SY0-701 Practice Exam 54 — 20 Questions

Question 1

Match each business scenario to the most appropriate risk treatment.
1. A legacy reporting server is expensive to replace, and leadership is willing to monitor the low expected loss for now.
2. A public web portal is being hit by credential stuffing, so the team adds MFA and rate limiting.
3. The organization wants protection from a costly third-party outage by purchasing cyber insurance.
4. A proposed project would collect regulated data that the business has decided not to process at all.

Accepted Answer

Risk acceptance: A legacy reporting server is expensive to replace, and leadership is willing to monitor the low expected loss for now.. Risk acceptance acknowledges the risk without action; mitigation reduces risk via controls; transfer shifts risk to insurance; avoidance eliminates the risk activity; reduction and sharing are related but less direct matches to the scenarios.

Answer

Risk acceptance: A proposed project would collect regulated data that the business has decided not to process.

Answer

Risk mitigation: The organization wants protection from a costly third-party outage by purchasing cyber insurance.

Question 2

A security analyst is reviewing the source code of a custom authentication service. The service uses a function that compares a user-supplied password to the stored password hash by iterating through each byte and returning false immediately upon the first mismatch. The analyst measures the function's execution time and discovers it varies measurably depending on how many initial bytes match. Which type of attack is this vulnerability most likely to facilitate?

Accepted Answer

Timing attack. The vulnerability is a timing attack because the comparison function returns false immediately upon the first mismatched byte, causing execution time to vary based on how many initial bytes match. An attacker can measure these timing differences to iteratively guess each byte of the password hash, effectively reducing the search space from exponential to linear. This is a classic side-channel attack that exploits observable timing variations in cryptographic or authentication operations.

Answer

Brute-force attack

Answer

Dictionary attack

Answer

Replay attack

Question 3

A company launches a new HTTPS portal. Users should be able to confirm the site is really the company's portal and not a fake copy. Which control provides that trust?

Accepted Answer

A TLS certificate issued by a trusted certificate authority. A TLS certificate issued by a trusted certificate authority (CA) provides the trust needed because browsers and operating systems maintain a root store of trusted CAs. When a user visits the HTTPS portal, the server presents a certificate signed by that CA, and the browser cryptographically verifies the signature chain back to a trusted root. This ensures the public key belongs to the claimed domain, authenticating the server and preventing impersonation by a fake copy.

Answer

A self-signed certificate installed only on user laptops

Answer

A SHA-256 checksum posted on the login page

Answer

A shared password embedded in the page source

Question 4

A security manager wants one document that states employees must protect company laptops and another that defines exact required settings such as disk encryption and a 10-minute screen lock. Which two document types are the best fit? Select two.

Accepted Answer

Policy. A policy is a high-level statement of management intent, such as requiring employees to protect company laptops. A standard defines mandatory, specific technical settings, like requiring disk encryption (e.g., AES-256) and a 10-minute screen lock timeout. Together, they provide the overarching directive (policy) and the enforceable configuration baseline (standard).

Answer

Guideline

Answer

Procedure

Answer

Exception

Question 5

A development team deploys a Linux web server on an IaaS cloud VM. The cloud provider secures the datacenter, hardware, and hypervisor. Which control remains the organization's responsibility?

Accepted Answer

Apply OS patches and harden services running inside the virtual machine.. In an IaaS model, the provider handles the physical infrastructure, storage, networking foundation, and hypervisor layer. The customer remains responsible for what runs on the VM, including the guest operating system, services, configuration, and application patching. Hardening the server inside the VM is therefore the correct answer because it is one of the core customer responsibilities in this cloud model.

Why others are wrong: Physical badge access and hypervisor patching are provider duties in IaaS, so the customer cannot rely on those as their own control. Replacing the provider backbone is outside the scope of the customer’s operational responsibility and is not how shared responsibility works. The question asks for the organization’s remaining duty, which is securing the guest OS and its applications.

