SY0-701 Practice Exam 58 — 20 Questions

Question 1

A company-owned laptop is being transferred from the incident site to the evidence locker for a theft investigation. Which two actions best support chain of custody during transport? Select two.

Accepted Answer

Place the device in a tamper-evident evidence bag or seal. Placing the device in a tamper-evident evidence bag or seal provides a physical barrier that immediately reveals any unauthorized access during transport. This is a foundational chain-of-custody control that preserves the integrity of the evidence by making tampering detectable, which is critical for admissibility in legal proceedings.

Answer

Leave the device unsealed so legal staff can inspect it quickly

Answer

Boot the laptop to confirm the user’s files are still present

Answer

Use a personal note app instead of formal transfer documentation

Question 2

After seizing a suspect's laptop, a responder creates a bit-for-bit disk image using a write blocker. The legal team wants the next step that most directly supports evidence integrity for later review. What should the responder do?

Accepted Answer

Compute and document cryptographic hash values for the source and the image.. Computing and documenting cryptographic hash values (e.g., SHA-256 or MD5) for both the source drive and the bit-for-bit image creates a digital fingerprint. If the hashes match, it proves the image is an exact, unaltered copy of the original evidence, directly supporting integrity for later review. This step is foundational in forensic acquisition to meet legal standards for admissibility.

Answer

Open the image file and browse folders to confirm the contents look normal.

Answer

Rename the image file with the case number and store it on a desktop.

Answer

Run a full antivirus scan on the image before logging it in.

Question 3

An organization is placing its public-facing website behind a new security design. The site must be reachable from the internet, but the database and file servers must stay isolated from direct external access. What design should the architect use?

Accepted Answer

Create a demilitarized zone (DMZ) for the public web server.. A demilitarized zone (DMZ) is a network segment that isolates public-facing services, such as a web server, from the internal network. By placing the web server in the DMZ, the organization allows internet traffic to reach the website while keeping the database and file servers on the internal network, which are not directly accessible from the internet. This design enforces a security boundary where only necessary traffic (e.g., HTTP/HTTPS) is permitted through firewall rules, preventing direct external access to sensitive backend systems.

Answer

Place the web server on the internal user subnet so it can reach the database directly.

Answer

Use a VPN concentrator so the website can be accessed securely from outside.

Answer

Use network address translation (NAT) on the web server to hide its IP address.

Question 4

A caller says they are from the help desk and need the employee's MFA code to "complete a password reset". Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting is a social engineering technique where an attacker fabricates a scenario (the pretext) to trick a victim into divulging sensitive information. In this case, the attacker pretends to be from the help desk and invokes a false password reset procedure to obtain the employee's MFA code, which should never be shared. The MFA code is a time-based one-time password (TOTP) or push notification response that authenticates the user, not a tool for password resets.

Answer

Phishing

Answer

DDoS

Answer

SQL injection

Question 5

A security architect is redesigning the network for a payment card processing environment. The goal is to create a cardholder data environment (CDE) that is isolated from the rest of the corporate network to reduce PCI DSS scope. The CDE will contain only the payment application servers and the database storing credit card numbers. The architect must allow authorized administrators in the corporate network to perform updates and monitoring on the CDE servers. Which of the following network architecture designs provides the strongest isolation while still meeting the requirement for authorized administrative access?

Accepted Answer

Deploy a dedicated firewall that connects the corporate network to an isolated CDE segment. Configure firewall rules to allow only SSH and RDP from a specific jump box in the corporate network to the CDE servers, and deny all other inbound traffic from the corporate network.. It uses a dedicated firewall to create a true network isolation boundary between the corporate network and the CDE, which is a core PCI DSS requirement for reducing scope. By allowing only SSH and RDP from a specific jump box, it enforces strict least-privilege administrative access while preventing any direct or uncontrolled traffic from the corporate network. This design ensures that the CDE is a separate, protected segment with a single controlled entry point, meeting both isolation and authorized access needs.

