SY0-701 Practice Exam 56 — 20 Questions

Question 1

After building a new file server, an administrator reviews the security baseline and notices that a remote desktop service is enabled even though no one uses it. What is the best hardening action?

Accepted Answer

Disable the unnecessary service. The best hardening action is to disable the unnecessary remote desktop service because it reduces the attack surface. An enabled but unused service, such as Remote Desktop Protocol (RDP) on TCP/3389, is a common vector for brute-force attacks and exploits (e.g., BlueKeep, CVE-2019-0708). Disabling it eliminates this risk without affecting legitimate operations.

Answer

Keep the service enabled in case someone needs it later

Answer

Change the server name to make it harder to find

Answer

Increase disk space on the server

Question 2

Employees authenticate once to a corporate portal and then open the help desk, payroll, and documentation apps without logging in again. The apps rely on tokens from the company's identity provider instead of storing separate passwords. What is being implemented?

Accepted Answer

Federated single sign-on using the corporate identity provider.. The scenario describes single sign-on (SSO) where the corporate identity provider (IdP) issues tokens (e.g., SAML assertions, OIDC ID tokens) after initial authentication. The help desk, payroll, and documentation apps are configured as service providers that trust the IdP, so they accept the token instead of requiring separate credentials. This is federated SSO because the apps rely on a central identity provider rather than sharing password databases or synchronizing passwords.

Answer

Password synchronization between every application in the suite.

Answer

Shared guest accounts for all employees on the portal.

Answer

Split tunneling through a VPN to speed up application access.

Question 3

A help desk team needs to reset passwords on servers during incidents, but they should not keep standing administrator rights all day. Which two controls best support this requirement? Select two.

Accepted Answer

Use privileged access management (PAM) to control and audit elevated access.. Privileged Access Management (PAM) solutions enforce just-in-time (JIT) elevation, time-bound access, and session auditing. This allows the help desk team to obtain administrator rights only when needed for incident response, eliminating the need for standing admin rights while maintaining full audit trails.

Answer

Share one permanent domain administrator account with the whole team.

Answer

Use a regular user account and disable all authentication logging.

Answer

Give every help desk user full access all the time so work is faster.

Question 4

An employee receives an email that appears to come from the company's payroll provider. It says payroll documents will be deleted today unless the employee signs in through the included link. What is the best first action?

Accepted Answer

Report the message and verify the request using a trusted contact method.. The email exhibits classic signs of a phishing attack—urgency, a threat of data loss, and a link to a fake login page. The best first action is to report the suspicious message to the security team and independently verify the request by contacting the payroll provider through a trusted channel (e.g., a known phone number or a previously bookmarked URL). This prevents credential theft and potential account compromise.

Answer

Click the link quickly and sign in to avoid losing the documents.

Answer

Reply to the sender and ask whether the message is legitimate.

Answer

Forward the email to coworkers so they can watch for the same warning.

Question 5

An administrator needs to send sensitive configuration details to a remote branch office so only the branch manager can read them. Which cryptographic method is most appropriate?

Accepted Answer

Encrypting the file so only the intended recipient can decrypt it. Encrypting the file with the branch manager's public key ensures that only the manager, possessing the corresponding private key, can decrypt and read the sensitive configuration details. This asymmetric encryption method directly addresses the requirement of confidentiality and targeted recipient access, unlike hashing or simple labeling.

Answer

Hashing the file before sending it

Answer

Using a checksum printed in the email subject line

Answer

Appending the word confidential to the file name

Question 6

A vulnerability scan identifies four issues across a small company. Which item should the operations team remediate first?

Accepted Answer

A high-severity flaw on an internet-facing customer portal with public exploit code available. The internet-facing customer portal with a high-severity flaw and public exploit code presents the highest risk to the organization. The combination of high attack surface (exposed to the internet), high severity, and readily available exploit code means an attacker can easily compromise the system, leading to data breach, financial loss, or reputational damage. Remediation prioritization should follow risk-based principles, where likelihood and impact are both high.

Answer

A critical flaw on a disconnected training laptop that is used only in the lab

Answer

A medium-severity flaw on an internal print server that stores no sensitive data

Answer

A low-severity flaw on an archive server scheduled for retirement next month

Question 7

A help desk manager is hardening a fleet of Windows laptops. The goal is to prevent booting from untrusted external media and to ensure only approved software can run on the devices. Which two controls best address those goals? Select two.

Accepted Answer

Enable Secure Boot in firmware.. Secure Boot is a UEFI firmware feature that verifies the digital signature of the bootloader against a database of trusted signatures stored in the firmware. By enabling Secure Boot, the system will refuse to boot from any external media (e.g., USB drives) that does not have a valid, trusted signature, directly preventing unauthorized boot code from executing.