Answer

Monitor physical badge access at the provider facility.

Answer

Replace the provider's network backbone with a private carrier circuit.

Answer

Ensure the hypervisor is updated before every release cycle.

Question 6

A system administrator downloads a vendor patch package and a separate checksum file. After the download completes, the administrator runs a command that produces a SHA-256 value for the package and compares it to the vendor's published value. Which cryptographic primitive is being used for the comparison?

Accepted Answer

Hashing. The administrator is using SHA-256 to compute a fixed-length digest of the downloaded package and comparing it to the vendor's published checksum. This is a classic application of a cryptographic hash function (hashing), which produces a unique, irreversible fingerprint of data. The comparison verifies integrity—ensuring the package has not been altered during transit—but does not provide authentication or non-repudiation.

Answer

Symmetric encryption

Answer

Digital signatures

Answer

Asymmetric encryption

Question 7

Which four of the following are key principles of secure network architecture design that help enforce defense-in-depth? (Choose four.)

Accepted Answer

Deploying network access control (NAC) to authenticate devices before granting access. Implementing a DMZ isolates externally facing services (e.g., web, email) from the internal network, ensuring that if an attacker compromises a public-facing server, they cannot directly pivot to internal resources. This is a foundational defense-in-depth layer that enforces traffic inspection and access controls between zones.

Answer

Using a single, unified security appliance at the network perimeter

Answer

Placing all servers on the same flat subnet for ease of management

Question 8

A help desk technician receives a call from someone claiming to be a contractor whose MFA device was lost during travel. The caller knows the company org chart and asks for a new device enrollment. Which three responses are appropriate? Select three.

Accepted Answer

Refuse to bypass identity verification requirements.. Bypassing identity verification for MFA device enrollment would undermine the security that MFA provides. The caller's knowledge of the org chart does not constitute proof of identity; social engineering attacks often leverage such information. Refusing to bypass verification ensures that only authorized users can enroll new MFA tokens, maintaining the integrity of the authentication process.

Answer

Read the current MFA reset code over the phone to speed up recovery.

Answer

Enroll the new device immediately because the caller knows company names and roles.

Question 9

Based on the exhibit, what is the MOST likely explanation for the network traffic?

The affected host is not showing a large amount of internet-bound traffic, but its DNS behavior is highly unusual.

Accepted Answer

DNS tunneling used for command-and-control or data transfer. The exhibit shows a host with minimal internet-bound traffic but highly unusual DNS behavior, such as frequent queries to a single domain or large DNS query sizes. This pattern is characteristic of DNS tunneling, where data is encoded in DNS queries and responses to bypass network controls, often used for command-and-control (C2) communication or covert data exfiltration. The lack of other traffic indicates the host is not performing normal web browsing or data transfers, making DNS tunneling the most likely explanation.

Answer

ARP poisoning causing the host to redirect traffic to a rogue gateway

Answer

A browser cache synchronization feature repeatedly polling a cloud service

Answer

A misconfigured static route sending all web traffic to the wrong subnet

Question 10

A threat intelligence feed says an adversary rotates domains daily, uses cloud VPS hosting, and reuses the same malware sample across several campaigns. Analysts want the indicator that remains useful even when the domain changes. What should they prioritize?

Accepted Answer

The malware's SHA-256 file hash because it uniquely identifies the sample.. The malware's SHA-256 file hash is the most persistent indicator because it is a cryptographic hash that uniquely identifies the specific binary sample, regardless of the domain or IP address used for delivery. Unlike domains or IPs, which the adversary can rotate daily, the hash remains constant as long as the same malware sample is reused across campaigns. This makes it a reliable indicator of compromise (IOC) for detection via file reputation or hash-based blocklists.

Answer

The current domain name because it is the easiest item to block immediately.

Answer

The cloud provider's entire ASN because all traffic from that provider is automatically malicious.

Answer

The malware's file name because attackers usually keep the same name for convenience.