Answer

Place the CDE servers on a separate subnet within the same VLAN as the corporate network, and rely on host-based firewalls on each server to deny all traffic except from specific administrative IP addresses.

Answer

Place the CDE servers on a separate VLAN with a Layer 3 switch that uses ACLs to allow only ICMP traffic from the corporate network to the CDE for monitoring, and require administrators to physically connect to the CDE network via a dedicated console server.

Answer

Connect the CDE servers directly to the internet through a web application firewall (WAF), and require all management access to occur through a cloud-based VPN with two-factor authentication.

Question 6

A data analyst needs a copy of a customer file for product testing. The file includes names, email addresses, purchase history, and government ID numbers, but the test team only needs the names and purchase history. What is the BEST handling action?

Accepted Answer

Remove or mask the government ID numbers before sharing the minimum necessary fields.. It applies the principle of least privilege and data minimization. The test team only needs names and purchase history, so removing or masking the government ID numbers before sharing the minimum necessary fields protects sensitive personally identifiable information (PII) and complies with data protection regulations like GDPR or CCPA. This action reduces the risk of unauthorized exposure of high-risk data while still enabling the test team to perform their work.

Answer

Provide the full file because the test team is internal and already trusted.

Answer

Encrypt the file and send it by email to the entire test group.

Answer

Keep the file unchanged and rely on the team not to open the sensitive columns.

Question 7

A firewall ACL must be modified in production to allow a vendor update server. The team wants to minimize the chance of accidentally blocking payroll traffic. Which change-management step is best before applying the rule?

Accepted Answer

Test the proposed rule in a staged policy set and keep a rollback plan ready.. Testing the proposed rule in a staged policy set allows the team to verify that the new ACL entry does not inadvertently match and drop payroll traffic before it is applied to the production firewall. Keeping a rollback plan ready ensures that if the rule causes unexpected blocking, the previous ACL can be restored immediately, minimizing downtime. This aligns with the change-management principle of validating changes in a controlled environment to prevent service disruption.

Answer

Apply the rule immediately and monitor the help desk for complaints.

Answer

Remove all deny rules temporarily so the vendor traffic can pass cleanly.

Answer

Disable logging during the change to avoid slowing down the firewall.

Question 8

A security analyst at a financial firm notices a significant increase in DNS queries from an internal server to a rarely visited external domain. The queries are for unusual subdomain names that contain encoded data. The server is not a DNS server and does not typically generate outbound traffic. Which of the following is the MOST appropriate immediate action for the analyst to take?

Accepted Answer

Isolate the server from the network to prevent further data loss.. The server is exhibiting signs of a DNS data exfiltration attack, where encoded data is being tunneled through DNS queries to an external domain. Isolating the server immediately stops the data loss and prevents further compromise, which is the most critical first step in incident response. Blocking traffic or scanning alone would not halt the active exfiltration, and logging without action allows continued data theft.

Answer

Block all outbound DNS traffic from the server immediately.

Answer

Create a firewall rule to log all further DNS queries from the server.

Answer

Run an antivirus scan on the server.

Question 9

Based on the exhibit, what is the BEST fix for the vulnerability being exploited?

A user with a standard account can retrieve documents by changing the `docId` value in the request. The application returns another employee's file without any authorization error.

Accepted Answer

Enforce server-side object-level authorization checks before returning any document.. The vulnerability is an Insecure Direct Object Reference (IDOR), where the application trusts user-supplied input (the `docId` parameter) without verifying that the authenticated user is authorized to access the requested document. The best fix is to enforce server-side object-level authorization checks before returning any document, ensuring that the server validates the user's permissions against the specific resource ID before processing the request.

Answer

Add client-side JavaScript to hide document IDs from the user interface.

Answer

Require users to change passwords more frequently to prevent unauthorized document access.

Answer

Place the document server behind a load balancer to prevent direct access to the application.

