SY0-701 Practice Exam 56 — 20 Questions

Question 1

A security analyst is reviewing the source code of a custom network service written in C. The service allocates a 256-byte buffer and uses the strcpy() function to copy incoming data into that buffer without verifying the length of the input. If an attacker sends a specially crafted payload that exceeds 256 bytes, which security control would be most effective at detecting and preventing the resulting exploitation at runtime?

Accepted Answer

Stack canaries. Stack canaries are the most effective runtime control for detecting and preventing buffer overflow exploitation. When a buffer overflow overwrites the stack, it corrupts a canary value placed between the buffer and the return address; before the function returns, the canary is checked, and if altered, the program terminates immediately, preventing arbitrary code execution.

Answer

Transport Layer Security (TLS)

Answer

Code signing

Answer

Data Execution Prevention (DEP)

Question 2

Users on a branch VLAN intermittently reach a fake login page even though DNS records have not changed. A packet capture shows the default gateway MAC address changing every 60 seconds, and the switch logs list repeated unsolicited ARP replies from one workstation. Which attack is most likely?

Accepted Answer

ARP poisoning, because forged ARP replies are associating the gateway IP with the attacker's MAC address.. The repeated unsolicited ARP replies from one workstation, combined with the default gateway MAC address changing every 60 seconds, directly indicate an ARP poisoning attack. The attacker is sending forged ARP replies to associate the gateway IP with its own MAC address, causing traffic destined for the gateway to be intercepted. This allows the attacker to redirect users to a fake login page without altering DNS records.

Answer

DNS poisoning, because name resolution is directing users to the wrong server.

Answer

Replay attack, because previously captured traffic is being resent to the network.

Answer

Denial of service, because the branch users cannot reliably reach websites.

Question 3

A help desk technician receives a call from someone claiming to be a new contractor whose MFA app failed during travel. The caller knows the company org chart, names the technician's supervisor, and says the technician should use a callback number included in a text message they just sent. What is the safest first action?

Accepted Answer

End the call and verify the request through a published help desk number or ticketing system.. Option C is correct because the safest first action when receiving an unsolicited call requesting privileged actions (like MFA reset) is to independently verify the request through official channels. The caller's knowledge of internal details (org chart, supervisor name) and the request to use a callback number from a text message are classic social engineering red flags, as the callback number could be attacker-controlled. Hanging up and calling back via a published help desk number ensures the request is legitimate and prevents MFA bypass or account takeover.

Answer

Reset MFA immediately, since the caller has provided enough internal details to seem credible.

Answer

Ask the caller to read a one-time code aloud so the technician can confirm their identity.

Answer

Approve the request if the caller can name the supervisor and the contractor's project team.

Question 4

Users on the internal Wi-Fi report that the finance portal suddenly resolves to a different IP address, and the browser shows a fake login page that closely matches the real site. The DNS resolver cache on the network also contains unexpected entries for that host name. What attack is most likely?

Accepted Answer

DNS poisoning, because the attacker has corrupted name resolution so users are sent to a malicious destination.. B is correct because DNS poisoning (also known as DNS cache poisoning) directly corrupts the name resolution process, causing the finance portal's hostname to resolve to a malicious IP address. The presence of unexpected DNS resolver cache entries for that hostname confirms that the attack targeted the DNS infrastructure, not the ARP table or network availability.

Answer

ARP spoofing, because the attacker is changing the MAC address used on the local network.

Answer

Port scanning, because the attacker is probing internal services for open ports.

Answer

Denial-of-service, because the attacker is overwhelming the portal with traffic.

Question 5

Users on a wired subnet report intermittent outages when reaching an internal application. A packet capture shows the default gateway IP address repeatedly mapped to a different workstation MAC address, and traffic is being forwarded through that workstation. What attack is most likely occurring?

Accepted Answer

ARP spoofing, because false Layer 2 address mappings are redirecting traffic.. B is correct because ARP spoofing (also known as ARP poisoning) involves an attacker sending forged ARP messages over a local area network. This results in the attacker's MAC address being associated with the IP address of the default gateway, causing traffic destined for the gateway to be forwarded to the attacker's workstation instead. The packet capture evidence of the default gateway IP repeatedly mapped to a different workstation MAC address is the classic signature of this attack.

Answer

DNS poisoning, because the hostname is resolving to the wrong server.

Answer

Replay attack, because packets are being resent to the gateway.

Answer

Rogue DHCP service, because clients are losing access to the default gateway.

Question 6

Which two are detective controls? Select two.

Accepted Answer

Security camera monitoring an entrance. Security camera monitoring an entrance is a detective control because it records events as they occur, providing evidence after the fact. It does not prevent unauthorized access but instead detects and documents incidents for review. This aligns with the detective control function of identifying and alerting on security events.

