and audited. This aligns with the principle of defense in depth and the AWS/cloud best practice of using a bastion host for administrative access.

Answer

Ask the provider to patch the guest operating system on the VM.

Answer

Move SSH to a public IP on the VM so administrators can reach it more easily.

Answer

Enable object storage versioning to protect the VM from unauthorized logins.

Question 4

EDR detects encoded PowerShell launched from a word processor, a process attempt to read LSASS memory, and an outbound HTTPS connection to a rare domain. What should the analyst do first?

Accepted Answer

Isolate the endpoint from the network while keeping it powered on for investigation.. The EDR alerts indicate a likely credential theft attempt (LSASS read) and C2 communication (rare domain). Isolating the endpoint preserves forensic evidence in memory and disk while preventing further data exfiltration or lateral movement, which is the immediate containment priority per incident response best practices.

Answer

Delete the user's profile to stop the malicious process immediately.

Answer

Patch the word processor before reviewing any alerts or logs.

Answer

Reboot the system immediately to clear anything running in memory.

Question 5

Help desk staff must restart one Windows service and read its event logs on 150 servers, but they should not have local administrator rights or interactive logon to the systems. Which approach best supports this requirement?

Accepted Answer

Use a Just Enough Administration constrained endpoint for the allowed tasks.. Just Enough Administration (JEA) allows you to create constrained PowerShell endpoints that delegate specific administrative tasks—such as restarting a service and reading event logs—without granting full local administrator rights or interactive logon. By defining role capabilities that limit cmdlets and parameters, help desk staff can perform only the required operations on all 150 servers via a constrained endpoint, meeting the security requirement precisely.

Answer

Create one shared local administrator account for the entire help desk team.

Answer

Add the staff to the local Administrators group on every server.

Answer

Run the maintenance job under each technician's personal account on a schedule.

Question 6

Threat intelligence shows an attacker changes domains every day, but the malware file itself stays the same across incidents. Which indicator would be the best to block immediately if you find it in your environment?

Accepted Answer

The malware file hash from the shared sample. The malware file hash (e.g., MD5, SHA-1, or SHA-256) is a unique fingerprint of the file's binary content. Since the malware file itself remains unchanged across incidents, its hash is a static, reliable indicator of compromise (IoC) that can be immediately blocked via file reputation or hash-based detection rules, regardless of domain changes.

Answer

The current weather in the city where the attack was observed

Answer

The logo used on the phishing email

Answer

The time zone used by the help desk

Question 7

A Linux server is missing expected security-agent processes, but users can still connect to the application. Local command output does not show a suspicious daemon that another monitoring tool says is listening on port 4444. A raw disk scan reveals a kernel module loaded at boot, and several files appear only when viewed outside the normal operating system tools. What malware type is most likely?

Accepted Answer

Rootkit, because kernel-level components are hiding processes and files from normal user-mode visibility.. The scenario describes a rootkit: a kernel-level rootkit can load a malicious kernel module at boot, intercept system calls (e.g., `open`, `readdir`, `netstat`), and hide processes, files, and network listeners from user-mode tools like `ps`, `ls`, or `netstat`. The raw disk scan reveals files invisible to normal OS tools, and the missing security-agent processes and hidden daemon on port 4444 are classic signs of kernel-mode hooking that bypasses standard visibility.

Answer

Trojan, because it could have introduced the suspicious service after the initial compromise.

Answer

Spyware, because it may collect data while leaving the application functional.

Answer

Logic bomb, because the malware activates after startup and changes what administrators see.

Question 8

A finance workflow currently lets one employee create a payment batch and approve it in the same session. Audit findings say the design increases fraud risk. Which two access architecture changes best reduce that risk while keeping the process functional? Select two.

Accepted Answer

Split the workflow into separate creator and approver roles.. Implementing separation of duties (SoD) by splitting the payment batch creation and approval into distinct roles ensures that no single user can both create and approve a transaction. This directly mitigates the fraud risk identified in the audit by requiring collusion between two users to execute a fraudulent payment. The process remains functional because the workflow is simply reordered into two sequential steps performed by different users.

Answer

Grant all finance users local administrator rights to speed up exception handling.

Answer

Store the payment password in a shared mailbox so the team can continue when someone is absent.

Answer

Remove approval steps entirely and rely on log reviews after payment runs.

Question 9

Based on the exhibit, what control type is the automated reapplication of the baseline?

