SY0-701 Practice Exam 57 — 20 Questions

Question 1

Field staff use company-owned tablets that also run approved personal apps. Security needs business data isolated from personal data, the ability to wipe only corporate content, and enforcement of screen lock and encryption. Which two controls best fit? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enroll the tablets in MDM and enforce encryption and a screen-lock PIN.. Mobile Device Management (MDM) enforces security policies like encryption and screen-lock PIN across the device, meeting the requirements for data protection. Option B is correct because a managed work profile or container (e.g., Android Work Profile or iOS Managed Open In) isolates corporate apps and data from personal apps, allowing selective wipe of corporate content without affecting personal data.

Answer

Allow rooted devices if the antivirus app is current.

Answer

Place all apps in one shared profile and use a single passcode for every user.

Answer

Disable remote wipe so personal photos are never affected.

Question 2

A branch office loses power briefly several times each month. Which control best helps keep network equipment running long enough for an orderly shutdown?

Accepted Answer

A UPS. A UPS (Uninterruptible Power Supply) provides battery backup power to network equipment during a power outage, allowing enough time for an orderly shutdown to prevent data corruption or hardware damage. Unlike surge protectors, a UPS actively supplies clean, regulated power from its batteries when the mains fail, making it the correct control for this scenario.

Answer

A badge reader

Answer

A locked filing cabinet

Answer

A fire extinguisher

Question 3

A project team needs to use a temporary file-sharing service for two weeks because the approved platform is under maintenance. The security manager wants the exception to be reviewed, time-limited, and documented with the business reason. Which governance document should be created?

Accepted Answer

An exception request, because it records a deviation from the normal security requirement.. An exception request is the formal governance document used to record, review, and time-limit a deviation from the organization's security baseline. In this scenario, the temporary use of an unapproved file-sharing service for two weeks requires documented authorization, including the business reason, to ensure the risk is accepted and tracked until the approved platform returns.

Answer

A guideline, because it provides optional best practices for users to follow.

Answer

A standard, because it defines the mandatory company-wide rule for file sharing.

Answer

A procedure, because it gives step-by-step instructions for employees to follow.

Question 4

A SaaS vendor hosts a customer relationship platform for multiple organizations. Your company wants to know which two responsibilities typically remain with the customer rather than the SaaS provider. Select two.

Accepted Answer

Assigning user roles and approving access within the tenant.. In a SaaS model, the customer retains administrative control over user identities, roles, and access permissions within their own tenant. The SaaS provider manages the underlying application and infrastructure, but the customer must configure role-based access control (RBAC) to enforce least privilege and approve access requests. This aligns with the shared responsibility model where identity and access management (IAM) at the application layer falls to the customer.

Answer

Patching the provider's underlying database engine.

Answer

Maintaining the vendor's physical data center power and cooling.

Answer

Replacing the provider's hypervisors during maintenance windows.

Question 5

A records application displays a mandatory notice before login that tells employees exactly which data types they may open, when to lock their screens, and that only assigned work may be processed. The notice is meant to shape behavior before misuse occurs, but it does not technically block any action. Which control type is this notice?

Accepted Answer

Directive control. A directive control is designed to guide or mandate behavior through policies, procedures, or notices without enforcing technical restrictions. This notice explicitly tells employees which data types they may open, when to lock screens, and that only assigned work may be processed, shaping behavior before misuse occurs without blocking any action. It aligns with the definition of a directive control as it provides rules and expectations rather than preventing or deterring actions through technical means.

Answer

Preventive control

Answer

Deterrent control

Answer

Detective control

Question 6

A development team runs multiple customer workloads in a shared Kubernetes cluster. Security wants to reduce the risk that one compromised container can read another team's data or deploy an altered image. Which three actions best improve the design? Select three.

Accepted Answer

Require signed, scanned images from an approved registry before deployment.. Requiring signed, scanned images from an approved registry ensures that only trusted, vulnerability-free images are deployed. Image signing (e.g., using Docker Content Trust or Notary) verifies the image's integrity and origin, preventing tampered images from being deployed. Scanning catches known vulnerabilities before runtime, reducing the attack surface. This directly addresses the risk of deploying an altered image.

Answer

Run each container as root so file permissions inside the container do not block apps.

Answer

Mount the host filesystem into every pod so support staff can troubleshoot more quickly.

Question 7

A vulnerability scan reports three findings: a critical remote code execution issue on an internet-facing VPN appliance with a public exploit, a high-severity local privilege escalation on an isolated lab PC, and a medium-severity outdated browser plug-in on a workstation used for training. Which finding should be remediated first?

Accepted Answer

The internet-facing VPN appliance, because it combines critical severity, exposure, and public exploit availability.. The internet-facing VPN appliance should be remediated first because it combines a critical severity rating, direct exposure to the internet, and a publicly available exploit. This creates an immediate and high-probability risk of remote code execution, which could lead to full compromise of the network perimeter. In contrast, the other findings are isolated or lower severity, making them less urgent.

