SY0-701 Practice Exam 53 — 20 Questions

Question 1

Several corporate laptops occasionally boot from a removable drive containing an untrusted recovery tool before Windows loads. The security team wants to reduce the chance of pre-boot tampering and unauthorized boot media use. Which two controls are most effective? Select two.

Accepted Answer

Enable UEFI Secure Boot.. UEFI Secure Boot ensures that only signed, trusted bootloaders and drivers are executed during the boot process. By verifying the digital signature of each component against a database of trusted keys, it prevents unauthorized boot media (such as an untrusted recovery tool) from loading before the operating system starts. This directly reduces the risk of pre-boot tampering and unauthorized boot media use.

Answer

Keep local administrator rights so users can recover faster.

Answer

Turn off disk encryption because it slows startup.

Answer

Move the laptops to a different subnet.

Question 2

Several employees receive a text message that says their payroll deposit failed and they must tap a link to verify account details. The link opens a fake login page. What type of attack is this?

Accepted Answer

Smishing. Smishing is a form of phishing that uses SMS (Short Message Service) text messages as the attack vector. In this scenario, the attacker sends a fraudulent text message claiming a payroll deposit failure and includes a link to a fake login page, which is the classic mechanism of smishing. The attack relies on social engineering via SMS to trick the recipient into revealing sensitive credentials.

Answer

Phishing

Answer

Pretexting

Answer

Baiting

Question 3

NetFlow shows one user workstation making authenticated SMB and WinRM connections to more than 40 internal hosts within 15 minutes, starting shortly after the user opened a spreadsheet attachment. No approved admin tool was running on the device. What is the best initial response?

Accepted Answer

Isolate the workstation and begin investigating for credential compromise or lateral movement. The sudden burst of authenticated SMB and WinRM connections from a single workstation to over 40 internal hosts immediately after opening a spreadsheet attachment is a classic indicator of lateral movement using stolen credentials. Since no approved admin tool was running, this behavior strongly suggests the user's credentials have been compromised, likely via a macro or exploit in the attachment, and an attacker is using those protocols to move laterally. Isolating the workstation stops the attack in progress and preserves evidence for forensic investigation.

Answer

Treat the traffic as normal because the workstation used valid credentials

Answer

Increase the DHCP lease time to reduce network noise

Answer

Block all SMB and WinRM traffic across the entire enterprise

Question 4

NetFlow shows one workstation initiating SMB and WinRM sessions to 25 internal servers within 12 minutes, followed by a spike in Kerberos authentication requests and attempts to access admin shares. The user says they only opened an invoice spreadsheet. What is the most likely attacker objective?

Accepted Answer

Lateral movement using compromised credentials to pivot across the environment.. The observed behavior—a single workstation initiating SMB and WinRM sessions to 25 internal servers in rapid succession, followed by a spike in Kerberos authentication requests and attempts to access admin shares—is a classic indicator of lateral movement using compromised credentials. The attacker likely obtained the user's credentials (e.g., via phishing in the invoice spreadsheet) and is using them to authenticate to multiple servers via WinRM for remote command execution and SMB for file access, with the Kerberos spike reflecting TGT/TGS requests as they pivot across the environment to escalate privileges or deploy ransomware.

Answer

Distributed denial-of-service activity against the internal network.

Answer

Port scanning from an external attacker trying to enumerate exposed services.

Answer

DNS tunneling used to bypass content filtering and exfiltrate data.

Question 5

Network engineers need to manage switches in a data center from home. The solution must encrypt management traffic, strongly authenticate users, and avoid exposing management ports directly to the internet. Which approach is best?

Accepted Answer

Connect through a VPN to a bastion host, then use SSH to the switches.. Option D is correct because it combines a VPN (which encrypts all traffic and provides strong authentication) with a bastion host (a hardened jump server) to avoid exposing switch management interfaces directly to the internet. SSH then provides encrypted, authenticated access to the switches from the bastion host, meeting all three requirements: encryption, strong authentication, and no direct internet exposure.

Answer

Telnet to the switches over a router port-forward rule.

Answer

SSH directly to the switches from the internet using password-only authentication.

Answer

Use SNMPv2c with restricted source IP addresses.

Question 6

NetFlow shows one workstation opening SMB connections to a dozen internal servers and then attempting many WinRM connections. What is the most likely explanation?

Accepted Answer

The host is likely being used for lateral movement or internal reconnaissance.. SMB connections to many internal servers followed by WinRM attempts is a classic pattern of lateral movement or internal reconnaissance. An attacker or compromised host uses SMB to probe for accessible shares and then leverages WinRM for remote command execution, which is a common technique in post-exploitation frameworks like PsExec or CrackMapExec.

Answer

The workstation is probably downloading a routine operating system update.

Answer

The network is likely suffering from a wireless interference problem.

Answer

The user is likely printing documents to multiple shared printers.

Question 7

Several company laptops were found to boot from a removable drive containing an untrusted pre-boot utility before the operating system loaded. The security team wants to prevent unsigned or tampered boot code from starting. Which control is the best fit?

Accepted Answer

Enable Secure Boot in firmware and block external boot devices where possible.. Secure Boot is a UEFI firmware feature that verifies the digital signature of boot code against a trusted database before execution. By enabling Secure Boot and blocking external boot devices, the security team ensures that only signed, trusted bootloaders and drivers can run, preventing untrusted pre-boot utilities from loading. This directly addresses the scenario where laptops boot from a removable drive containing unsigned or tampered boot code.

Answer

Turn on screen lock after ten minutes of inactivity.

Answer

Increase the password complexity policy for user accounts.

Answer

Disable Windows Defender notifications on the endpoints.

Question 8

Match each access principle to the best description.

Question 9

Match each awareness-program metric or pattern to the best interpretation. Use each interpretation once.

Question 10

Match each cloud security concept to the best description.

Question 11

Match each business situation to the best risk treatment. Use each treatment once.

Question 12

Several users on the same subnet report that their traffic to the default gateway is intermittently slow and sometimes reaches the wrong device. A packet capture shows ARP replies that map the gateway IP to a different MAC address. What attack is most likely occurring?

Accepted Answer

ARP spoofing, which poisons address resolution on the local network. ARP spoofing (also known as ARP poisoning) is the correct answer because the attacker sends forged ARP replies that associate the default gateway's IP address with the attacker's MAC address. This causes the victims' switches to update their ARP caches with the false mapping, so traffic destined for the gateway is instead sent to the attacker, leading to intermittent connectivity and misrouted packets. The symptoms—slow traffic and reaching the wrong device—are classic indicators of a man-in-the-middle (MITM) attack via ARP cache poisoning.

Answer

DNS amplification, which overwhelms the target with reflected DNS traffic

Answer

Replay attack, which resends captured authentication data

Answer

Port scanning, which probes hosts for open services and ports

Question 13

Match each control type to the best description.

Question 14

Match each control type to the example that best fits it.

Question 15

Match each cryptographic action to the most appropriate use case.

Question 16

Match each cryptographic concept to its best purpose.

Question 17

Match each cryptographic primitive to its main purpose.

Question 18

Match each excerpt from a small enterprise security program to the correct governance artifact.

Question 19

Match each network segment to the best use in a small enterprise.

Question 20

Match each principle to the scenario that best illustrates it.