Accepted Answer

Corrective control, because the MDM agent restores the approved baseline after the unauthorized change is found.. The automatic reapplication of the approved firewall baseline is a corrective control because it fixes a configuration that drifted away from the secure standard. The user was able to make the change, so the control was not preventive. The MDM system then returned the device to its approved state, which is the defining behavior of correction rather than simple detection or deterrence.

Why others are wrong: The user change was already allowed to happen, so the control was not preventive. The log shows an automatic restoration, not just an alert, so it is more than detective. A deterrent would merely discourage changes through warnings or visibility. The key evidence is the platform's automatic rollback to the approved baseline after the deviation was found.

Answer

Preventive control, because the system prevented the user from changing the firewall profile at all.

Answer

Detective control, because the help desk can review the event later.

Answer

Deterrent control, because the policy baseline discourages users from making changes.

Question 10

Based on the exhibit, which security principle does the organization appear to be using most clearly?

Accepted Answer

Defense in depth, because several different controls stop or limit the attack at different stages.. The exhibit shows multiple security controls—an email filter blocking the attachment, a web filter blocking the download link, and an endpoint detection and response (EDR) tool blocking execution—each acting at a different stage of the attack chain. This layered approach, where no single control is relied upon to stop the threat, is the hallmark of defense in depth. The correct answer is B because the scenario clearly demonstrates overlapping controls that provide redundancy and mitigate risk at various points.

Answer

Zero trust, because all access is denied until a user proves identity again.

Answer

Least privilege, because the attachment was blocked from having administrator rights.

Answer

Need-to-know, because only the security team should be aware of the incident.

Question 11

A SaaS dashboard invalidates passwords after a forced reset, but a stolen bearer token from a browser cookie still works from a VPN exit node for several hours. SIEM logs show the same token value used from two countries within five minutes, and no MFA prompt appears because the token is already accepted. What attack is most likely?

Accepted Answer

Session hijacking, because a valid session token is being replayed from a different location.. The scenario describes a stolen bearer token (session token) being reused from a different geographic location (VPN exit node) without re-authentication. This is classic session hijacking, where an attacker captures a valid session token (e.g., from a browser cookie) and replays it to impersonate the authenticated user. The fact that the token works even after a password reset and bypasses MFA confirms the attack is session hijacking, not credential theft or request forgery.

Answer

Credential stuffing, because the attacker used many passwords against the portal.

Answer

Cross-site request forgery, because the attacker is making requests on behalf of the user.

Answer

Phishing, because the attacker likely stole the user's password first.

Question 12

A user reports a ransomware note on one department file share, but other departments are still working normally. What is the best first containment action?

Accepted Answer

Disconnect the affected file share or server from the network.. The immediate priority in a ransomware incident is to contain the threat by isolating the affected system to prevent lateral movement. Disconnecting the file share or server from the network stops the ransomware from encrypting additional files or spreading to other departments via SMB or other protocols. This aligns with the NIST SP 800-61 containment strategy, which emphasizes rapid isolation without disrupting unaffected systems.

Answer

Shut down the entire company network immediately.

Answer

Delete the ransom note and wait to see whether the problem returns.

Answer

Restore the share immediately before checking what caused the incident.

Question 13

An employee receives an email that says, 'This is the CEO. Buy gift cards now and reply with the codes before the meeting starts.' What should the employee do?

Accepted Answer

Verify the request through an approved channel and report the message. The email exhibits classic social engineering indicators—spoofed authority, urgency, and a request for non-standard financial transactions (gift cards). The employee must verify the request through an approved communication channel (e.g., a phone call to the CEO's known number) and report the message to the security team for incident response. This aligns with security policy for phishing and business email compromise (BEC) prevention, as per NIST SP 800-61 and organizational security awareness training.

Answer

Reply with the codes because the request appears urgent

Answer

Forward the email to coworkers so they can watch for similar messages

Answer

Delete the email and ignore it without telling anyone

Question 14

A SOC analyst reviews an EDR alert on a finance workstation. The alert shows powershell.exe launched with an encoded command, downloaded a payload into memory, and then spawned rundll32.exe. No new executable was written to disk, but the process later created a scheduled task for persistence. Which two findings most strongly support a fileless attack? Select two.

Accepted Answer

powershell.exe launched with an encoded command and executed the payload in memory. Executing a PowerShell encoded command that downloads and runs a payload entirely in memory, without writing to disk, is a hallmark of fileless malware. This technique avoids traditional file-based detection by leveraging PowerShell's ability to load and execute scripts directly in memory, bypassing disk-based antivirus scans.

