SY0-701 Practice Exam 55 — 20 Questions

Question 1

Drag and drop the steps to perform a password reset for a user in Active Directory into the correct order.

Accepted Answer

Open Active Directory Users and Computers, locate the user account, right-click the user and select Reset Password, then enter the new password, optionally check 'User must change password at next logon', and click OK.. Password reset in AD is done via ADUC; the admin must have appropriate permissions, and it's good practice to enforce change at next logon.

Answer

Right-click the user and select Reset Password, then open Active Directory Users and Computers, locate the user account, then enter the new password and click OK.

Answer

Open Active Directory Users and Computers, right-click the user and select Reset Password, then locate the user account, then enter the new password and click OK.

Answer

Open Active Directory Users and Computers, locate the user account, then enter the new password and click OK, then right-click the user and select Reset Password.

Question 2

An API log shows repeated requests such as `GET /api/orders?orderId=105%20OR%201=1--` followed by responses containing many customers' order records instead of one record. Which attack is most likely?

Accepted Answer

SQL injection, because the attacker is altering the database query through crafted input.. The request includes `%20OR%201=1--`, which URL-decodes to ` OR 1=1--`. This is a classic SQL injection payload that appends a tautology (`OR 1=1`) and comments out the rest of the query (`--`). The API log shows that instead of returning a single order record, the response contains many customers' order records, confirming that the injected condition bypassed the intended WHERE clause and returned all rows from the orders table.

Answer

Cross-site scripting, because malicious code is being reflected in the browser.

Answer

Cross-site request forgery, because the request appears to be an unauthorized action.

Answer

Broken access control, because the API is not validating the user role correctly.

Question 3

An employee receives an email that appears to come from the HR team. It says their payroll account will be suspended unless they click a link and sign in within 30 minutes. What type of attack is this most likely?

Accepted Answer

Phishing. This is a classic phishing attack because the threat actor uses a deceptive email message to trick the recipient into clicking a malicious link and providing sensitive credentials. Phishing specifically refers to social engineering attacks delivered via email, often leveraging urgency and impersonation of a trusted entity like HR to bypass the victim's critical thinking.

Answer

Smishing

Answer

Vishing

Answer

Pretexting

Question 4

A user reports receiving repeated MFA push requests even though they are not logging in. Later, someone calls and claims to be IT, asking the user to approve one prompt so support can finish a password reset. Which control would best reduce the success of this attack?

Accepted Answer

Use phishing-resistant MFA with number matching or hardware security keys. Phishing-resistant MFA, such as number matching or hardware security keys (e.g., FIDO2/WebAuthn), prevents an attacker from tricking the user into approving a fraudulent push request. Number matching requires the user to enter a number displayed on the login screen into the MFA prompt, ensuring the approval is tied to an actual authentication attempt. Hardware security keys use cryptographic challenge-response, making it impossible for an attacker to replay or intercept the authentication factor.

Answer

Increase password complexity requirements

Answer

Shorten the screen-lock timeout on user devices

Answer

Allow users to approve any MFA prompt sent during business hours

Question 5

An EDR alert shows suspicious PowerShell activity on a remote employee laptop, and the user is still logged in to cloud applications. Which two response actions are best if the device is believed to be actively compromised? Select two.

Accepted Answer

Isolate the endpoint through the EDR tool or quarantine its network access.. Isolating the endpoint via the EDR tool or quarantining its network access immediately stops the attacker's ability to communicate with command-and-control servers, preventing lateral movement and further data exfiltration. This containment action is a critical first step in incident response for an actively compromised device, as it preserves the integrity of the investigation while halting malicious activity.

Answer

Power off the laptop immediately to stop the activity as fast as possible.

Answer

Wait until the user returns the laptop to the office for physical inspection.

Answer

Remove the EDR agent so the attacker cannot detect the investigation.

Question 6

A company is considering a new SaaS vendor that will process customer records. What is the best first action before signing the contract?

