SY0-701 Practice Exam 56 — 20 Questions

Question 1

After completing a vulnerability scan, a security analyst discovers that a legacy customer-facing application running on an unsupported operating system contains a critical remote code execution vulnerability. The application is essential to daily operations and cannot be patched or upgraded in the near term. Management has approved the purchase of a hardware-based network firewall that will be placed in front of the application to restrict inbound traffic to only authorized source IP addresses and port numbers. Which risk management strategy does this action primarily represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Risk mitigation. The security team is implementing a hardware-based network firewall to restrict inbound traffic to only authorized source IP addresses and port numbers. This directly reduces the likelihood of exploitation by limiting the attack surface, which is the essence of risk mitigation — applying controls to reduce the risk to an acceptable level. Patching or upgrading is not feasible, so compensating controls like network segmentation and access control lists (ACLs) are used to mitigate the vulnerability.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transference

Question 2

A finance manager can view only the reports needed for monthly budgeting and cannot see payroll details. Which principle is being applied?

Accepted Answer

Need-to-know, because access is limited to information required for the job.. The principle of need-to-know restricts access to only the information necessary for an individual to perform their job duties. In this scenario, the finance manager can view only monthly budgeting reports and is explicitly blocked from payroll details, which aligns directly with need-to-know. This is typically enforced through access control lists (ACLs) or role-based access control (RBAC) policies that limit data visibility based on job function.

Answer

Zero trust, because the manager uses a password to sign in.

Answer

Separation of duties, because the manager is part of finance.

Answer

Defense in depth, because only one report system is being used.

Question 3

After a server rebuild, an administrator notices that Remote Desktop, SMBv1, and Print Spooler are still enabled on a Windows file server even though the server only stores department documents. The security team also wants to know if future changes drift away from the approved build. What should be implemented?

Accepted Answer

Apply the approved secure baseline and enable configuration drift monitoring against it.. Applying an approved secure baseline (e.g., via Group Policy or Security Compliance Toolkit) ensures that unnecessary services like Remote Desktop, SMBv1, and Print Spooler are explicitly disabled. Enabling configuration drift monitoring (e.g., using Azure Policy, DSC, or a SIEM) allows the security team to detect and alert on any unauthorized changes that deviate from the baseline, addressing both the immediate risk and the long-term compliance requirement.

Answer

Keep the server as-is and rely on the antivirus console to stop misuse.

Answer

Move the server into a different VLAN and leave the operating system settings unchanged.

Answer

Schedule a monthly reboot to clear temporary settings and reduce attack surface.

Question 4

Employees authenticate once to a corporate portal and then open the help desk, payroll, and documentation apps without logging in again. The apps rely on tokens from the company's identity provider instead of storing separate passwords. What is being implemented?

Accepted Answer

Federated single sign-on using the corporate identity provider.. The scenario describes single sign-on (SSO) where the corporate identity provider (IdP) issues tokens (e.g., SAML assertions, OIDC ID tokens) after initial authentication. The help desk, payroll, and documentation apps are configured as service providers that trust the IdP, so they accept the token instead of requiring separate credentials. This is federated SSO because the apps rely on a central identity provider rather than sharing password databases or synchronizing passwords.

Answer

Password synchronization between every application in the suite.

Answer

Shared guest accounts for all employees on the portal.

Answer

Split tunneling through a VPN to speed up application access.

Question 5

A help desk team needs to reset passwords on servers during incidents, but they should not keep standing administrator rights all day. Which two controls best support this requirement? Select two.

Accepted Answer

Use privileged access management (PAM) to control and audit elevated access.. Privileged Access Management (PAM) solutions enforce just-in-time (JIT) elevation, time-bound access, and session auditing. This allows the help desk team to obtain administrator rights only when needed for incident response, eliminating the need for standing admin rights while maintaining full audit trails.

Answer

Share one permanent domain administrator account with the whole team.

Answer

Use a regular user account and disable all authentication logging.

Answer

Give every help desk user full access all the time so work is faster.

Question 6

An employee receives an email that appears to come from the company's payroll provider. It says payroll documents will be deleted today unless the employee signs in through the included link. What is the best first action?

Accepted Answer

Report the message and verify the request using a trusted contact method.. The email exhibits classic signs of a phishing attack—urgency, a threat of data loss, and a link to a fake login page. The best first action is to report the suspicious message to the security team and independently verify the request by contacting the payroll provider through a trusted channel (e.g., a known phone number or a previously bookmarked URL). This prevents credential theft and potential account compromise.

Answer

Click the link quickly and sign in to avoid losing the documents.

Answer

Reply to the sender and ask whether the message is legitimate.

Answer

Forward the email to coworkers so they can watch for the same warning.

Question 7

An administrator needs to send sensitive configuration details to a remote branch office so only the branch manager can read them. Which cryptographic method is most appropriate?

