SY0-701 Practice Exam 55 — 20 Questions

Question 1

EDR flags a word processor that launched encoded PowerShell and then made an outbound HTTPS connection to a rare domain. Which two actions should the analyst take first from the EDR console? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the endpoint from the network to stop further communication and lateral movement.. Isolating the endpoint from the network immediately stops the outbound HTTPS connection to the rare domain, preventing data exfiltration and blocking potential lateral movement. This is a critical first step in containment, as the encoded PowerShell and rare domain strongly suggest a malicious payload or C2 communication.

Answer

Uninstall the word processor immediately because it is the process that launched PowerShell.

Answer

Reboot the laptop right away to clear the encoded PowerShell process from memory.

Answer

Whitelist the rare domain temporarily to see whether the connection is business-related.

Question 2

A company has two security issues to address this week. One is a public-facing login portal that uses default administrator credentials. The other is an internal lab system used only by one tester. Which issue should be prioritized first?

Accepted Answer

The public-facing login portal, because it has a higher likelihood and impact. The public-facing login portal with default administrator credentials is a critical risk because it is exposed to the internet, making it easily discoverable and exploitable by attackers. Default credentials are widely known and often targeted in automated attacks, leading to a high likelihood of compromise and potential impact such as data breach or system takeover. This aligns with risk management principles where priority is given to vulnerabilities with the highest risk score (likelihood × impact).

Answer

The internal lab system, because it is easier to fix quickly

Answer

Both issues have the same priority because they are both vulnerabilities

Answer

Neither issue should be addressed until the next annual review

Question 3

Based on the exhibit, which change best meets the requirement that guest devices can reach the internet but must not reach any internal subnets or printer VLANs?

Accepted Answer

Move guests into a dedicated guest zone with outbound NAT and default-deny rules to internal networks.. Placing guest devices in a dedicated guest zone with outbound NAT allows them to access the internet while default-deny rules to internal subnets and printer VLANs enforce network segmentation. This approach uses firewall policies to explicitly block RFC 1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from guest traffic, ensuring no Layer 3 connectivity to internal resources.

Answer

Add more allow rules for the printer VLAN so guests can print without changing routing.

Answer

Place guest and corporate devices on the same VLAN and rely on the wireless password for separation.

Answer

Allow guest traffic to reach internal DNS and DHCP servers across all RFC1918 subnets.

Question 4

Network engineers need to administer internal switches from home. The company wants encrypted management traffic, strong user verification, and no management ports exposed directly to the internet. Which approach is best?

Accepted Answer

Require a VPN or ZTNA connection with MFA, then allow SSH or HTTPS management only through that protected tunnel.. It enforces encryption (via VPN or ZTNA tunnel), strong user verification (MFA), and network segmentation (no direct internet exposure). SSH or HTTPS management traffic is then allowed only through the protected tunnel, ensuring confidentiality, integrity, and access control. This aligns with the principle of defense in depth for remote network device administration.

Answer

Expose SSH on the internet and rely on key-based authentication alone.

Answer

Use RDP with port forwarding because it is simpler for remote support.

Answer

Allow split tunneling without MFA so engineers can reduce latency while working remotely.

Question 5

Drag and drop the steps to perform a password reset for a user in Active Directory into the correct order.

Accepted Answer

Open Active Directory Users and Computers, locate the user account, right-click the user and select Reset Password, then enter the new password, optionally check 'User must change password at next logon', and click OK.. Password reset in AD is done via ADUC; the admin must have appropriate permissions, and it's good practice to enforce change at next logon.

Answer

Right-click the user and select Reset Password, then open Active Directory Users and Computers, locate the user account, then enter the new password and click OK.

Answer

Open Active Directory Users and Computers, right-click the user and select Reset Password, then locate the user account, then enter the new password and click OK.

Answer

Open Active Directory Users and Computers, locate the user account, then enter the new password and click OK, then right-click the user and select Reset Password.