Answer

The isolated lab PC, because local privilege escalation is always the highest technical severity.

Answer

The training workstation, because browser plug-ins are common entry points for attackers.

Answer

None of them, because all vulnerability findings should wait for the next planned maintenance cycle.

Question 8

An EDR console shows `mshta.exe` launching `powershell.exe` from a user profile directory, followed by a script that never writes a new executable to disk. Minutes later, the host begins making regular outbound HTTPS connections to an unfamiliar IP address. What type of malware behavior is most likely being observed?

Accepted Answer

Fileless attack. The EDR console shows mshta.exe (a Microsoft binary for executing HTML Applications) launching PowerShell from a user profile directory, followed by a script that never writes a new executable to disk. This is classic fileless malware behavior, where the malicious payload runs entirely in memory (e.g., via PowerShell or .NET reflection) without dropping a file, making it harder for traditional signature-based antivirus to detect. The subsequent outbound HTTPS connections to an unfamiliar IP indicate command-and-control (C2) communication, consistent with a fileless attack that persists only in memory.

Answer

Ransomware

Answer

Worm

Answer

Rootkit

Question 9

Based on the exhibit, which change best improves secure administration for the scheduled task?

Accepted Answer

Use a dedicated service account with only the required permissions and allow the task to run whether or not anyone is logged on.. Using a dedicated service account with minimal required permissions follows the principle of least privilege, reducing the attack surface. Allowing the task to run whether or not anyone is logged on ensures the scheduled task executes reliably without depending on a user session, which is essential for automated administrative tasks. This approach also avoids the security risks of using the built-in Administrator account, which has excessive privileges and is a common target for attackers.

Answer

Keep the Administrator account and leave the task running only when a user is logged on.

Answer

Move the script to the desktop so it is easier for technicians to monitor manually.

Answer

Disable the task and have staff run the script manually whenever they remember to do it.

Question 10

A cloud support team is replacing separate logins for several internal apps. The new design must support one sign-in, reduce the chance that a stolen session remains valid too long, and let the identity team revoke access centrally after termination. Which three controls best fit? Select three.

Accepted Answer

Implement SSO through federation with the identity provider as the source of truth.. Implementing SSO through federation with the identity provider (IdP) as the source of truth allows users to sign in once and access multiple internal apps without separate logins. This design centralizes authentication, so when the identity team revokes access after termination, the IdP denies all subsequent token requests, effectively invalidating sessions across all apps. Federation typically uses SAML 2.0 or OIDC, where the IdP issues signed assertions or ID tokens that apps trust, eliminating the need for app-specific credentials.

Answer

Keep app-specific local accounts so each application can manage sessions independently.

Answer

Disable centralized logout so active sessions are never interrupted during maintenance.

Question 11

A help desk analyst can reset passwords in the ticketing portal but cannot view payroll records, edit user profiles, or access other HR functions. Which security principle is the organization applying?

Accepted Answer

Least privilege. The help desk analyst is granted only the permissions necessary to perform their job function—resetting passwords—while all other HR functions are explicitly denied. This is the core definition of least privilege: each user or system component receives the minimum set of access rights needed to complete their tasks. By restricting the analyst’s account to password reset operations only, the organization reduces the attack surface and limits potential damage from compromised credentials or insider misuse.

Answer

Defense in depth

Answer

Separation of duties

Answer

Zero trust

Question 12

An administrator wants to add a new vendor IP range to a firewall rule in production. What is the best change-management step to reduce risk?

Accepted Answer

Test and approve the change before implementing it in production.. Change management requires testing and approval before applying changes to production systems. Adding a new vendor IP range to a firewall rule without validation could inadvertently allow malicious traffic or block legitimate traffic, leading to a security breach or service disruption. Testing in a non-production environment or using a change window ensures the rule behaves as intended and aligns with the organization's security policy.

Answer

Apply the change immediately during peak business hours.

Answer

Allow the entire vendor subnet permanently without review.

Answer

Skip documentation to speed up the rollout.

Question 13

A firewall ACL must be modified in production to allow a vendor update server. The team wants to minimize the chance of accidentally blocking payroll traffic. Which change-management step is best before applying the rule?

Accepted Answer

Test the proposed rule in a staged policy set and keep a rollback plan ready.. Testing the proposed rule in a staged policy set allows the team to verify that the new ACL entry does not inadvertently match and drop payroll traffic before it is applied to the production firewall. Keeping a rollback plan ready ensures that if the rule causes unexpected blocking, the previous ACL can be restored immediately, minimizing downtime. This aligns with the change-management principle of validating changes in a controlled environment to prevent service disruption.

Answer

Apply the rule immediately and monitor the help desk for complaints.