Question 10

An HR manager wants to share employee data with a benefits analytics vendor. The dataset includes names, employee IDs, home addresses, and medical leave codes. Security wants to reduce privacy exposure while still allowing the vendor to complete the analysis. What is the best first step?

Accepted Answer

Provide only the minimum necessary fields and replace direct identifiers with project IDs. It implements data minimization, a core privacy principle, by providing only the minimum necessary fields and replacing direct identifiers (names, employee IDs) with project-specific pseudonyms. This reduces exposure of personally identifiable information (PII) while preserving the vendor's ability to perform analytics on the medical leave codes and other non-identifying data. It aligns with the CompTIA SY0-701 objective of applying privacy-enhancing techniques like anonymization and data masking.

Answer

Send the full file as-is if the vendor agrees not to disclose it

Answer

Keep the names but mark the spreadsheet confidential before sending it

Answer

Upload the file to a public cloud folder and restrict the link to the vendor

Question 11

Before approving a new payroll SaaS provider, the security team wants independent evidence that the vendor's controls operated effectively during the last year and wants the contract to clearly define security responsibilities. Which two items should they request or review? Select two.

Accepted Answer

A SOC 2 Type II report. A SOC 2 Type II report provides independent, audited evidence that a vendor's controls (e.g., security, availability, confidentiality) were operating effectively over a specified period (typically 6–12 months). This directly meets the requirement for independent evidence of control effectiveness over the last year, unlike a point-in-time assessment.

Answer

A sales presentation from the vendor account team

Answer

The vendor's public blog posts

Answer

A screenshot of the login page

Question 12

Which document should define mandatory settings such as full-disk encryption, a 10-minute screen-lock timeout, and removal of local administrator rights on company laptops?

Accepted Answer

Standard, because it defines specific required configurations that must be followed.. A standard defines mandatory, specific technical configurations that must be uniformly applied across all company laptops. The question lists concrete settings (full-disk encryption, 10-minute screen-lock timeout, removal of local admin rights) that are not open to interpretation, which aligns precisely with the role of a security standard in enforcing baseline compliance.

Answer

Policy, because it explains the general direction but not the exact settings.

Answer

Procedure, because it lists the steps an end user should take every day.

Answer

Guideline, because it offers flexible recommendations rather than mandatory rules.

Question 13

A public web application is seeing bursts of requests that contain SQL metacharacters, encoded script tags, and attempts to POST to administrative endpoints. The team wants a control that can inspect HTTP traffic and block the malicious requests before they reach the app. What should be deployed?

Accepted Answer

A web application firewall in front of the application. A web application firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at the application layer (Layer 7), analyzing request payloads for SQL metacharacters, encoded script tags (XSS), and unauthorized POST attempts to administrative endpoints. By deploying a WAF in front of the web application, malicious traffic is filtered and blocked before it reaches the application server, providing a proactive security control against common web attacks such as SQL injection and cross-site scripting.

Answer

An endpoint detection and response agent on the web server only

Answer

A data loss prevention rule on the email gateway

Answer

A network access control system for user authentication

Question 14

A branch office has users, finance workstations, and printers on the same LAN. Management wants finance devices isolated from general users while still allowing approved printing and internet access. Which two changes best meet this goal? Select two.

Accepted Answer

Put finance systems in a separate VLAN.. Placing finance systems in a separate VLAN (Option A) segments the LAN into isolated broadcast domains, preventing general users from directly accessing finance workstations at Layer 2. This is a foundational step for network segmentation, as VLANs logically separate traffic without requiring physical re-cabling.

Answer

Remove the default gateway from all finance devices.

Answer

Place all systems in one flat subnet.

Answer

Use hubs instead of switches to simplify traffic flow.

Question 15

A team deploys a Linux virtual machine in IaaS and stores documents in a managed cloud object storage service. The provider secures datacenters, hardware, and the storage platform, but the organization still wants to reduce exposure. Which two tasks remain the organization's responsibility? Select two.

