SY0-701 Practice Exam 54 — 20 Questions

Question 1

Match each principle to the workplace scenario.

Question 2

Match each scenario from a security design review to the principle it best demonstrates.

Question 3

Match each security principle to the best workplace example.

Question 4

Match each security control type to the best example in a small office environment.

Question 5

Match each traffic control to the best description.

Question 6

Match each data example to the most appropriate classification label.
1. A public marketing flyer approved for external posting.
2. An internal org chart and office directory meant only for employees.
3. A customer case file with contact details and order history.
4. A vault export containing API keys and encryption secrets.

Question 7

Match each SOC alert artifact to the most useful investigation pivot. Each pivot should help determine whether the alert is a true incident, a false positive, or part of a broader campaign.

Question 8

Match each change-management practice to the best description for reducing patching risk in production.

Question 9

Match each PKI term to what it does.

Question 10

Match each business scenario to the most appropriate risk treatment.
1. A legacy reporting server is expensive to replace, and leadership is willing to monitor the low expected loss for now.
2. A public web portal is being hit by credential stuffing, so the team adds MFA and rate limiting.
3. The organization wants protection from a costly third-party outage by purchasing cyber insurance.
4. A proposed project would collect regulated data that the business has decided not to process at all.

Question 11

Match each procurement need to the vendor due diligence artifact or control that best fits.
1. Procurement wants independent evidence that a SaaS provider's controls operated effectively during the last year.
2. The team wants to know what files, libraries, and modules were included in a supplier's software build.
3. The business needs a signed agreement that defines how customer data is handled and what the vendor must do if an incident occurs.
4. The procurement team wants answers about MFA, logging, and incident response before onboarding a cloud supplier.

Question 12

Match each governance need to the document type that best fits.
1. All employees must follow rules for acceptable use of company systems.
2. Every company laptop must use full-disk encryption and a 14-character screen-lock PIN.
3. The service desk follows these exact steps to verify a caller before resetting MFA.
4. Admins are encouraged to place non-production test data in approved folders when practical.

Question 13

Match each control category to the best example.

Question 14

Match each requirement or instruction to the correct governance document type. Use each document type once.

Question 15

Match each design requirement to the best security architecture control. Use each control once.

Question 16

Match the security need to the best cryptographic solution.

Question 17

A company is redesigning how systems are separated in its office and data center network. Match each network design element to the scenario it best supports. Use each term once.

Question 18

Match each security principle to the best description.

Question 19

SIEM alerts show one workstation making SMB connections to 30 internal hosts within 10 minutes, followed by remote service creation and repeated access attempts to admin shares. The workstation also begins authenticating with several privileged accounts. What is the most likely activity?

Accepted Answer

Lateral movement after credential compromise or endpoint takeover.. The sequence of SMB connections to many internal hosts, followed by remote service creation and repeated access attempts to admin shares, combined with authentication using privileged accounts, is the classic pattern of lateral movement. This indicates the attacker has already compromised the workstation (endpoint takeover) or obtained valid credentials and is now using SMB and PsExec-like techniques to move laterally across the network, escalate privileges, and establish persistence.

Answer

A distributed denial-of-service attack launched from a compromised internal host.

Answer

DNS tunneling used to exfiltrate data through allowed name-resolution traffic.

Answer

ARP spoofing to redirect local traffic at the network layer.

Question 20

A security analyst is reviewing incident response procedures. Which three of the following activities are typically performed during the 'Containment, Eradication, and Recovery' phase of the incident response process? (Choose three.)

Accepted Answer

Isolating affected systems from the network to prevent further damage. The 'Containment, Eradication, and Recovery' phase focuses on stopping the spread of an incident, removing the root cause, and restoring normal operations. Isolating affected systems (containment), removing malicious files and restoring from backups (eradication/recovery), and rebuilding from a secure baseline (recovery) are all core activities in this phase, as defined by NIST SP 800-61 Rev. 2 and CompTIA's incident response framework.

Answer

Escalating the incident to law enforcement agencies

Answer

Performing forensic imaging of all systems before any action is taken

Answer

Conducting a lessons-learned meeting with the incident response team