Answer

Rely only on full-disk encryption to stop unauthorized boot code.

Answer

Increase the screen-lock timeout so users are interrupted less often.

Answer

Use a stronger Wi-Fi password so malware cannot start.

Question 8

Based on the exhibit, what is the best fix so role changes take effect promptly without waiting for token expiration?

Accepted Answer

Perform authorization checks against current directory data on each privileged request.. Performing authorization checks against current directory data (e.g., via LDAP or a policy decision point) on each privileged request ensures that role changes are enforced immediately, regardless of JWT token lifetime. This decouples authentication (token validity) from authorization (current role membership), allowing dynamic updates without waiting for token expiration or reauthentication.

Answer

Increase the token lifetime so users reauthenticate less often during the workday.

Answer

Store the JWT in a browser cookie so it refreshes automatically when roles change.

Answer

Disable MFA and rely only on the role claim inside the token.

Question 9

Which two statements describe authorization? Select two.

Accepted Answer

It determines what a user can access after sign-in. Authorization determines the resources and actions a user can access after successful authentication. It enforces access control policies, such as those defined by RBAC or ACLs, ensuring users only interact with permitted data or systems. This aligns with the NIST definition of authorization as the process of granting or denying rights to a user.

Answer

It proves a user is who they claim to be

Answer

It records every packet a device sends

Answer

It replaces the need for authentication

Question 10

A security analyst detects that multiple workstations in the finance department are displaying ransom notes and files are being encrypted. The analyst has disconnected the affected workstations from the network. Which of the following should the analyst do next according to the incident response procedure?

Accepted Answer

Isolate the entire finance department network segment and preserve forensic evidence.. The immediate next step in the incident response procedure after containment (disconnecting affected workstations) is to isolate the affected network segment to prevent lateral movement and preserve forensic evidence. This aligns with the NIST SP 800-61 incident response framework, which prioritizes containment, eradication, and recovery in that order, and emphasizes evidence preservation before any remediation actions.

Answer

Reimage all affected workstations immediately to restore operations.

Answer

Run a full antivirus scan on the workstations to remove the ransomware.

Answer

Restore the encrypted files from the latest backup without further investigation.

Question 11

Employees must sign in to several SaaS applications with corporate credentials, and terminated users should lose access quickly without manual changes in each app. Which solution best meets the requirement?

Accepted Answer

Use federation for sign-on and automated provisioning and deprovisioning through an identity lifecycle process.. Federation enables single sign-on (SSO) using standards like SAML 2.0 or OIDC, allowing users to authenticate once with corporate credentials across multiple SaaS apps. Automated provisioning and deprovisioning via SCIM (System for Cross-domain Identity Management) ensures that when an employee is terminated, their access is revoked from all connected applications instantly without manual intervention, meeting the requirement for rapid access removal.

Answer

Create separate local usernames and passwords in each SaaS application.

Answer

Require users to share one department password for each SaaS platform.

Answer

Store the same password in every application vault and sync it nightly.

Question 12

After restoring a virtual file server from last night’s backup, users can browse shares, but finance reports that several spreadsheet edits from yesterday are missing. What should the administrator verify next before declaring the restore successful?

Accepted Answer

Whether the backup job used the correct restore point and included the needed transaction logs.. The missing spreadsheet edits indicate that the backup may have been taken before those changes were committed. The administrator must verify that the restore point includes the necessary transaction logs (e.g., from a VSS-aware backup or application-consistent snapshot) to recover the most recent data. Without these logs, any edits made after the last full backup are lost, so confirming the correct restore point and log inclusion is the next logical step before declaring success.

Answer

Whether the file server antivirus signatures are fully up to date.

Answer

Whether the share permissions were tightened during the restore.

Answer

Whether the virtual machine has enough CPU and memory allocated.

Question 13

Based on the exhibit, what control type is the file integrity monitor providing?

Accepted Answer

Detective control, because the tool identifies the unauthorized change and alerts the SOC.. A file integrity monitor (FIM) operates by comparing current file hashes against a known good baseline. When it detects a hash mismatch, it generates an alert to the Security Operations Center (SOC). This is a detective control because it identifies and reports the unauthorized change after it has occurred, rather than preventing or automatically correcting it.

Answer

Preventive control, because the file monitor stopped the change from occurring.

Answer

Corrective control, because the monitor automatically fixed the configuration after the change.

Answer

Directive control, because the alert tells administrators what they should review next.

Question 14

A marketing analyst asks for a spreadsheet containing customer names, email addresses, purchase history, and government ID numbers so the team can build a campaign list. What is the BEST security response?