Accepted Answer

Patch and harden the Linux virtual machine operating system.. In an IaaS model, the customer is responsible for securing the operating system of the virtual machine, including applying patches and hardening configurations. The cloud provider secures the underlying hypervisor and physical infrastructure, but the customer must manage the OS-level security controls.

Answer

Replace the provider's datacenter controls with a customer-owned firewall appliance.

Answer

Assume the provider will apply tenant-specific application permissions automatically.

Answer

Rely on the cloud provider to classify the company's documents for compliance.

Question 16

Several employees nearly entered credentials into a fake mailbox login page. The security team wants to reduce repeat mistakes quickly without overwhelming the whole company. What is the best communication approach?

Accepted Answer

Send a short targeted notice to the affected users with examples, warning signs, and reporting steps. A short targeted notice to the affected users is the best approach because it directly addresses the immediate threat without overwhelming the entire company. This method allows the security team to quickly reinforce specific warning signs (e.g., mismatched URLs, lack of HTTPS/TLS certificates) and reporting procedures, reducing the likelihood of repeat mistakes while maintaining operational efficiency.

Answer

Wait until the annual security training cycle to address the issue

Answer

Disable all external email until the next awareness campaign is completed

Answer

Send a company-wide message naming the affected employees to discourage mistakes

Question 17

Based on the exhibit, which additional control is the best fit to prevent employees from copying sensitive reports to removable media?

Accepted Answer

Implement endpoint device control or DLP rules to restrict removable media use.. Endpoint device control or DLP (Data Loss Prevention) rules are specifically designed to monitor, block, or restrict the use of removable media such as USB drives. By implementing such controls, an organization can enforce policies that prevent sensitive data from being copied to unauthorized external storage devices, directly addressing the threat of data exfiltration via removable media.

Answer

Block all internet access on finance laptops except for the accounting website.

Answer

Increase the password complexity requirements for finance users.

Answer

Add more antivirus signatures to the endpoint protection platform.

Question 18

A security analyst receives an alert about a user account that has been attempting to authenticate from an unusual geographic location outside of business hours. The analyst reviews the event logs and sees that the authentication attempt was successful, but the user has not reported any suspicious activity. Which of the following actions should the analyst take NEXT?

Accepted Answer

Contact the user to verify whether the authentication was legitimate. The correct next step is to contact the user to verify whether the authentication was legitimate. Since the authentication was successful and the user has not reported suspicious activity, the analyst must first gather context from the user before taking any disruptive action. This aligns with the incident response process of validation and scoping before containment.

Answer

Disable the user account immediately to prevent further access

Answer

Continuously monitor the account for additional suspicious activity

Answer

Revoke all active sessions for the user account

Question 19

An investigator has just created a bit-for-bit image of a suspect's SSD using a write blocker. Before the drive is returned to evidence storage, what action most directly validates the integrity of both the original media and the image?

Accepted Answer

Calculate cryptographic hashes of the source and the image and record them.. Cryptographic hashing (e.g., SHA-256 or MD5) generates a unique digital fingerprint of the original SSD and the forensic image. By comparing the hash values, the investigator can verify that the bit-for-bit copy is identical to the source, ensuring data integrity and admissibility in legal proceedings. This step directly validates that no data has been altered or omitted during acquisition.

Answer

Defragment the original SSD to make later analysis faster.

Answer

Compress the image file to reduce storage usage before documentation.

Answer

Wipe free space on the original SSD to remove deleted remnants.

Question 20

Based on the exhibit, what type of threat is the security team most likely seeing on the workstation?

Accepted Answer

Fileless malware. The security team is most likely seeing fileless malware because the exhibit shows a PowerShell command that injects malicious code directly into memory (e.g., using Invoke-Mimikatz or a reflective DLL injection technique) without writing a persistent executable to disk. Fileless malware operates in-memory, leveraging legitimate system tools like PowerShell, WMI, or .NET to evade traditional signature-based antivirus detection, which matches the scenario described.

Answer

Trojan

Answer

Worm

Answer

Rootkit