SY0-701 Practice Exam 58 — 20 Questions

Question 1

A contractor signs in to a project portal that fronts several SaaS tools. Access must be granted only if all of the following are true: the user is assigned to the project, the device is managed, and the request occurs during the approved maintenance window. Which access model best supports this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attribute-based access control because multiple runtime attributes determine access. Attribute-based access control (ABAC) evaluates multiple runtime attributes—such as user-project assignment, device management status, and time of request—against policies to grant access. This matches the requirement because all three conditions must be true simultaneously, and ABAC can combine subject, resource, and environment attributes in a single policy rule. Role-based access control (RBAC) would only check the user's role, not device or time attributes.

Answer

Role-based access control because the contractor has one project role

Answer

Single sign-on because the user should not log in more than once

Answer

Privileged access management because the contractor needs temporary access

Question 2

A help desk technician receives an alert that an unmanaged laptop was plugged into a conference room network jack and was automatically placed into a restricted network segment until it passed a security check. Which control is responsible for that behavior?

Accepted Answer

Network access control (NAC).. Network Access Control (NAC) is the correct answer because it is specifically designed to enforce security policies on devices attempting to connect to a network. When an unmanaged laptop is plugged into a network jack, NAC evaluates the device's compliance (e.g., antivirus status, patch level) and, if it fails, automatically places it into a restricted segment (e.g., a quarantine VLAN) until it passes a security check. This behavior is a core function of NAC solutions like Cisco ISE or Aruba ClearPass, which use 802.1X or MAC authentication bypass to dynamically assign VLANs based on device posture.

Answer

Data loss prevention (DLP).

Answer

Intrusion prevention system (IPS).

Answer

Sandboxing gateway.

Question 3

A finance laptop is powered on, the user is still logged in, and it remains connected to Wi-Fi after a malware alert. What should the responder do first to preserve volatile evidence?

Accepted Answer

Collect volatile data such as memory, running processes, and active network connections.. The laptop is powered on, the user is logged in, and it is connected to the network, meaning volatile data (memory contents, running processes, active network connections) is at immediate risk of being lost if the system is shut down or tampered with. The responder must collect this data first to preserve evidence of the malware's current state, including any malicious processes, network connections, and in-memory artifacts that would disappear on power loss.

Answer

Power the laptop off immediately to stop any further attacker activity.

Answer

Run a full antimalware scan before touching any other data.

Answer

Disconnect the power cable and remove the battery to prevent changes.

Question 4

A records room has repeated tailgating after hours and occasional door propping during deliveries. Management wants one control that prevents follow-on entry and another that immediately alerts security if the door is forced open or left ajar. Which two controls best meet the need? Select two.

Accepted Answer

Install a mantrap at the room entrance.. A mantrap (option A) prevents tailgating by requiring one door to close before the next can open, effectively stopping follow-on entry. A door position sensor (option B) detects when the door is forced open or left ajar and triggers an immediate alert to security via an alarm or SIEM integration, meeting the requirement for real-time notification.

Answer

Place a larger warning sign on the wall beside the door.

Answer

Mount a visible camera over the door only.

Answer

Replace the mechanical lock with the same type of lock and no monitoring.

Question 5

A user's laptop starts renaming many documents, and a ransom note appears on the desktop. What is the best immediate action for the help desk to recommend?

Accepted Answer

Disconnect the laptop from the network to contain the infection.. Disconnecting the laptop from the network immediately stops the ransomware from communicating with its command-and-control (C2) server, preventing further encryption of network shares and lateral movement. This containment step is critical before any remediation, as it isolates the threat and preserves evidence for forensic analysis.

Answer

Shut down the laptop immediately and leave it on the desk.

Answer

Delete the ransom note and continue working until the next reboot.

Answer

Install a new browser extension to block the attacker.

Question 6

A user's laptop suddenly shows encrypted .docx files, a ransom note, and the EDR console reports mass file renames and shadow copy deletion. The device is still online and connected to the corporate VPN. What is the best immediate action?