Accepted Answer

Perform vendor due diligence and review the vendor's security controls. Performing vendor due diligence and reviewing the vendor's security controls is the best first action because it proactively assesses the SaaS vendor's ability to protect customer records before any data is shared. This aligns with the principle of 'trust but verify' and ensures that the vendor's security posture meets the company's compliance requirements (e.g., GDPR, HIPAA) and risk tolerance before signing a legally binding contract.

Answer

Allow the vendor access immediately and monitor for misuse afterward

Answer

Ask the vendor to send a marketing brochure and pricing sheet only

Answer

Wait until a security incident occurs before reviewing the vendor

Question 7

A finance analyst receives an email that appears to come from the CFO. It references a real project, asks for an urgent wire transfer to a "new vendor account," and says to avoid the normal approval workflow because the deal is time-sensitive. What is the best immediate response?

Accepted Answer

Verify the request using a known-good contact method and report the message as suspicious.. The best response is to verify the request through a known, trusted communication path and then report it. In a spear phishing or business email compromise scenario, the attacker relies on urgency, authority, and familiarity to bypass normal controls. A separate phone call, chat message, or in-person confirmation using an existing contact list provides stronger assurance than any reply to the suspicious email itself.

Why others are wrong: Replying, processing the transfer, or forwarding the message all keep the workflow inside the attacker’s channel and increase the chance of fraud. None of those actions independently validate the sender’s identity or the payment change request. The key security habit is to stop, verify outside the email thread, and escalate the suspicious communication.

Answer

Reply to the email asking for additional payment details and wait for a response.

Answer

Process the transfer quickly because the message appears to come from an executive.

Answer

Forward the email to another finance employee so someone else can confirm the request.

Question 8

A finance manager can view only the reports needed for monthly budgeting and cannot see payroll details. Which principle is being applied?

Accepted Answer

Need-to-know, because access is limited to information required for the job.. The principle of need-to-know restricts access to only the information necessary for an individual to perform their job duties. In this scenario, the finance manager can view only monthly budgeting reports and is explicitly blocked from payroll details, which aligns directly with need-to-know. This is typically enforced through access control lists (ACLs) or role-based access control (RBAC) policies that limit data visibility based on job function.

Answer

Zero trust, because the manager uses a password to sign in.

Answer

Separation of duties, because the manager is part of finance.

Answer

Defense in depth, because only one report system is being used.

Question 9

A finance application works normally for weeks after a contractor leaves the company. On the first business day of the quarter, a hidden task runs, deletes archived reports, and then removes itself from the scheduled task list. What type of malware behavior is this?

Accepted Answer

Logic bomb. The malware behavior described is a logic bomb because it lies dormant for a specific period (weeks) and triggers on a predefined condition (the first business day of the quarter) to execute a malicious payload (deleting archived reports) and then self-destructs by removing itself from the scheduled task list. This matches the definition of a logic bomb: malicious code that executes when a logical condition is met, often used for sabotage or delayed attacks.

Answer

Worm

Answer

Rootkit

Answer

Spyware

Question 10

A development team is moving a regulated application to a cloud platform. The security architect wants the strongest practical separation from other customers without buying and operating physical servers. Which hosting option is most appropriate?

Accepted Answer

A dedicated host or isolated compute offering from the cloud provider.. A dedicated host or isolated compute offering (option B) provides the strongest practical separation because it ensures the application runs on a physical server dedicated solely to that customer, preventing any resource sharing or potential side-channel attacks from other tenants. This meets the regulatory requirement for strong isolation without the cost and operational overhead of purchasing and managing physical servers on-premises.

Answer

A shared multi-tenant environment with no additional security configuration.

Answer

Any public object storage service because the data will be encrypted by default.

Answer

A remote desktop service on the cheapest shared instance available.

Question 11

A help desk lead notices that several support technicians have broad administrator access across every department's systems so they can resolve tickets faster. After a phishing incident, management wants to reduce the damage if one technician account is compromised. What is the best security principle to apply when redesigning access?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. By applying least privilege, each technician would receive access only to the specific systems and resources required for their role, rather than broad administrator access across all departments. This containment directly limits the blast radius of a compromised account, preventing an attacker from moving laterally to other departmental systems.