Question 6

An API log shows repeated requests such as `GET /api/orders?orderId=105%20OR%201=1--` followed by responses containing many customers' order records instead of one record. Which attack is most likely?

Accepted Answer

SQL injection, because the attacker is altering the database query through crafted input.. The request includes `%20OR%201=1--`, which URL-decodes to ` OR 1=1--`. This is a classic SQL injection payload that appends a tautology (`OR 1=1`) and comments out the rest of the query (`--`). The API log shows that instead of returning a single order record, the response contains many customers' order records, confirming that the injected condition bypassed the intended WHERE clause and returned all rows from the orders table.

Answer

Cross-site scripting, because malicious code is being reflected in the browser.

Answer

Cross-site request forgery, because the request appears to be an unauthorized action.

Answer

Broken access control, because the API is not validating the user role correctly.

Question 7

An employee receives an email that appears to come from the HR team. It says their payroll account will be suspended unless they click a link and sign in within 30 minutes. What type of attack is this most likely?

Accepted Answer

Phishing. This is a classic phishing attack because the threat actor uses a deceptive email message to trick the recipient into clicking a malicious link and providing sensitive credentials. Phishing specifically refers to social engineering attacks delivered via email, often leveraging urgency and impersonation of a trusted entity like HR to bypass the victim's critical thinking.

Answer

Smishing

Answer

Vishing

Answer

Pretexting

Question 8

A user reports receiving repeated MFA push requests even though they are not logging in. Later, someone calls and claims to be IT, asking the user to approve one prompt so support can finish a password reset. Which control would best reduce the success of this attack?

Accepted Answer

Use phishing-resistant MFA with number matching or hardware security keys. Phishing-resistant MFA, such as number matching or hardware security keys (e.g., FIDO2/WebAuthn), prevents an attacker from tricking the user into approving a fraudulent push request. Number matching requires the user to enter a number displayed on the login screen into the MFA prompt, ensuring the approval is tied to an actual authentication attempt. Hardware security keys use cryptographic challenge-response, making it impossible for an attacker to replay or intercept the authentication factor.

Answer

Increase password complexity requirements

Answer

Shorten the screen-lock timeout on user devices

Answer

Allow users to approve any MFA prompt sent during business hours

Question 9

An HR portal has three groups: HR staff can edit employee records, managers can approve leave, and payroll can view salary data. No one should have all functions. Which access model should the engineer implement?

Accepted Answer

Role-based access control with separate groups mapped to each business function.. Role-Based Access Control (RBAC) allows the engineer to define three distinct roles (HR staff, managers, payroll) with granular permissions mapped to specific business functions, ensuring no single user inherits all privileges. This model enforces the principle of least privilege by separating duties across groups, preventing any user from having full access to the portal's sensitive operations.

Answer

A single shared admin account so all tasks can be completed quickly.

Answer

Mandatory access control with all users assigned the same clearance level.

Answer

Local account creation on the portal for each user, with permissions assigned manually one by one.

Question 10

An EDR alert shows suspicious PowerShell activity on a remote employee laptop, and the user is still logged in to cloud applications. Which two response actions are best if the device is believed to be actively compromised? Select two.

Accepted Answer

Isolate the endpoint through the EDR tool or quarantine its network access.. Isolating the endpoint via the EDR tool or quarantining its network access immediately stops the attacker's ability to communicate with command-and-control servers, preventing lateral movement and further data exfiltration. This containment action is a critical first step in incident response for an actively compromised device, as it preserves the integrity of the investigation while halting malicious activity.

Answer

Power off the laptop immediately to stop the activity as fast as possible.

Answer

Wait until the user returns the laptop to the office for physical inspection.

Answer

Remove the EDR agent so the attacker cannot detect the investigation.

Question 11

A finance application works normally for weeks after a contractor leaves the company. On the first business day of the quarter, a hidden task runs, deletes archived reports, and then removes itself from the scheduled task list. What type of malware behavior is this?