Accepted Answer

Provide only the minimum fields required and remove the government ID numbers.. The best security response is to apply the principle of least privilege and data minimization. Government ID numbers are sensitive personally identifiable information (PII) that are not necessary for building a marketing campaign list; providing only the minimum required fields (e.g., names and email addresses) reduces the risk of exposure and complies with data protection regulations like GDPR or CCPA.

Answer

Approve the request because the data is needed for any marketing activity.

Answer

Send the full file, but ask the analyst not to store it permanently.

Answer

Classify the file as public so it can be shared more easily with the marketing team.

Question 15

Match each audit request to the best evidence artifact.
1. Auditors want proof that managers reviewed privileged access last quarter.
2. Auditors want evidence that an emergency firewall change was approved before implementation.
3. Auditors want to verify that annual security training was completed by staff.
4. Auditors want to confirm that records were deleted after the retention period expired.

Accepted Answer

Request 1: Access review records with manager sign-offs. Each audit request requires specific evidence: access reviews show manager sign-offs, change requests prove pre-approval, training records confirm completion, and deletion logs demonstrate data disposal per policy.

Answer

Request 2: Access review records with manager sign-offs

Answer

Request 4: Training completion records

Question 16

A laptop repeatedly starts with an unapproved bootloader, and the security team wants the firmware to refuse boot code that is not signed by a trusted key. Which feature should be used?

Accepted Answer

Secure Boot.. Secure Boot is a UEFI firmware feature that verifies the digital signature of bootloaders and kernel code against a database of trusted keys before allowing execution. By configuring Secure Boot to only accept boot code signed by a trusted key, the firmware will reject any unapproved bootloader, preventing unauthorized code from running during the boot process.

Answer

BitLocker full-disk encryption.

Answer

A DHCP reservation.

Answer

A local administrator password policy.

Question 17

Several company laptops were found to boot from a removable drive containing an untrusted pre-boot utility before the operating system loaded. The security team wants to prevent unsigned or tampered boot code from starting. Which control is the best fit?

Accepted Answer

Enable Secure Boot in firmware and block external boot devices where possible.. Secure Boot is a UEFI firmware feature that verifies the digital signature of boot code against a trusted database before execution. By enabling Secure Boot and blocking external boot devices, the security team ensures that only signed, trusted bootloaders and drivers can run, preventing untrusted pre-boot utilities from loading. This directly addresses the scenario where laptops boot from a removable drive containing unsigned or tampered boot code.

Answer

Turn on screen lock after ten minutes of inactivity.

Answer

Increase the password complexity policy for user accounts.

Answer

Disable Windows Defender notifications on the endpoints.

Question 18

A security analyst is reviewing authentication logs from a corporate web application. The logs show that over a span of two hours, a single external IP address attempted to log in with 500 different usernames, each using the same password 'Spring2024!'. Only a few of these attempts succeeded. Which type of attack is most likely being observed?

Accepted Answer

Password spraying attack. This is a password spraying attack because the attacker uses a single common password ('Spring2024!') against many different usernames. This technique avoids account lockout policies that typically trigger after multiple failed attempts on a single account, and the few successful logins indicate valid credentials were found.

Answer

Brute force attack

Answer

Credential stuffing attack

Answer

Dictionary attack

Question 19

An attacker calls the service desk claiming to be a traveling contractor whose phone was stolen. They know the contractor's manager name and ask for an MFA reset to a new number 'just for today.' Which control would best reduce the success of this attack?

Accepted Answer

Require a callback to a previously verified number and ticket approval before reset.. It introduces two verification factors that directly counter the social engineering vector: a callback to a previously verified number ensures the requestor is reachable at a known trusted contact point, and ticket approval creates an audit trail and requires secondary authorization. This combination prevents an attacker from simply claiming an identity and requesting a change without independent confirmation, which is the core weakness the attacker exploits.

Answer

Trust any caller who can provide a manager's name and employee ID.

Answer

Remove MFA so users are less likely to get locked out while traveling.

Answer

Use caller ID alone to confirm the person is legitimate.

Question 20

An external auditor asks for proof that firewall rule changes were reviewed and approved before being implemented during the last quarter. Which evidence is MOST appropriate to provide?

Accepted Answer

Change tickets showing requester, reviewer approval, implementation date, and rollback plan.. Change tickets provide a formal, auditable record of the entire change management process, including requester identification, reviewer approval, implementation date, and rollback plan. This directly satisfies the auditor's requirement for proof that firewall rule changes were reviewed and approved before implementation, aligning with the principle of separation of duties and change control.

Answer

A screenshot of the firewall management homepage showing that the system is online.

Answer

An email from the network team stating they remember reviewing the changes.

Answer

A list of the firewall vendor's product features from the company website.