Question 11

A customer portal has a form that submits a money-transfer request with the user’s existing session cookie. Security testing shows that if a user visits a malicious site while logged in, the portal will submit the transfer request without any additional verification. Which control would best reduce this risk?

Accepted Answer

Add a server-validated anti-CSRF token to each state-changing request. The described attack is a Cross-Site Request Forgery (CSRF), where a malicious site forces an authenticated user's browser to submit a state-changing request without the user's consent. Adding a server-validated anti-CSRF token ensures that each request includes a unique, unpredictable value tied to the user's session, which the server verifies before processing. This prevents the malicious site from forging a valid request because it cannot guess or obtain the token.

Answer

Replace the transfer form with a stored procedure

Answer

Enable input length limits on the transfer amount field

Answer

Turn on content security policy to block all script execution

Question 12

A team hosts a confidential document repository on an IaaS virtual machine. The provider secures the datacenter, hardware, and hypervisor. The organization wants to control who can decrypt the files and be able to revoke that access without changing providers. Which control is best?

Accepted Answer

Use customer-managed encryption keys in the cloud KMS or HSM.. Customer-managed encryption keys (CMEK) in a cloud KMS or HSM allow the organization to retain control over key material, enabling them to decrypt files and revoke access independently of the cloud provider. This meets the requirement to control decryption and revocation without changing providers, as the provider cannot access the keys. In contrast, provider-managed keys do not offer the same level of tenant-controlled revocation.

Answer

Use the provider's default managed encryption keys for the storage service.

Answer

Rely on security groups and network ACLs to protect the document contents.

Answer

Enable automated snapshots so deleted files can be restored later.

Question 13

A company is evaluating a new cloud-based customer relationship management (CRM) provider. The provider’s documentation includes a SOC 2 Type II report, but the company’s compliance team specifically requires evidence that data in transit is encrypted using TLS 1.2 or higher, and data at rest is encrypted with AES-256. Which of the following actions best demonstrates that the company has performed proper due diligence in vendor risk management?

Accepted Answer

Review the detailed control descriptions and auditor test results within the SOC 2 Type II report that address encryption of data in transit and at rest.. A SOC 2 Type II report includes detailed control descriptions and independent auditor test results that specifically verify whether encryption controls (TLS 1.2+ for data in transit and AES-256 for data at rest) are designed and operating effectively over a period of time. Reviewing these granular details allows the company to confirm compliance with its specific encryption requirements, which is a core component of due diligence in vendor risk management.

Answer

Request the provider to sign a contractual service-level agreement (SLA) that guarantees encryption compliance.

Answer

Accept the SOC 2 Type II report as sufficient and proceed without further review.

Answer

Conduct an independent penetration test on the provider’s infrastructure before signing the contract.

Question 14

A vulnerability scan reports that a public web server is running an operating system version that no longer receives security updates. Which issue is present?

Accepted Answer

Outdated component. An operating system version that no longer receives security updates is an outdated component. This means the vendor has ceased patching known vulnerabilities, leaving the system exposed to exploits that target unpatched flaws. In the context of a public web server, this directly violates the principle of maintaining a secure baseline and is a common finding in vulnerability scans.

Answer

Weak permissions

Answer

DNS poisoning

Answer

Smishing

Question 15

A user opens an attached document, and the endpoint security tool shows PowerShell running from memory with no new executable file written to disk. What type of attack is most likely?

Accepted Answer

Fileless attack. The scenario describes PowerShell running from memory without a new executable file written to disk, which is the hallmark of a fileless attack. Fileless attacks leverage legitimate system tools like PowerShell, WMI, or .NET to execute malicious code directly in memory, bypassing traditional file-based detection mechanisms.

Answer

Ransomware

Answer

Rootkit

Answer

Logic bomb

Question 16

A web application was updated at 10:00. At 10:05, the SIEM reports a sharp rise in HTTP 500 errors and WAF blocks from the same source range. The application owner says customers are seeing failures only on the new checkout page. What is the best next step?