Accepted Answer

Quarantine the endpoint from the network through EDR or physical isolation.. The immediate priority in a confirmed ransomware incident is to contain the threat by isolating the compromised host from the network. The EDR console showing mass file renames and shadow copy deletion indicates active encryption and lateral movement risk. Quarantining via EDR or physically disconnecting the network cable stops the ransomware from encrypting additional shares or communicating with its C2 server, preserving evidence and preventing further damage.

Answer

Reboot the laptop into safe mode and attempt manual malware removal.

Answer

Restore the affected files from backup before taking any other action.

Answer

Tell the user to change their password and continue working from the same laptop.

Question 7

A company-owned laptop is being transferred from the incident site to the evidence locker for a theft investigation. Which two actions best support chain of custody during transport? Select two.

Accepted Answer

Place the device in a tamper-evident evidence bag or seal. Placing the device in a tamper-evident evidence bag or seal provides a physical barrier that immediately reveals any unauthorized access during transport. This is a foundational chain-of-custody control that preserves the integrity of the evidence by making tampering detectable, which is critical for admissibility in legal proceedings.

Answer

Leave the device unsealed so legal staff can inspect it quickly

Answer

Boot the laptop to confirm the user’s files are still present

Answer

Use a personal note app instead of formal transfer documentation

Question 8

After seizing a suspect's laptop, a responder creates a bit-for-bit disk image using a write blocker. The legal team wants the next step that most directly supports evidence integrity for later review. What should the responder do?

Accepted Answer

Compute and document cryptographic hash values for the source and the image.. Computing and documenting cryptographic hash values (e.g., SHA-256 or MD5) for both the source drive and the bit-for-bit image creates a digital fingerprint. If the hashes match, it proves the image is an exact, unaltered copy of the original evidence, directly supporting integrity for later review. This step is foundational in forensic acquisition to meet legal standards for admissibility.

Answer

Open the image file and browse folders to confirm the contents look normal.

Answer

Rename the image file with the case number and store it on a desktop.

Answer

Run a full antivirus scan on the image before logging it in.

Question 9

An organization is placing its public-facing website behind a new security design. The site must be reachable from the internet, but the database and file servers must stay isolated from direct external access. What design should the architect use?

Accepted Answer

Create a demilitarized zone (DMZ) for the public web server.. A demilitarized zone (DMZ) is a network segment that isolates public-facing services, such as a web server, from the internal network. By placing the web server in the DMZ, the organization allows internet traffic to reach the website while keeping the database and file servers on the internal network, which are not directly accessible from the internet. This design enforces a security boundary where only necessary traffic (e.g., HTTP/HTTPS) is permitted through firewall rules, preventing direct external access to sensitive backend systems.

Answer

Place the web server on the internal user subnet so it can reach the database directly.

Answer

Use a VPN concentrator so the website can be accessed securely from outside.

Answer

Use network address translation (NAT) on the web server to hide its IP address.

Question 10

A caller says they are from the help desk and need the employee's MFA code to "complete a password reset". Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting is a social engineering technique where an attacker fabricates a scenario (the pretext) to trick a victim into divulging sensitive information. In this case, the attacker pretends to be from the help desk and invokes a false password reset procedure to obtain the employee's MFA code, which should never be shared. The MFA code is a time-based one-time password (TOTP) or push notification response that authenticates the user, not a tool for password resets.

Answer

Phishing

Answer

DDoS

Answer

SQL injection

Question 11

A security architect is redesigning the network for a payment card processing environment. The goal is to create a cardholder data environment (CDE) that is isolated from the rest of the corporate network to reduce PCI DSS scope. The CDE will contain only the payment application servers and the database storing credit card numbers. The architect must allow authorized administrators in the corporate network to perform updates and monitoring on the CDE servers. Which of the following network architecture designs provides the strongest isolation while still meeting the requirement for authorized administrative access?