Accepted Answer

Encrypting the file so only the intended recipient can decrypt it. Encrypting the file with the branch manager's public key ensures that only the manager, possessing the corresponding private key, can decrypt and read the sensitive configuration details. This asymmetric encryption method directly addresses the requirement of confidentiality and targeted recipient access, unlike hashing or simple labeling.

Answer

Hashing the file before sending it

Answer

Using a checksum printed in the email subject line

Answer

Appending the word confidential to the file name

Question 8

A vulnerability scan identifies four issues across a small company. Which item should the operations team remediate first?

Accepted Answer

A high-severity flaw on an internet-facing customer portal with public exploit code available. The internet-facing customer portal with a high-severity flaw and public exploit code presents the highest risk to the organization. The combination of high attack surface (exposed to the internet), high severity, and readily available exploit code means an attacker can easily compromise the system, leading to data breach, financial loss, or reputational damage. Remediation prioritization should follow risk-based principles, where likelihood and impact are both high.

Answer

A critical flaw on a disconnected training laptop that is used only in the lab

Answer

A medium-severity flaw on an internal print server that stores no sensitive data

Answer

A low-severity flaw on an archive server scheduled for retirement next month

Question 9

An HR analyst must send a compensation spreadsheet to an external auditor. The auditor only needs employee names, departments, and salary totals; Social Security numbers and bank account fields are not required. What should the analyst do before sharing the file?

Accepted Answer

Remove or redact the fields the auditor does not need, then share only the minimum necessary data.. The principle of data minimization requires sharing only the information necessary for the task. By removing or redacting the Social Security numbers and bank account fields, the analyst reduces the risk of exposing sensitive personally identifiable information (PII) to the external auditor, aligning with least privilege and need-to-know principles.

Answer

Encrypt the spreadsheet and send the full file as-is to preserve all records.

Answer

Store the file in a shared cloud folder and grant the auditor read-only access.

Answer

Convert the file to PDF so the sensitive information is harder to edit.

Question 10

A help desk manager is hardening a fleet of Windows laptops. The goal is to prevent booting from untrusted external media and to ensure only approved software can run on the devices. Which two controls best address those goals? Select two.

Accepted Answer

Enable Secure Boot in firmware.. Secure Boot is a UEFI firmware feature that verifies the digital signature of the bootloader against a database of trusted signatures stored in the firmware. By enabling Secure Boot, the system will refuse to boot from any external media (e.g., USB drives) that does not have a valid, trusted signature, directly preventing unauthorized boot code from executing.

Answer

Rely only on full-disk encryption to stop unauthorized boot code.

Answer

Increase the screen-lock timeout so users are interrupted less often.

Answer

Use a stronger Wi-Fi password so malware cannot start.

Question 11

Based on the exhibit, what is the best fix so role changes take effect promptly without waiting for token expiration?

Accepted Answer

Perform authorization checks against current directory data on each privileged request.. Performing authorization checks against current directory data (e.g., via LDAP or a policy decision point) on each privileged request ensures that role changes are enforced immediately, regardless of JWT token lifetime. This decouples authentication (token validity) from authorization (current role membership), allowing dynamic updates without waiting for token expiration or reauthentication.

Answer

Increase the token lifetime so users reauthenticate less often during the workday.

Answer

Store the JWT in a browser cookie so it refreshes automatically when roles change.

Answer

Disable MFA and rely only on the role claim inside the token.

Question 12

Which two statements describe authorization? Select two.

Accepted Answer

It determines what a user can access after sign-in. Authorization determines the resources and actions a user can access after successful authentication. It enforces access control policies, such as those defined by RBAC or ACLs, ensuring users only interact with permitted data or systems. This aligns with the NIST definition of authorization as the process of granting or denying rights to a user.

Answer

It proves a user is who they claim to be

Answer

It records every packet a device sends

Answer

It replaces the need for authentication

Question 13

After restoring a virtual file server from last night’s backup, users can browse shares, but finance reports that several spreadsheet edits from yesterday are missing. What should the administrator verify next before declaring the restore successful?

Accepted Answer

Whether the backup job used the correct restore point and included the needed transaction logs.. The missing spreadsheet edits indicate that the backup may have been taken before those changes were committed. The administrator must verify that the restore point includes the necessary transaction logs (e.g., from a VSS-aware backup or application-consistent snapshot) to recover the most recent data. Without these logs, any edits made after the last full backup are lost, so confirming the correct restore point and log inclusion is the next logical step before declaring success.

Answer

Whether the file server antivirus signatures are fully up to date.

Answer

Whether the share permissions were tightened during the restore.

Answer

Whether the virtual machine has enough CPU and memory allocated.

Question 14

Based on the exhibit, what control type is the file integrity monitor providing?