Answer

Locked server rack

Answer

Employee security awareness training

Answer

Disk encryption on a laptop

Question 7

Which two documents are typically mandatory and organization-wide rather than optional guidance? Select two.

Accepted Answer

Security policy. Security policies are mandatory, high-level documents that define management's intent and direction for security, establishing rules that all employees must follow. They are organization-wide and enforceable, unlike guidelines which are optional. Standards are also mandatory and specify uniform technical controls or configurations (e.g., requiring AES-256 encryption) that must be implemented across the organization to comply with the security policy.

Answer

Guideline

Answer

Personal preference note

Answer

Architecture diagram

Question 8

Which two uses are appropriate for encryption in transit? Select two.

Accepted Answer

Protecting web login traffic with TLS. TLS (Transport Layer Security) encrypts web login traffic between a client and server, protecting credentials and session data from eavesdropping or tampering during transmission. This is a classic use of encryption in transit, as TLS operates at the transport layer to secure data moving across a network.

Answer

Storing a password as a hash

Answer

Comparing file integrity with a checksum

Answer

Sharing a symmetric key by email

Question 9

After a user installs a free PDF converter from an unofficial website, the laptop starts making periodic outbound connections to an unknown server, the browser homepage changes, and a new program launches at logon. What is the most likely malware type?

Accepted Answer

Trojan. The user downloaded and installed a program that appears legitimate (a PDF converter) but performs malicious actions: making outbound connections, changing browser settings, and adding a startup program. This is the classic behavior of a Trojan horse, which disguises itself as useful software to trick users into installing it, then executes hidden malicious functions. Unlike worms, Trojans do not self-replicate, and unlike ransomware or rootkits, the described symptoms focus on unauthorized remote access and persistence rather than file encryption or deep OS concealment.

Answer

Worm

Answer

Rootkit

Answer

Ransomware

Question 10

Based on the exhibit, which social engineering attack is most likely?

Accepted Answer

Vishing. The exhibit shows a voicemail message instructing the recipient to call a specific phone number to verify account activity. This is a classic vishing (voice phishing) attack, where the attacker uses a phone call or voicemail to trick the victim into providing sensitive information or calling a fraudulent number. Unlike phishing, which uses email or text, vishing relies on voice communication channels.

Answer

Phishing

Answer

Baiting

Answer

Pretexting

Question 11

Based on the exhibit, what is the most likely explanation for the suspicious workstation activity?

Accepted Answer

Fileless attack. The exhibit shows a PowerShell command that downloads and executes a payload directly in memory without writing to disk. This is a classic indicator of a fileless attack, where malicious code runs in volatile memory (e.g., via PowerShell, WMI, or macros) to evade traditional file-based antivirus detection. The use of `Invoke-Expression` (IEX) with a remote URL confirms the attack vector is fileless.

Answer

Ransomware campaign

Answer

Worm propagation

Answer

Rootkit persistence

Question 12

A security analyst receives an alert from the intrusion detection system indicating that a workstation in the finance department has established an outbound connection to a known malicious IP address using an encrypted protocol. The analyst verifies the alert and checks the user's activity logs, which show no legitimate business reason for the connection. According to the incident response process, what should the analyst do NEXT?

Accepted Answer

Isolate the workstation from the network to contain the threat.. According to the NIST SP 800-61 incident response process, containment is the immediate priority after verification to prevent further damage or data exfiltration. Since the workstation has an active encrypted outbound connection to a known malicious IP with no legitimate business reason, isolating the network interface (e.g., disabling the port, blocking the MAC address, or unplugging the cable) stops the threat from communicating while preserving the system state for later analysis. This aligns with the containment phase, which must precede eradication or full forensic analysis.

Answer

Begin the eradication phase by immediately reimaging the workstation.

Answer

Conduct a full forensic analysis of the workstation's hard drive.

Answer

Update the firewall rule to block all outbound traffic to the malicious IP.

Question 13

EDR flags encoded PowerShell launched by a spreadsheet application, followed by an attempt to access LSASS and outbound HTTPS traffic to a rare domain. What should the analyst do first from the EDR console?

Accepted Answer

Isolate the endpoint from the network while keeping it powered on. Option B is correct because isolating the endpoint from the network while keeping it powered on preserves volatile evidence (e.g., running processes, memory contents) and prevents the attacker from exfiltrating data or establishing further C2 communication. The EDR console allows immediate network isolation without losing the ability to perform live forensics or memory analysis. This aligns with the incident response priority of containment before eradication or recovery.

Answer

Reboot the endpoint to terminate the suspicious processes

Answer

Uninstall the spreadsheet application immediately

Answer

Block the rare domain and close the alert

Question 14

Field staff use company-owned tablets that also run approved personal apps. Security wants corporate email and documents separated from personal data, with the ability to wipe only the work data if a device is lost. What is the best control?

