SY0-701 Practice Exam 57 — 20 Questions

Question 1

A SaaS vendor hosts a customer relationship platform for multiple organizations. Your company wants to know which two responsibilities typically remain with the customer rather than the SaaS provider. Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assigning user roles and approving access within the tenant.. In a SaaS model, the customer retains administrative control over user identities, roles, and access permissions within their own tenant. The SaaS provider manages the underlying application and infrastructure, but the customer must configure role-based access control (RBAC) to enforce least privilege and approve access requests. This aligns with the shared responsibility model where identity and access management (IAM) at the application layer falls to the customer.

Answer

Patching the provider's underlying database engine.

Answer

Maintaining the vendor's physical data center power and cooling.

Answer

Replacing the provider's hypervisors during maintenance windows.

Question 2

A records application displays a mandatory notice before login that tells employees exactly which data types they may open, when to lock their screens, and that only assigned work may be processed. The notice is meant to shape behavior before misuse occurs, but it does not technically block any action. Which control type is this notice?

Accepted Answer

Directive control. A directive control is designed to guide or mandate behavior through policies, procedures, or notices without enforcing technical restrictions. This notice explicitly tells employees which data types they may open, when to lock screens, and that only assigned work may be processed, shaping behavior before misuse occurs without blocking any action. It aligns with the definition of a directive control as it provides rules and expectations rather than preventing or deterring actions through technical means.

Answer

Preventive control

Answer

Deterrent control

Answer

Detective control

Question 3

A development team runs multiple customer workloads in a shared Kubernetes cluster. Security wants to reduce the risk that one compromised container can read another team's data or deploy an altered image. Which three actions best improve the design? Select three.

Accepted Answer

Require signed, scanned images from an approved registry before deployment.. Requiring signed, scanned images from an approved registry ensures that only trusted, vulnerability-free images are deployed. Image signing (e.g., using Docker Content Trust or Notary) verifies the image's integrity and origin, preventing tampered images from being deployed. Scanning catches known vulnerabilities before runtime, reducing the attack surface. This directly addresses the risk of deploying an altered image.

Answer

Run each container as root so file permissions inside the container do not block apps.

Answer

Mount the host filesystem into every pod so support staff can troubleshoot more quickly.

Question 4

A vulnerability scan reports three findings: a critical remote code execution issue on an internet-facing VPN appliance with a public exploit, a high-severity local privilege escalation on an isolated lab PC, and a medium-severity outdated browser plug-in on a workstation used for training. Which finding should be remediated first?

Accepted Answer

The internet-facing VPN appliance, because it combines critical severity, exposure, and public exploit availability.. The internet-facing VPN appliance should be remediated first because it combines a critical severity rating, direct exposure to the internet, and a publicly available exploit. This creates an immediate and high-probability risk of remote code execution, which could lead to full compromise of the network perimeter. In contrast, the other findings are isolated or lower severity, making them less urgent.

Answer

The isolated lab PC, because local privilege escalation is always the highest technical severity.

Answer

The training workstation, because browser plug-ins are common entry points for attackers.

Answer

None of them, because all vulnerability findings should wait for the next planned maintenance cycle.

Question 5

A security architect is evaluating a zero trust architecture (ZTA) for a remote workforce. Which three of the following components are essential to the implementation? (Choose three.)

Accepted Answer

Encryption of all traffic, including internal east-west communications.. A policy engine is essential in zero trust architecture (ZTA) because it continuously evaluates trust based on user identity, device health, and context, dynamically granting or denying access. Microsegmentation is critical as it enforces granular access controls between workloads, preventing lateral movement even after an initial breach. Encrypting all traffic, including east-west communications, ensures data confidentiality and integrity across the network, aligning with the ZTA principle of never trusting and always verifying.

Answer

A mandatory VPN for all remote users before accessing any resource.

Answer

Implicit trust for all devices that are connected to the internal network.

Answer

A single, static firewall rule that allows all traffic from the corporate VPN IP range.

Question 6

Based on the exhibit, which cryptographic mechanism provides proof that the update came from the vendor and was not altered?

Accepted Answer

Digital signature, because only the vendor's private key can produce the verified signature.. A digital signature uses the vendor's private key to sign the update, and the customer verifies it using the vendor's public key. This asymmetric cryptographic mechanism ensures both authenticity (the update came from the vendor) and integrity (the update was not altered), as only the vendor's private key can produce a signature that validates with the corresponding public key.

Answer

Hashing, because matching SHA-256 values alone prove the file came from the vendor.

Answer

Symmetric encryption, because only the vendor and the customer share the secret key.

Answer

Salting, because adding random data makes the update file easier to trust.

Question 7

An EDR console shows `mshta.exe` launching `powershell.exe` from a user profile directory, followed by a script that never writes a new executable to disk. Minutes later, the host begins making regular outbound HTTPS connections to an unfamiliar IP address. What type of malware behavior is most likely being observed?