Answer

Defense in depth

Answer

Need-to-know

Answer

Zero trust

Question 12

A SIEM correlates three failed MFA prompts for a payroll admin account from one IP, a successful login two minutes later from the same IP, and a new mailbox forwarding rule to an external address. What is the best immediate action?

Accepted Answer

Disable the account and revoke active sessions and tokens.. The combination of failed MFA prompts followed by a successful login and immediate creation of an external mailbox forwarding rule is a classic indicator of account compromise (e.g., adversary-in-the-middle or token theft). Disabling the account and revoking active sessions and tokens stops the attacker from maintaining access and prevents further data exfiltration via the forwarding rule, which is the most urgent containment step in incident response.

Answer

Reset the password and leave the account enabled so the user can keep working.

Answer

Delete the forwarding rule and monitor the account for a few hours.

Answer

Wait for the user to confirm the login before taking any action.

Question 13

A vulnerability scan of a Linux application server reports these findings: OpenSSL 3.0.7 is flagged with a critical CVE, but the distribution vendor note says the fix was backported. Port 8443 is bound to all interfaces, yet a firewall blocks it from the internet. The internal admin console on that port still uses the default admin/admin credentials and is reachable from the corporate VLAN. Which issue should be remediated first?

Accepted Answer

Change the default credentials on the internal admin console and restrict access to only approved management hosts.. The most immediate risk is that an attacker on the corporate VLAN can access the internal admin console using default credentials (admin/admin). This bypasses the firewall and allows full control of the application server. Even though OpenSSL has a backported fix, the default credentials represent an active, easily exploitable vulnerability that requires no additional exploit development.

Answer

Upgrade OpenSSL immediately, because the reported CVE proves the package is exploitable as installed.

Answer

Ignore the 8443 service, because the internet firewall already prevents external exposure.

Answer

Leave the console as-is and focus only on changing the bind address to 127.0.0.1.

Question 14

An HR spreadsheet contains employee names, Social Security numbers, and bank account numbers. Which label is most appropriate under a Public, Internal, Confidential, and Restricted scheme?

Accepted Answer

Restricted, because it contains highly sensitive personal and financial data.. A spreadsheet containing employee names, Social Security numbers, and bank account numbers includes personally identifiable information (PII) and financial account data, which are subject to strict regulatory controls (e.g., GDPR, GLBA, or state breach notification laws). Under a Public/Internal/Confidential/Restricted classification scheme, 'Restricted' is the most appropriate label because it indicates the highest level of sensitivity and requires access control mechanisms such as encryption at rest (e.g., AES-256), strict least-privilege permissions, and audit logging to prevent unauthorized disclosure or modification.

Answer

Public, because it is used by the HR department and not shared externally.

Answer

Internal, because only employees should see it.

Answer

Confidential, because the information should be kept private but not tightly controlled.

Question 15

An administrator notices that a finance file share remained normal for weeks after a former contractor left the company. This morning, multiple PDFs and spreadsheets were deleted, and a scheduled task created months ago is now executing a script that wipes files in the shared folder. Which malware type is most consistent with this behavior?

Accepted Answer

Logic bomb triggered by a time or condition after being planted earlier. The behavior matches a logic bomb: malicious code planted in advance (the scheduled task created months ago) that remains dormant until triggered by a specific condition (the passage of time or a date). The file share was normal for weeks because the logic bomb had not yet met its trigger condition; once triggered, it executed the script to delete files. This contrasts with other malware types that require active propagation, continuous monitoring, or kernel-level hiding.

Answer

Worm that is automatically propagating to other endpoints

Answer

Spyware that is secretly collecting keystrokes and screenshots

Answer

Rootkit that is hiding itself in the kernel to maintain stealth

Question 16

After containment and eradication of malware on several laptops, the team restores the devices from known-good images and verifies that users can authenticate and access email. Which action should occur NEXT to complete the incident response lifecycle and reduce future impact?

Accepted Answer

Perform a lessons-learned review and update playbooks, controls, or detections based on the incident. The incident response lifecycle includes a post-incident activity phase where the team conducts a lessons-learned review to identify gaps in security controls, update playbooks, and improve detection signatures. This step ensures that the organization reduces the likelihood and impact of similar incidents in the future, completing the lifecycle beyond just restoring operations.