Accepted Answer

Correlate deployment, WAF, and application logs to determine whether the release or an attack caused the failures.. The temporal correlation between the deployment at 10:00 and the spike in HTTP 500 errors and WAF blocks at 10:05 strongly suggests a causal relationship. The best next step is to correlate deployment logs, WAF logs, and application logs to determine whether the new checkout page code introduced a bug (causing 500 errors) or whether an attacker is exploiting a vulnerability in the new code (triggering WAF blocks). This diagnostic step avoids premature conclusions and ensures the root cause is identified before any remediation.

Answer

Close the incident because the WAF is blocking the suspicious traffic.

Answer

Disable all customer accounts until the failures disappear from the dashboard.

Answer

Increase the server's disk space and memory thresholds immediately.

Question 17

EDR flags a word processor that launched encoded PowerShell and then made an outbound HTTPS connection to a rare domain. Which two actions should the analyst take first from the EDR console? Select two.

Accepted Answer

Isolate the endpoint from the network to stop further communication and lateral movement.. Isolating the endpoint from the network immediately stops the outbound HTTPS connection to the rare domain, preventing data exfiltration and blocking potential lateral movement. This is a critical first step in containment, as the encoded PowerShell and rare domain strongly suggest a malicious payload or C2 communication.

Answer

Uninstall the word processor immediately because it is the process that launched PowerShell.

Answer

Reboot the laptop right away to clear the encoded PowerShell process from memory.

Answer

Whitelist the rare domain temporarily to see whether the connection is business-related.

Question 18

A company has two security issues to address this week. One is a public-facing login portal that uses default administrator credentials. The other is an internal lab system used only by one tester. Which issue should be prioritized first?

Accepted Answer

The public-facing login portal, because it has a higher likelihood and impact. The public-facing login portal with default administrator credentials is a critical risk because it is exposed to the internet, making it easily discoverable and exploitable by attackers. Default credentials are widely known and often targeted in automated attacks, leading to a high likelihood of compromise and potential impact such as data breach or system takeover. This aligns with risk management principles where priority is given to vulnerabilities with the highest risk score (likelihood × impact).

Answer

The internal lab system, because it is easier to fix quickly

Answer

Both issues have the same priority because they are both vulnerabilities

Answer

Neither issue should be addressed until the next annual review

Question 19

Based on the exhibit, which change best meets the requirement that guest devices can reach the internet but must not reach any internal subnets or printer VLANs?

Accepted Answer

Move guests into a dedicated guest zone with outbound NAT and default-deny rules to internal networks.. Placing guest devices in a dedicated guest zone with outbound NAT allows them to access the internet while default-deny rules to internal subnets and printer VLANs enforce network segmentation. This approach uses firewall policies to explicitly block RFC 1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from guest traffic, ensuring no Layer 3 connectivity to internal resources.

Answer

Add more allow rules for the printer VLAN so guests can print without changing routing.

Answer

Place guest and corporate devices on the same VLAN and rely on the wireless password for separation.

Answer

Allow guest traffic to reach internal DNS and DHCP servers across all RFC1918 subnets.

Question 20

Network engineers need to administer internal switches from home. The company wants encrypted management traffic, strong user verification, and no management ports exposed directly to the internet. Which approach is best?

Accepted Answer

Require a VPN or ZTNA connection with MFA, then allow SSH or HTTPS management only through that protected tunnel.. It enforces encryption (via VPN or ZTNA tunnel), strong user verification (MFA), and network segmentation (no direct internet exposure). SSH or HTTPS management traffic is then allowed only through the protected tunnel, ensuring confidentiality, integrity, and access control. This aligns with the principle of defense in depth for remote network device administration.

Answer

Expose SSH on the internet and rely on key-based authentication alone.

Answer

Use RDP with port forwarding because it is simpler for remote support.

Answer

Allow split tunneling without MFA so engineers can reduce latency while working remotely.