Accepted Answer

Use a work profile or container managed by a mobile device management platform.. A work profile or container managed by a mobile device management (MDM) platform creates a separate, encrypted partition on the device for corporate data. This allows the organization to enforce policies and perform a selective wipe of only the work container without affecting personal apps or data, meeting the requirement for separation and targeted remote wipe.

Answer

Disable all personal apps by removing internet access from the tablet.

Answer

Install only a screen lock and require a longer PIN for the tablet.

Answer

Use a USB cable lock so the tablet cannot be physically moved.

Question 15

Based on the exhibit, what type of malware is most likely present?

Accepted Answer

Logic bomb. The exhibit shows a script that checks for a specific employee name and, if the condition is met, deletes critical system files. This is a classic logic bomb: malicious code embedded in a legitimate program that executes when predefined conditions (e.g., a specific user, date, or event) are satisfied. Logic bombs do not self-replicate or continuously spy; they lie dormant until triggered.

Answer

Worm

Answer

Spyware

Answer

Rootkit

Question 16

A laptop is suspected of being used in a malware incident. It is still powered on and connected to Wi-Fi. What should the responder do before shutting it down?

Accepted Answer

Capture volatile evidence such as running processes and memory contents.. Option B is correct because volatile evidence, such as running processes, network connections, and memory contents, is lost when the system is powered off. Capturing this data first preserves critical forensic artifacts that can reveal the malware's behavior, persistence mechanisms, and indicators of compromise (IOCs). In a live incident, the responder must follow the order of volatility (RFC 3227) to collect the most ephemeral data before it disappears.

Answer

Install endpoint protection updates on the laptop right away.

Answer

Delete suspicious files so the malware can no longer spread.

Answer

Reboot the laptop immediately to clear the suspected malware.

Question 17

An employee reports a ransomware note on a finance laptop. The laptop is still powered on, connected to Wi-Fi, and the user says they were just working in a spreadsheet. Management wants the fastest safe response that also preserves evidence. What should the responder do first?

Accepted Answer

Isolate the laptop from the network while keeping it powered on for volatile evidence collection.. Option B is correct because the immediate priority is to contain the ransomware while preserving volatile evidence (e.g., memory contents, running processes, network connections) that could be critical for forensic analysis. Powering off the laptop (Option A) would destroy volatile data and may allow the ransomware to persist or trigger additional encryption on reboot. Isolating the network connection stops the ransomware from communicating with its command-and-control server or spreading laterally, while keeping the system powered on allows a responder to capture memory with tools like FTK Imager or LiME before performing a controlled shutdown.

Answer

Shut the laptop down immediately to prevent further encryption activity.

Answer

Ask the user to close all open applications and log off normally.

Answer

Start deleting suspicious files to reduce the impact of the ransomware.

Question 18

A security analyst is investigating a potential data exfiltration incident. Which three of the following indicators are most commonly associated with a data exfiltration attack? (Choose three.)

Accepted Answer

Unusual outbound network traffic, especially during non-business hours. Unusual outbound network traffic, especially during non-business hours, is a classic indicator of data exfiltration because attackers often schedule transfers when monitoring is less active. Large volumes of data being transferred to an external IP address directly suggests that sensitive data is being moved outside the organization. A sudden increase in DNS queries to a known malicious domain can indicate DNS tunneling, where data is encoded in DNS requests to bypass traditional network controls.

Answer

An employee receiving a phishing email with a malicious attachment

Answer

Multiple failed login attempts from a single user account

Answer

A spike in CPU usage on a database server

Question 19

A security manager is designing a security program to align with business goals. Which three of the following are essential components of a security program that directly support governance and oversight? (Choose three.)

Accepted Answer

Conducting periodic risk assessments to inform decision-making. A security steering committee with executive sponsorship ensures that security initiatives have top-down support and alignment with business objectives, which is a core governance function. Developing and maintaining security policies, standards, and procedures provides the formal framework for enforcing security controls and ensuring compliance, directly supporting oversight. Conducting periodic risk assessments informs decision-making by identifying and prioritizing risks, which is essential for governance and resource allocation.

Answer

Installing endpoint detection and response agents on all workstations

Answer

Deploying a next-generation firewall to segment the network

Answer

Implementing a vulnerability scanning tool across all endpoints

Question 20

An organization is implementing a third-party vendor risk management program. Which three of the following should be included as key activities to maintain oversight of vendor security? (Choose three.)

Accepted Answer

Performing due diligence assessments before onboarding new vendors. Performing due diligence assessments before onboarding new vendors is correct because it allows the organization to evaluate a vendor's security posture, compliance, and risk level before any contractual relationship begins. This proactive step helps identify potential vulnerabilities or gaps that could expose the organization to third-party risks, aligning with the NIST SP 800-161 supply chain risk management framework.

Answer

Automatically renewing vendor contracts unless a security incident occurs

Answer

Providing vendor staff with direct access to internal source code repositories

Answer

Requiring all vendors to use the same password manager as the organization