Answer

Close the ticket immediately because the systems are working again

Answer

Reimage the laptops again even though they were already restored and tested

Answer

Disable all email access for the organization until the next quarterly meeting

Question 17

A vulnerability dashboard shows four new findings. Which one should be remediated first by the operations team?

- A low-severity issue on an offline lab VM
- A medium-severity issue on a payroll server with no known exploit
- A critical issue on an internet-facing web server with an available exploit
- A high-severity issue on a test workstation that is not domain joined

Accepted Answer

The critical issue on the internet-facing web server with an available exploit.. The critical issue on the internet-facing web server with an available exploit should be remediated first because it combines the highest severity (critical) with an active, exploitable vulnerability on an asset exposed to the public internet. In vulnerability management, remediation priority is determined by risk, which is a function of severity, exploitability, and asset exposure. An internet-facing web server with a known exploit represents an immediate threat that can be remotely compromised, unlike the other findings which are on isolated or less critical systems.

Answer

The low-severity issue on the offline lab VM.

Answer

The medium-severity issue on the payroll server with no known exploit.

Answer

The high-severity issue on the test workstation that is not domain joined.

Question 18

A company is redesigning its network to host a public-facing web application that accesses a confidential database. The security team needs to minimize the risk of a direct attack against the database server while still allowing the web server to retrieve and update data. Which network architecture best achieves this objective?

Accepted Answer

Place the web server in the DMZ and the database server on the internal network. Configure the firewall to allow inbound traffic from the web server to the database server on the required port only.. It implements a tiered network architecture where the web server resides in the DMZ (a semi-trusted zone) and the database server is placed on the internal network, isolated from direct internet access. The firewall is configured with a stateful rule that permits only the web server's IP and the specific database port (e.g., TCP 3306 for MySQL or 1433 for MSSQL), preventing any direct inbound connections from the internet to the database. This minimizes the attack surface by ensuring that even if the web server is compromised, the database is not directly reachable from external hosts.

Answer

Place both the web server and the database server in the same DMZ segment and rely on host-based firewalls for protection.

Answer

Connect both servers to a single internal VLAN and use a reverse proxy to forward external traffic to the web server.

Answer

Use a site-to-site VPN to connect the web server and database server, and place both behind a single NAT gateway.

Question 19

After completing a vulnerability scan, a security analyst discovers that a legacy customer-facing application running on an unsupported operating system contains a critical remote code execution vulnerability. The application is essential to daily operations and cannot be patched or upgraded in the near term. Management has approved the purchase of a hardware-based network firewall that will be placed in front of the application to restrict inbound traffic to only authorized source IP addresses and port numbers. Which risk management strategy does this action primarily represent?

Accepted Answer

Risk mitigation. The security team is implementing a hardware-based network firewall to restrict inbound traffic to only authorized source IP addresses and port numbers. This directly reduces the likelihood of exploitation by limiting the attack surface, which is the essence of risk mitigation — applying controls to reduce the risk to an acceptable level. Patching or upgrading is not feasible, so compensating controls like network segmentation and access control lists (ACLs) are used to mitigate the vulnerability.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transference

Question 20

After a server rebuild, an administrator notices that Remote Desktop, SMBv1, and Print Spooler are still enabled on a Windows file server even though the server only stores department documents. The security team also wants to know if future changes drift away from the approved build. What should be implemented?

Accepted Answer

Apply the approved secure baseline and enable configuration drift monitoring against it.. Applying an approved secure baseline (e.g., via Group Policy or Security Compliance Toolkit) ensures that unnecessary services like Remote Desktop, SMBv1, and Print Spooler are explicitly disabled. Enabling configuration drift monitoring (e.g., using Azure Policy, DSC, or a SIEM) allows the security team to detect and alert on any unauthorized changes that deviate from the baseline, addressing both the immediate risk and the long-term compliance requirement.

Answer

Keep the server as-is and rely on the antivirus console to stop misuse.

Answer

Move the server into a different VLAN and leave the operating system settings unchanged.

Answer

Schedule a monthly reboot to clear temporary settings and reduce attack surface.