Accepted Answer

Detective control, because the tool identifies the unauthorized change and alerts the SOC.. A file integrity monitor (FIM) operates by comparing current file hashes against a known good baseline. When it detects a hash mismatch, it generates an alert to the Security Operations Center (SOC). This is a detective control because it identifies and reports the unauthorized change after it has occurred, rather than preventing or automatically correcting it.

Answer

Preventive control, because the file monitor stopped the change from occurring.

Answer

Corrective control, because the monitor automatically fixed the configuration after the change.

Answer

Directive control, because the alert tells administrators what they should review next.

Question 15

A marketing analyst asks for a spreadsheet containing customer names, email addresses, purchase history, and government ID numbers so the team can build a campaign list. What is the BEST security response?

Accepted Answer

Provide only the minimum fields required and remove the government ID numbers.. The best security response is to apply the principle of least privilege and data minimization. Government ID numbers are sensitive personally identifiable information (PII) that are not necessary for building a marketing campaign list; providing only the minimum required fields (e.g., names and email addresses) reduces the risk of exposure and complies with data protection regulations like GDPR or CCPA.

Answer

Approve the request because the data is needed for any marketing activity.

Answer

Send the full file, but ask the analyst not to store it permanently.

Answer

Classify the file as public so it can be shared more easily with the marketing team.

Question 16

Match each audit request to the best evidence artifact.
1. Auditors want proof that managers reviewed privileged access last quarter.
2. Auditors want evidence that an emergency firewall change was approved before implementation.
3. Auditors want to verify that annual security training was completed by staff.
4. Auditors want to confirm that records were deleted after the retention period expired.

Accepted Answer

Request 1: Access review records with manager sign-offs. Each audit request requires specific evidence: access reviews show manager sign-offs, change requests prove pre-approval, training records confirm completion, and deletion logs demonstrate data disposal per policy.

Answer

Request 2: Access review records with manager sign-offs

Answer

Request 4: Training completion records

Question 17

A laptop repeatedly starts with an unapproved bootloader, and the security team wants the firmware to refuse boot code that is not signed by a trusted key. Which feature should be used?

Accepted Answer

Secure Boot.. Secure Boot is a UEFI firmware feature that verifies the digital signature of bootloaders and kernel code against a database of trusted keys before allowing execution. By configuring Secure Boot to only accept boot code signed by a trusted key, the firmware will reject any unapproved bootloader, preventing unauthorized code from running during the boot process.

Answer

BitLocker full-disk encryption.

Answer

A DHCP reservation.

Answer

A local administrator password policy.

Question 18

Several company laptops were found to boot from a removable drive containing an untrusted pre-boot utility before the operating system loaded. The security team wants to prevent unsigned or tampered boot code from starting. Which control is the best fit?

Accepted Answer

Enable Secure Boot in firmware and block external boot devices where possible.. Secure Boot is a UEFI firmware feature that verifies the digital signature of boot code against a trusted database before execution. By enabling Secure Boot and blocking external boot devices, the security team ensures that only signed, trusted bootloaders and drivers can run, preventing untrusted pre-boot utilities from loading. This directly addresses the scenario where laptops boot from a removable drive containing unsigned or tampered boot code.

Answer

Turn on screen lock after ten minutes of inactivity.

Answer

Increase the password complexity policy for user accounts.

Answer

Disable Windows Defender notifications on the endpoints.

Question 19

An attacker calls the service desk claiming to be a traveling contractor whose phone was stolen. They know the contractor's manager name and ask for an MFA reset to a new number 'just for today.' Which control would best reduce the success of this attack?

Accepted Answer

Require a callback to a previously verified number and ticket approval before reset.. It introduces two verification factors that directly counter the social engineering vector: a callback to a previously verified number ensures the requestor is reachable at a known trusted contact point, and ticket approval creates an audit trail and requires secondary authorization. This combination prevents an attacker from simply claiming an identity and requesting a change without independent confirmation, which is the core weakness the attacker exploits.

Answer

Trust any caller who can provide a manager's name and employee ID.

Answer

Remove MFA so users are less likely to get locked out while traveling.

Answer

Use caller ID alone to confirm the person is legitimate.

Question 20

An external auditor asks for proof that firewall rule changes were reviewed and approved before being implemented during the last quarter. Which evidence is MOST appropriate to provide?

Accepted Answer

Change tickets showing requester, reviewer approval, implementation date, and rollback plan.. Change tickets provide a formal, auditable record of the entire change management process, including requester identification, reviewer approval, implementation date, and rollback plan. This directly satisfies the auditor's requirement for proof that firewall rule changes were reviewed and approved before implementation, aligning with the principle of separation of duties and change control.

Answer

A screenshot of the firewall management homepage showing that the system is online.

Answer

An email from the network team stating they remember reviewing the changes.

Answer

A list of the firewall vendor's product features from the company website.