Accepted Answer

Deploy a dedicated firewall that connects the corporate network to an isolated CDE segment. Configure firewall rules to allow only SSH and RDP from a specific jump box in the corporate network to the CDE servers, and deny all other inbound traffic from the corporate network.. It uses a dedicated firewall to create a true network isolation boundary between the corporate network and the CDE, which is a core PCI DSS requirement for reducing scope. By allowing only SSH and RDP from a specific jump box, it enforces strict least-privilege administrative access while preventing any direct or uncontrolled traffic from the corporate network. This design ensures that the CDE is a separate, protected segment with a single controlled entry point, meeting both isolation and authorized access needs.

Answer

Place the CDE servers on a separate subnet within the same VLAN as the corporate network, and rely on host-based firewalls on each server to deny all traffic except from specific administrative IP addresses.

Answer

Place the CDE servers on a separate VLAN with a Layer 3 switch that uses ACLs to allow only ICMP traffic from the corporate network to the CDE for monitoring, and require administrators to physically connect to the CDE network via a dedicated console server.

Answer

Connect the CDE servers directly to the internet through a web application firewall (WAF), and require all management access to occur through a cloud-based VPN with two-factor authentication.

Question 12

Users on the internal Wi-Fi report that the finance portal suddenly resolves to a different IP address, and the browser shows a fake login page that closely matches the real site. The DNS resolver cache on the network also contains unexpected entries for that host name. What attack is most likely?

Accepted Answer

DNS poisoning, because the attacker has corrupted name resolution so users are sent to a malicious destination.. B is correct because DNS poisoning (also known as DNS cache poisoning) directly corrupts the name resolution process, causing the finance portal's hostname to resolve to a malicious IP address. The presence of unexpected DNS resolver cache entries for that hostname confirms that the attack targeted the DNS infrastructure, not the ARP table or network availability.

Answer

ARP spoofing, because the attacker is changing the MAC address used on the local network.

Answer

Port scanning, because the attacker is probing internal services for open ports.

Answer

Denial-of-service, because the attacker is overwhelming the portal with traffic.

Question 13

During malware containment, an analyst needs to preserve transient information from a compromised Windows workstation that is still running. Which action is MOST appropriate before shutdown or imaging?

Accepted Answer

Capture memory and live process information with approved response tools. Transient information such as running processes, network connections, and memory-resident malware is lost when the system is powered off. Capturing memory and live process data with approved forensic tools (e.g., FTK Imager, DumpIt, or WinPmem) preserves volatile evidence critical for incident analysis and attribution, in accordance with the order of volatility (RFC 3227).

Answer

Immediately unplug the workstation and carry it to the evidence room

Answer

Run a full antivirus scan to clean the machine before analysis

Answer

Clear the event logs so the malicious activity is easier to isolate

Question 14

A data analyst needs a copy of a customer file for product testing. The file includes names, email addresses, purchase history, and government ID numbers, but the test team only needs the names and purchase history. What is the BEST handling action?

Accepted Answer

Remove or mask the government ID numbers before sharing the minimum necessary fields.. It applies the principle of least privilege and data minimization. The test team only needs names and purchase history, so removing or masking the government ID numbers before sharing the minimum necessary fields protects sensitive personally identifiable information (PII) and complies with data protection regulations like GDPR or CCPA. This action reduces the risk of unauthorized exposure of high-risk data while still enabling the test team to perform their work.

Answer

Provide the full file because the test team is internal and already trusted.

Answer

Encrypt the file and send it by email to the entire test group.

Answer

Keep the file unchanged and rely on the team not to open the sensitive columns.

Question 15

A security analyst at a financial firm notices a significant increase in DNS queries from an internal server to a rarely visited external domain. The queries are for unusual subdomain names that contain encoded data. The server is not a DNS server and does not typically generate outbound traffic. Which of the following is the MOST appropriate immediate action for the analyst to take?

Accepted Answer

Isolate the server from the network to prevent further data loss.. The server is exhibiting signs of a DNS data exfiltration attack, where encoded data is being tunneled through DNS queries to an external domain. Isolating the server immediately stops the data loss and prevents further compromise, which is the most critical first step in incident response. Blocking traffic or scanning alone would not halt the active exfiltration, and logging without action allows continued data theft.

Answer

Block all outbound DNS traffic from the server immediately.