Accepted Answer

Logic bomb. The malware behavior described is a logic bomb because it lies dormant for a specific period (weeks) and triggers on a predefined condition (the first business day of the quarter) to execute a malicious payload (deleting archived reports) and then self-destructs by removing itself from the scheduled task list. This matches the definition of a logic bomb: malicious code that executes when a logical condition is met, often used for sabotage or delayed attacks.

Answer

Worm

Answer

Rootkit

Answer

Spyware

Question 12

A development team is moving a regulated application to a cloud platform. The security architect wants the strongest practical separation from other customers without buying and operating physical servers. Which hosting option is most appropriate?

Accepted Answer

A dedicated host or isolated compute offering from the cloud provider.. A dedicated host or isolated compute offering (option B) provides the strongest practical separation because it ensures the application runs on a physical server dedicated solely to that customer, preventing any resource sharing or potential side-channel attacks from other tenants. This meets the regulatory requirement for strong isolation without the cost and operational overhead of purchasing and managing physical servers on-premises.

Answer

A shared multi-tenant environment with no additional security configuration.

Answer

Any public object storage service because the data will be encrypted by default.

Answer

A remote desktop service on the cheapest shared instance available.

Question 13

A help desk lead notices that several support technicians have broad administrator access across every department's systems so they can resolve tickets faster. After a phishing incident, management wants to reduce the damage if one technician account is compromised. What is the best security principle to apply when redesigning access?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. By applying least privilege, each technician would receive access only to the specific systems and resources required for their role, rather than broad administrator access across all departments. This containment directly limits the blast radius of a compromised account, preventing an attacker from moving laterally to other departmental systems.

Answer

Defense in depth

Answer

Need-to-know

Answer

Zero trust

Question 14

A SIEM correlates three failed MFA prompts for a payroll admin account from one IP, a successful login two minutes later from the same IP, and a new mailbox forwarding rule to an external address. What is the best immediate action?

Accepted Answer

Disable the account and revoke active sessions and tokens.. The combination of failed MFA prompts followed by a successful login and immediate creation of an external mailbox forwarding rule is a classic indicator of account compromise (e.g., adversary-in-the-middle or token theft). Disabling the account and revoking active sessions and tokens stops the attacker from maintaining access and prevents further data exfiltration via the forwarding rule, which is the most urgent containment step in incident response.

Answer

Reset the password and leave the account enabled so the user can keep working.

Answer

Delete the forwarding rule and monitor the account for a few hours.

Answer

Wait for the user to confirm the login before taking any action.

Question 15

A vulnerability scan of a Linux application server reports these findings: OpenSSL 3.0.7 is flagged with a critical CVE, but the distribution vendor note says the fix was backported. Port 8443 is bound to all interfaces, yet a firewall blocks it from the internet. The internal admin console on that port still uses the default admin/admin credentials and is reachable from the corporate VLAN. Which issue should be remediated first?

Accepted Answer

Change the default credentials on the internal admin console and restrict access to only approved management hosts.. The most immediate risk is that an attacker on the corporate VLAN can access the internal admin console using default credentials (admin/admin). This bypasses the firewall and allows full control of the application server. Even though OpenSSL has a backported fix, the default credentials represent an active, easily exploitable vulnerability that requires no additional exploit development.

Answer

Upgrade OpenSSL immediately, because the reported CVE proves the package is exploitable as installed.

Answer

Ignore the 8443 service, because the internet firewall already prevents external exposure.

Answer

Leave the console as-is and focus only on changing the bind address to 127.0.0.1.

Question 16

An HR spreadsheet contains employee names, Social Security numbers, and bank account numbers. Which label is most appropriate under a Public, Internal, Confidential, and Restricted scheme?