Accepted Answer

Fileless attack. The EDR console shows mshta.exe (a Microsoft binary for executing HTML Applications) launching PowerShell from a user profile directory, followed by a script that never writes a new executable to disk. This is classic fileless malware behavior, where the malicious payload runs entirely in memory (e.g., via PowerShell or .NET reflection) without dropping a file, making it harder for traditional signature-based antivirus to detect. The subsequent outbound HTTPS connections to an unfamiliar IP indicate command-and-control (C2) communication, consistent with a fileless attack that persists only in memory.

Answer

Ransomware

Answer

Worm

Answer

Rootkit

Question 8

A cloud support team is replacing separate logins for several internal apps. The new design must support one sign-in, reduce the chance that a stolen session remains valid too long, and let the identity team revoke access centrally after termination. Which three controls best fit? Select three.

Accepted Answer

Implement SSO through federation with the identity provider as the source of truth.. Implementing SSO through federation with the identity provider (IdP) as the source of truth allows users to sign in once and access multiple internal apps without separate logins. This design centralizes authentication, so when the identity team revokes access after termination, the IdP denies all subsequent token requests, effectively invalidating sessions across all apps. Federation typically uses SAML 2.0 or OIDC, where the IdP issues signed assertions or ID tokens that apps trust, eliminating the need for app-specific credentials.

Answer

Keep app-specific local accounts so each application can manage sessions independently.

Answer

Disable centralized logout so active sessions are never interrupted during maintenance.

Question 9

An administrator wants to add a new vendor IP range to a firewall rule in production. What is the best change-management step to reduce risk?

Accepted Answer

Test and approve the change before implementing it in production.. Change management requires testing and approval before applying changes to production systems. Adding a new vendor IP range to a firewall rule without validation could inadvertently allow malicious traffic or block legitimate traffic, leading to a security breach or service disruption. Testing in a non-production environment or using a change window ensures the rule behaves as intended and aligns with the organization's security policy.

Answer

Apply the change immediately during peak business hours.

Answer

Allow the entire vendor subnet permanently without review.

Answer

Skip documentation to speed up the rollout.

Question 10

Based on the exhibit, which indicator should the security team prioritize for endpoint detection and hunting?

The attacker rotates infrastructure frequently, but one artifact has remained consistent across recent investigations.

Accepted Answer

The unique mutex name created by the malware on infected endpoints. A mutex (mutual exclusion object) is a unique artifact created by malware to prevent multiple instances of itself from running on the same endpoint. Since the attacker rotates infrastructure frequently (IPs, domains, filenames), the consistent mutex name provides a stable indicator of compromise (IoC) that can be used for endpoint detection and hunting across different incidents. This makes it a reliable signature for identifying the same malware family or variant even when other indicators change.

Answer

The current source IP addresses hosting the payloads

Answer

The exact wording of the latest phishing email lure

Answer

The filename of the attachment used in the most recent incident

Question 11

After a phishing campaign, several employees entered credentials on a fake login page. Management wants a control that both improves user behavior and gives the security team a way to measure whether click rates are going down. Which two actions best meet that goal? Select two.

Accepted Answer

Run role-based phishing awareness training. Role-based phishing awareness training (B) directly improves user behavior by tailoring content to specific job functions, making the training more relevant and effective. Simulated phishing exercises with reporting metrics (D) provide a measurable way for the security team to track click rates over time, enabling data-driven assessment of improvement. Together, they address both behavioral change and quantifiable measurement.

Answer

Send a reminder email once a year and stop there

Answer

Disable all external email for every employee

Answer

Tell users to ignore suspicious messages unless IT calls first

Question 12

An organization wants to reduce the risk of malware infections from removable media. Which three of the following controls should be implemented? (Choose three.)

Accepted Answer

Disabling AutoRun and AutoPlay features. Disabling AutoRun and AutoPlay features prevents malicious code from executing automatically when removable media is inserted, which is a common infection vector. Using group policy to block execution from removable media stops any executable files from running, even if manually launched. Scanning all removable media with antivirus software upon insertion detects and quarantines known malware before it can interact with the system.

Answer

Enforcing a policy of full disk encryption on all removable drives

Answer

Installing a host-based intrusion detection system on every workstation

Answer

Requiring all removable media to be formatted as NTFS

Question 13

A security architect is designing a solution to process highly sensitive financial transactions in a shared cloud environment. The architect needs to ensure that the processor and memory used to handle transaction data are isolated from the host operating system and other virtual machines, even if the hypervisor is compromised. Which technology is specifically designed to provide this level of isolation for code and data during runtime?

Accepted Answer

Secure enclave (e.g., Intel SGX). Secure enclave technology, such as Intel SGX, provides hardware-enforced isolation by creating trusted execution environments (TEEs) within the CPU. Code and data inside an enclave are encrypted in memory and decrypted only within the processor, ensuring that even a compromised hypervisor or host OS cannot access the transaction data during runtime. This meets the requirement for processor and memory isolation in a shared cloud environment.