Answer

a new portable executable was written to the user's temporary folder before being run

Answer

the endpoint antivirus quarantined the payload after a signature match

Answer

a USB storage device was inserted shortly before the alert fired

Question 15

Match each control category to the best example.

Accepted Answer

Preventive: Firewall. Control categories are matched to examples: preventive controls block, detective controls identify, corrective controls fix, deterrent controls discourage, compensating controls provide alternatives, and directive controls set rules.

Answer

Preventive: Intrusion Detection System

Answer

Detective: Firewall

Question 16

A security analyst detects unusual outbound traffic from a workstation that appears to be communicating with a known malicious IP address. The analyst immediately isolates the workstation from the network. Which of the following is the NEXT step in the incident response process according to NIST SP 800-61?

Accepted Answer

Eradication. According to NIST SP 800-61, the incident response process follows a sequence: Preparation, Detection & Analysis, Containment, Eradication, Recovery, and Lessons Learned. Since the analyst has already performed containment by isolating the workstation, the next step is Eradication, which involves removing the threat (e.g., malware, backdoors) from the affected system. This ensures the root cause is eliminated before moving to recovery.

Answer

Recovery

Answer

Containment

Answer

Lessons Learned

Question 17

Match each awareness-program metric or pattern to the best interpretation. Use each interpretation once.

Accepted Answer

Phishing click rate: Susceptibility. Phishing click rate measures susceptibility, reporting rate indicates vigilance, training completion rate shows participation, repeat offender rate identifies high-risk users, time to report reflects responsiveness, and knowledge assessment score measures understanding.

Answer

Training completion rate: Responsiveness

Answer

Time to report: Understanding

Answer

Knowledge assessment score: Participation

Question 18

A security analyst detects a high volume of failed authentication attempts from IP address 203.0.113.1 against a web application. The attempts use different usernames, such as 'admin', 'root', 'test', and several common names. Account lockout policies are configured to lock an account after five failed attempts. Despite this, the analyst sees the attempts continuing over several hours. Which of the following security controls is most likely missing or improperly configured?

Accepted Answer

Configure rate limiting per source IP address. Rate limiting per source IP address is the correct control because it restricts the number of authentication requests from a single IP (203.0.113.1) within a given time window, regardless of the usernames used. Account lockout policies are ineffective here because the attacker is rotating through different usernames (e.g., 'admin', 'root', 'test'), so no single account reaches the five-failed-attempt threshold. By limiting the request rate from the source IP, the analyst can throttle the attacker's brute-force attempts without affecting legitimate users.

Answer

Increase the account lockout threshold to a lower number

Answer

Implement geofencing to block traffic from the attacker's region

Answer

Enable detailed failed login attempt logging

Question 19

A technician restores a file server from backup, but the business wants confidence that the recovery process will work during an outage. What should the team do most often to validate the backups?

Accepted Answer

Perform regular restore tests using sample files or systems.. The only way to gain confidence that backups can be successfully restored during an actual outage is to perform regular, documented restore tests. This validates the integrity of the backup media, the correctness of the restoration procedure, and the recoverability of data within the required recovery time objective (RTO). Without testing, assumptions about backup reliability remain unverified, which can lead to catastrophic data loss when a real disaster occurs.

Answer

Review the backup vendor brochure for proof that recovery will work.

Answer

Increase the backup retention period without testing restores.

Answer

Change the backup password every day and skip verification.

Question 20

A security analyst in the SOC is investigating a potential DNS tunneling incident. The analyst has identified a workstation that is making thousands of DNS queries to an external domain with base64-encoded subdomains. The analyst suspects that sensitive files from the workstation are being exfiltrated by encoding their contents into the subdomains of the DNS queries. Which of the following log sources will provide the most definitive evidence to confirm that the contents of a specific sensitive file are being transmitted in the DNS queries?

Accepted Answer

A full packet capture of the network traffic from the workstation showing the complete DNS messages.. A full packet capture (PCAP) contains the complete DNS query and response messages, including the raw payload of the subdomain fields. This allows the analyst to extract the base64-encoded data from the subdomains and decode it to verify that it matches the contents of the suspected sensitive file. DNS server logs (option A) typically only record the queried domain names, not the full DNS message payload, and may truncate long subdomains. Process creation logs (option B) show which executable made the queries but not the data being sent. Firewall logs (option D) only show connection metadata (source, destination, port) and never the DNS query content.

Answer

The DNS server logs showing the queried domains and subdomains.

Answer

The workstation's process creation logs showing which process initiated the DNS queries.

Answer

The firewall logs showing outbound connections from the workstation to the external DNS server on port 53.