Answer

Create a firewall rule to log all further DNS queries from the server.

Answer

Run an antivirus scan on the server.

Question 16

Based on the exhibit, what is the BEST fix for the vulnerability being exploited?

A user with a standard account can retrieve documents by changing the `docId` value in the request. The application returns another employee's file without any authorization error.

Accepted Answer

Enforce server-side object-level authorization checks before returning any document.. The vulnerability is an Insecure Direct Object Reference (IDOR), where the application trusts user-supplied input (the `docId` parameter) without verifying that the authenticated user is authorized to access the requested document. The best fix is to enforce server-side object-level authorization checks before returning any document, ensuring that the server validates the user's permissions against the specific resource ID before processing the request.

Answer

Add client-side JavaScript to hide document IDs from the user interface.

Answer

Require users to change passwords more frequently to prevent unauthorized document access.

Answer

Place the document server behind a load balancer to prevent direct access to the application.

Question 17

An HR manager wants to share employee data with a benefits analytics vendor. The dataset includes names, employee IDs, home addresses, and medical leave codes. Security wants to reduce privacy exposure while still allowing the vendor to complete the analysis. What is the best first step?

Accepted Answer

Provide only the minimum necessary fields and replace direct identifiers with project IDs. It implements data minimization, a core privacy principle, by providing only the minimum necessary fields and replacing direct identifiers (names, employee IDs) with project-specific pseudonyms. This reduces exposure of personally identifiable information (PII) while preserving the vendor's ability to perform analytics on the medical leave codes and other non-identifying data. It aligns with the CompTIA SY0-701 objective of applying privacy-enhancing techniques like anonymization and data masking.

Answer

Send the full file as-is if the vendor agrees not to disclose it

Answer

Keep the names but mark the spreadsheet confidential before sending it

Answer

Upload the file to a public cloud folder and restrict the link to the vendor

Question 18

Before approving a new payroll SaaS provider, the security team wants independent evidence that the vendor's controls operated effectively during the last year and wants the contract to clearly define security responsibilities. Which two items should they request or review? Select two.

Accepted Answer

A SOC 2 Type II report. A SOC 2 Type II report provides independent, audited evidence that a vendor's controls (e.g., security, availability, confidentiality) were operating effectively over a specified period (typically 6–12 months). This directly meets the requirement for independent evidence of control effectiveness over the last year, unlike a point-in-time assessment.

Answer

A sales presentation from the vendor account team

Answer

The vendor's public blog posts

Answer

A screenshot of the login page

Question 19

A Linux operations team must run a nightly maintenance script on 70 servers to rotate logs and restart one service. Security will not allow interactive SSH logins, and the script should only have the permissions required for those two commands. Which two configuration choices best meet the requirement? Select two.

Accepted Answer

Create a dedicated automation account and restrict it in sudoers to the exact commands needed.. Creating a dedicated automation account and restricting it in sudoers to the exact commands needed (e.g., `/usr/sbin/logrotate` and `/usr/bin/systemctl restart <service>`) enforces the principle of least privilege. This ensures the account can only execute the specific maintenance tasks without granting interactive SSH access or unnecessary permissions.

Answer

Place the automation account in the root group so it can restart services everywhere.

Answer

Copy the administrator's personal password into the script so the job can log in unattended.

Answer

Approve the job through email one time, then allow the script to run with no restrictions forever.

Question 20

Which document should define mandatory settings such as full-disk encryption, a 10-minute screen-lock timeout, and removal of local administrator rights on company laptops?

Accepted Answer

Standard, because it defines specific required configurations that must be followed.. A standard defines mandatory, specific technical configurations that must be uniformly applied across all company laptops. The question lists concrete settings (full-disk encryption, 10-minute screen-lock timeout, removal of local admin rights) that are not open to interpretation, which aligns precisely with the role of a security standard in enforcing baseline compliance.

Answer

Policy, because it explains the general direction but not the exact settings.

Answer

Procedure, because it lists the steps an end user should take every day.

Answer

Guideline, because it offers flexible recommendations rather than mandatory rules.