Answer

Trusted Platform Module (TPM)

Answer

Hardware Security Module (HSM)

Answer

UEFI Secure Boot

Question 14

A small company is deploying a public web application with a front-end server, an application server, and a database. Which two design choices best reduce exposure of the backend systems? Select two.

Accepted Answer

Place the web server in a DMZ that is reachable from the internet.. Placing the web server in a DMZ (demilitarized zone) allows it to be reachable from the internet while isolating it from the internal network. This design ensures that even if the web server is compromised, an attacker cannot directly access the application server or database, as traffic must pass through a firewall with strict rules. The DMZ acts as a buffer zone, reducing the attack surface of backend systems.

Answer

Put the database on the same subnet as the web server for faster communication.

Answer

Allow every tier to communicate freely to simplify troubleshooting.

Answer

Use one flat VLAN for all three servers and rely on strong passwords.

Question 15

A security architect proposes adding endpoint protection, network segmentation, multifactor authentication, email filtering, and immutable backups so that one failed safeguard does not expose the entire organization. What security strategy is being described?

Accepted Answer

Defense in depth. Defense in depth is a layered security strategy where multiple, independent controls (endpoint protection, network segmentation, MFA, email filtering, immutable backups) are deployed so that if one safeguard fails, others continue to protect the organization. This approach ensures no single point of failure can compromise the entire environment, aligning directly with the scenario described.

Answer

Least privilege

Answer

Need-to-know

Answer

Zero trust

Question 16

A file server begins encrypting documents, and the SOC confirms the activity is malicious. Which incident response step should happen first to limit further damage?

Accepted Answer

Containment. Containment is the correct first step because it isolates the compromised file server from the network, preventing the ransomware from encrypting additional shares or spreading laterally. The SMB protocol (port 445) used for file sharing would be blocked at the switch or firewall, halting further encryption of documents. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Answer

Lessons learned

Answer

Recovery

Answer

Post-incident reporting

Question 17

A business unit keeps a low-priority legacy tool but adds extra monitoring and patching. The company also buys cyber insurance to reduce the financial effect of a loss. Which two risk treatment strategies are being used? Select two.

Accepted Answer

Mitigation. Mitigation (B) is correct because the business unit keeps the legacy tool but reduces its risk exposure by adding extra monitoring and patching, which are compensating controls that lower the likelihood or impact of a loss. Transfer (D) is correct because purchasing cyber insurance shifts the financial consequences of a potential loss to the insurer, which is the defining characteristic of risk transfer. Acceptance (A) does not apply because the organization is actively applying controls rather than simply acknowledging and retaining the risk without action. Avoidance (C) does not apply because the legacy tool is still kept in use rather than being eliminated or discontinued. Deterrent (E) is not a distinct risk treatment strategy here; monitoring and patching are preventive/detective controls supporting mitigation, not a separate deterrent strategy.

Answer

Acceptance

Answer

Avoidance

Answer

Deterrent

Question 18

A help desk technician receives an alert that an unmanaged laptop was plugged into a conference room network jack and was automatically placed into a restricted network segment until it passed a security check. Which control is responsible for that behavior?

Accepted Answer

Network access control (NAC).. Network Access Control (NAC) is the correct answer because it is specifically designed to enforce security policies on devices attempting to connect to a network. When an unmanaged laptop is plugged into a network jack, NAC evaluates the device's compliance (e.g., antivirus status, patch level) and, if it fails, automatically places it into a restricted segment (e.g., a quarantine VLAN) until it passes a security check. This behavior is a core function of NAC solutions like Cisco ISE or Aruba ClearPass, which use 802.1X or MAC authentication bypass to dynamically assign VLANs based on device posture.

Answer

Data loss prevention (DLP).

Answer

Intrusion prevention system (IPS).

Answer

Sandboxing gateway.

Question 19

A records room has repeated tailgating after hours and occasional door propping during deliveries. Management wants one control that prevents follow-on entry and another that immediately alerts security if the door is forced open or left ajar. Which two controls best meet the need? Select two.

Accepted Answer

Install a mantrap at the room entrance.. A mantrap (option A) prevents tailgating by requiring one door to close before the next can open, effectively stopping follow-on entry. A door position sensor (option B) detects when the door is forced open or left ajar and triggers an immediate alert to security via an alarm or SIEM integration, meeting the requirement for real-time notification.

Answer

Place a larger warning sign on the wall beside the door.

Answer

Mount a visible camera over the door only.

Answer

Replace the mechanical lock with the same type of lock and no monitoring.

Question 20

A user's laptop starts renaming many documents, and a ransom note appears on the desktop. What is the best immediate action for the help desk to recommend?

Accepted Answer

Disconnect the laptop from the network to contain the infection.. Disconnecting the laptop from the network immediately stops the ransomware from communicating with its command-and-control (C2) server, preventing further encryption of network shares and lateral movement. This containment step is critical before any remediation, as it isolates the threat and preserves evidence for forensic analysis.

Answer

Shut down the laptop immediately and leave it on the desk.

Answer

Delete the ransom note and continue working until the next reboot.

Answer

Install a new browser extension to block the attacker.