Accepted Answer

Restricted, because it contains highly sensitive personal and financial data.. A spreadsheet containing employee names, Social Security numbers, and bank account numbers includes personally identifiable information (PII) and financial account data, which are subject to strict regulatory controls (e.g., GDPR, GLBA, or state breach notification laws). Under a Public/Internal/Confidential/Restricted classification scheme, 'Restricted' is the most appropriate label because it indicates the highest level of sensitivity and requires access control mechanisms such as encryption at rest (e.g., AES-256), strict least-privilege permissions, and audit logging to prevent unauthorized disclosure or modification.

Answer

Public, because it is used by the HR department and not shared externally.

Answer

Internal, because only employees should see it.

Answer

Confidential, because the information should be kept private but not tightly controlled.

Question 17

An administrator notices that a finance file share remained normal for weeks after a former contractor left the company. This morning, multiple PDFs and spreadsheets were deleted, and a scheduled task created months ago is now executing a script that wipes files in the shared folder. Which malware type is most consistent with this behavior?

Accepted Answer

Logic bomb triggered by a time or condition after being planted earlier. The behavior matches a logic bomb: malicious code planted in advance (the scheduled task created months ago) that remains dormant until triggered by a specific condition (the passage of time or a date). The file share was normal for weeks because the logic bomb had not yet met its trigger condition; once triggered, it executed the script to delete files. This contrasts with other malware types that require active propagation, continuous monitoring, or kernel-level hiding.

Answer

Worm that is automatically propagating to other endpoints

Answer

Spyware that is secretly collecting keystrokes and screenshots

Answer

Rootkit that is hiding itself in the kernel to maintain stealth

Question 18

A legacy application cannot be patched for two weeks, but the security team still wants to reduce risk in the meantime. What is the best temporary measure?

Accepted Answer

Add a compensating control such as restricting access to the system.. Implementing a compensating control, such as restricting network access via firewall rules or disabling unnecessary services, reduces the attack surface while the legacy application remains unpatched. This aligns with the principle of defense-in-depth, where temporary mitigations like access control lists (ACLs) or host-based firewalls can block exploit vectors until the patch is applied.

Answer

Do nothing until the patch window opens.

Answer

Disable all logging so the system runs faster.

Answer

Rename the application so attackers cannot find it.

Question 19

After containment and eradication of malware on several laptops, the team restores the devices from known-good images and verifies that users can authenticate and access email. Which action should occur NEXT to complete the incident response lifecycle and reduce future impact?

Accepted Answer

Perform a lessons-learned review and update playbooks, controls, or detections based on the incident. The incident response lifecycle includes a post-incident activity phase where the team conducts a lessons-learned review to identify gaps in security controls, update playbooks, and improve detection signatures. This step ensures that the organization reduces the likelihood and impact of similar incidents in the future, completing the lifecycle beyond just restoring operations.

Answer

Close the ticket immediately because the systems are working again

Answer

Reimage the laptops again even though they were already restored and tested

Answer

Disable all email access for the organization until the next quarterly meeting

Question 20

A company is redesigning its network to host a public-facing web application that accesses a confidential database. The security team needs to minimize the risk of a direct attack against the database server while still allowing the web server to retrieve and update data. Which network architecture best achieves this objective?

Accepted Answer

Place the web server in the DMZ and the database server on the internal network. Configure the firewall to allow inbound traffic from the web server to the database server on the required port only.. It implements a tiered network architecture where the web server resides in the DMZ (a semi-trusted zone) and the database server is placed on the internal network, isolated from direct internet access. The firewall is configured with a stateful rule that permits only the web server's IP and the specific database port (e.g., TCP 3306 for MySQL or 1433 for MSSQL), preventing any direct inbound connections from the internet to the database. This minimizes the attack surface by ensuring that even if the web server is compromised, the database is not directly reachable from external hosts.

Answer

Place both the web server and the database server in the same DMZ segment and rely on host-based firewalls for protection.

Answer

Connect both servers to a single internal VLAN and use a reverse proxy to forward external traffic to the web server.

Answer

Use a site-to-site VPN to connect the web server and database server, and place both behind a single NAT gateway.