Answer

Remove all deny rules temporarily so the vendor traffic can pass cleanly.

Answer

Disable logging during the change to avoid slowing down the firewall.

Question 14

Based on the exhibit, which indicator should the security team prioritize for endpoint detection and hunting?

The attacker rotates infrastructure frequently, but one artifact has remained consistent across recent investigations.

Accepted Answer

The unique mutex name created by the malware on infected endpoints. A mutex (mutual exclusion object) is a unique artifact created by malware to prevent multiple instances of itself from running on the same endpoint. Since the attacker rotates infrastructure frequently (IPs, domains, filenames), the consistent mutex name provides a stable indicator of compromise (IoC) that can be used for endpoint detection and hunting across different incidents. This makes it a reliable signature for identifying the same malware family or variant even when other indicators change.

Answer

The current source IP addresses hosting the payloads

Answer

The exact wording of the latest phishing email lure

Answer

The filename of the attachment used in the most recent incident

Question 15

After a phishing campaign, several employees entered credentials on a fake login page. Management wants a control that both improves user behavior and gives the security team a way to measure whether click rates are going down. Which two actions best meet that goal? Select two.

Accepted Answer

Run role-based phishing awareness training. Role-based phishing awareness training (B) directly improves user behavior by tailoring content to specific job functions, making the training more relevant and effective. Simulated phishing exercises with reporting metrics (D) provide a measurable way for the security team to track click rates over time, enabling data-driven assessment of improvement. Together, they address both behavioral change and quantifiable measurement.

Answer

Send a reminder email once a year and stop there

Answer

Disable all external email for every employee

Answer

Tell users to ignore suspicious messages unless IT calls first

Question 16

An organization wants to reduce the risk of malware infections from removable media. Which three of the following controls should be implemented? (Choose three.)

Accepted Answer

Disabling AutoRun and AutoPlay features. Disabling AutoRun and AutoPlay features prevents malicious code from executing automatically when removable media is inserted, which is a common infection vector. Using group policy to block execution from removable media stops any executable files from running, even if manually launched. Scanning all removable media with antivirus software upon insertion detects and quarantines known malware before it can interact with the system.

Answer

Requiring all removable media to be formatted as NTFS

Answer

Enforcing a policy of full disk encryption on all removable drives

Answer

Installing a host-based intrusion detection system on every workstation

Question 17

A security architect is designing a solution to process highly sensitive financial transactions in a shared cloud environment. The architect needs to ensure that the processor and memory used to handle transaction data are isolated from the host operating system and other virtual machines, even if the hypervisor is compromised. Which technology is specifically designed to provide this level of isolation for code and data during runtime?

Accepted Answer

Secure enclave (e.g., Intel SGX). Secure enclave technology, such as Intel SGX, provides hardware-enforced isolation by creating trusted execution environments (TEEs) within the CPU. Code and data inside an enclave are encrypted in memory and decrypted only within the processor, ensuring that even a compromised hypervisor or host OS cannot access the transaction data during runtime. This meets the requirement for processor and memory isolation in a shared cloud environment.

Answer

Trusted Platform Module (TPM)

Answer

Hardware Security Module (HSM)

Answer

UEFI Secure Boot

Question 18

A security architect proposes adding endpoint protection, network segmentation, multifactor authentication, email filtering, and immutable backups so that one failed safeguard does not expose the entire organization. What security strategy is being described?

Accepted Answer

Defense in depth. Defense in depth is a layered security strategy where multiple, independent controls (endpoint protection, network segmentation, MFA, email filtering, immutable backups) are deployed so that if one safeguard fails, others continue to protect the organization. This approach ensures no single point of failure can compromise the entire environment, aligning directly with the scenario described.

Answer

Least privilege

Answer

Need-to-know

Answer

Zero trust

Question 19

A Windows server is still running after suspected compromise. Before it is powered down, which two volatile data sources should be collected first? Select two.

Accepted Answer

A memory capture or RAM image from the live system.. A memory capture (RAM image) preserves volatile data that is lost on power-down, including running processes, open network connections, encryption keys, and malware that exists only in memory. This is critical for forensic analysis of a live system suspected of compromise, as it captures the system state at the time of collection.

Answer

A full disk image from the powered-off server.

Answer

A hardware inventory report from the asset management database.

Answer

A screenshot of the server’s desktop wallpaper for reference.

Question 20

A file server begins encrypting documents, and the SOC confirms the activity is malicious. Which incident response step should happen first to limit further damage?

Accepted Answer

Containment. Containment is the correct first step because it isolates the compromised file server from the network, preventing the ransomware from encrypting additional shares or spreading laterally. The SMB protocol (port 445) used for file sharing would be blocked at the switch or firewall, halting further encryption of documents. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Answer

Lessons learned

Answer

Recovery

Answer

Post-incident reporting