SY0-701 Practice Exam 59 — 20 Questions

Question 1

A public web application is seeing bursts of requests that contain SQL metacharacters, encoded script tags, and attempts to POST to administrative endpoints. The team wants a control that can inspect HTTP traffic and block the malicious requests before they reach the app. What should be deployed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A web application firewall in front of the application. A web application firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at the application layer (Layer 7), analyzing request payloads for SQL metacharacters, encoded script tags (XSS), and unauthorized POST attempts to administrative endpoints. By deploying a WAF in front of the web application, malicious traffic is filtered and blocked before it reaches the application server, providing a proactive security control against common web attacks such as SQL injection and cross-site scripting.

Answer

An endpoint detection and response agent on the web server only

Answer

A data loss prevention rule on the email gateway

Answer

A network access control system for user authentication

Question 2

A branch office has users, finance workstations, and printers on the same LAN. Management wants finance devices isolated from general users while still allowing approved printing and internet access. Which two changes best meet this goal? Select two.

Accepted Answer

Put finance systems in a separate VLAN.. Placing finance systems in a separate VLAN (Option A) segments the LAN into isolated broadcast domains, preventing general users from directly accessing finance workstations at Layer 2. This is a foundational step for network segmentation, as VLANs logically separate traffic without requiring physical re-cabling.

Answer

Remove the default gateway from all finance devices.

Answer

Place all systems in one flat subnet.

Answer

Use hubs instead of switches to simplify traffic flow.

Question 3

A team deploys a Linux virtual machine in IaaS and stores documents in a managed cloud object storage service. The provider secures datacenters, hardware, and the storage platform, but the organization still wants to reduce exposure. Which two tasks remain the organization's responsibility? Select two.

Accepted Answer

Patch and harden the Linux virtual machine operating system.. In an IaaS model, the customer is responsible for securing the operating system of the virtual machine, including applying patches and hardening configurations. The cloud provider secures the underlying hypervisor and physical infrastructure, but the customer must manage the OS-level security controls.

Answer

Replace the provider's datacenter controls with a customer-owned firewall appliance.

Answer

Assume the provider will apply tenant-specific application permissions automatically.

Answer

Rely on the cloud provider to classify the company's documents for compliance.

Question 4

Several employees nearly entered credentials into a fake mailbox login page. The security team wants to reduce repeat mistakes quickly without overwhelming the whole company. What is the best communication approach?

Accepted Answer

Send a short targeted notice to the affected users with examples, warning signs, and reporting steps. A short targeted notice to the affected users is the best approach because it directly addresses the immediate threat without overwhelming the entire company. This method allows the security team to quickly reinforce specific warning signs (e.g., mismatched URLs, lack of HTTPS/TLS certificates) and reporting procedures, reducing the likelihood of repeat mistakes while maintaining operational efficiency.

Answer

Wait until the annual security training cycle to address the issue

Answer

Disable all external email until the next awareness campaign is completed

Answer

Send a company-wide message naming the affected employees to discourage mistakes

Question 5

Based on the exhibit, which additional control is the best fit to prevent employees from copying sensitive reports to removable media?

Accepted Answer

Implement endpoint device control or DLP rules to restrict removable media use.. Endpoint device control or DLP (Data Loss Prevention) rules are specifically designed to monitor, block, or restrict the use of removable media such as USB drives. By implementing such controls, an organization can enforce policies that prevent sensitive data from being copied to unauthorized external storage devices, directly addressing the threat of data exfiltration via removable media.

Answer

Block all internet access on finance laptops except for the accounting website.

Answer

Increase the password complexity requirements for finance users.

Answer

Add more antivirus signatures to the endpoint protection platform.

Question 6

A security analyst receives an alert about a user account that has been attempting to authenticate from an unusual geographic location outside of business hours. The analyst reviews the event logs and sees that the authentication attempt was successful, but the user has not reported any suspicious activity. Which of the following actions should the analyst take NEXT?

Accepted Answer

Contact the user to verify whether the authentication was legitimate. The correct next step is to contact the user to verify whether the authentication was legitimate. Since the authentication was successful and the user has not reported suspicious activity, the analyst must first gather context from the user before taking any disruptive action. This aligns with the incident response process of validation and scoping before containment.

Answer

Disable the user account immediately to prevent further access

Answer

Continuously monitor the account for additional suspicious activity

Answer

Revoke all active sessions for the user account

Question 7

An investigator has just created a bit-for-bit image of a suspect's SSD using a write blocker. Before the drive is returned to evidence storage, what action most directly validates the integrity of both the original media and the image?

Accepted Answer

Calculate cryptographic hashes of the source and the image and record them.. Cryptographic hashing (e.g., SHA-256 or MD5) generates a unique digital fingerprint of the original SSD and the forensic image. By comparing the hash values, the investigator can verify that the bit-for-bit copy is identical to the source, ensuring data integrity and admissibility in legal proceedings. This step directly validates that no data has been altered or omitted during acquisition.

Answer

Defragment the original SSD to make later analysis faster.

Answer

Compress the image file to reduce storage usage before documentation.

Answer

Wipe free space on the original SSD to remove deleted remnants.

Question 8

Based on the exhibit, what type of threat is the security team most likely seeing on the workstation?

Accepted Answer

Fileless malware. The security team is most likely seeing fileless malware because the exhibit shows a PowerShell command that injects malicious code directly into memory (e.g., using Invoke-Mimikatz or a reflective DLL injection technique) without writing a persistent executable to disk. Fileless malware operates in-memory, leveraging legitimate system tools like PowerShell, WMI, or .NET to evade traditional signature-based antivirus detection, which matches the scenario described.

Answer

Trojan

Answer

Worm

Answer

Rootkit

Question 9

Based on the exhibit, what should the security team recommend for the finance workstation pilot?

Accepted Answer

Require the vendor to provide the missing supply-chain documentation or an approved compensating-control plan before approval.. The exhibit indicates missing supply-chain documentation for the finance workstation pilot. Without this documentation, the security team cannot verify the integrity and provenance of the hardware and software, which is critical for a pilot involving sensitive financial data. Requiring the vendor to provide the missing documentation or an approved compensating-control plan ensures compliance with supply-chain risk management policies before approval.

Answer

Approve the pilot because the workstations are limited to read-only data and the application is signed.

Answer

Disable segmentation so the pilot can access more systems if troubleshooting is needed.

Answer

Let the finance director sign an informal email and skip the security review.

Question 10

During business impact analysis interviews, the team needs two inputs that help determine which business services must recover first after an outage. Which two inputs are the most useful? Select two.

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) defines the maximum acceptable downtime for a business service, directly indicating the urgency of recovery. Recovery Point Objective (RPO) defines the maximum acceptable data loss, which influences the recovery strategy and priority. Together, they provide the two critical inputs needed to sequence recovery efforts after an outage.

Answer

Annualized Loss Expectancy (ALE)

Answer

Mean Time Between Failures (MTBF)

Answer

Control self-assessment score

Question 11

The SOC has contained a mailbox compromise by resetting the password and revoking active sessions. Investigation shows the attacker created an automatic forwarding rule and added an OAuth consent grant. What should happen next to eradicate the threat?

Accepted Answer

Remove the malicious forwarding rule and review or revoke suspicious OAuth app grants.. The immediate next step after containment is to remove the attacker's persistence mechanisms. The malicious forwarding rule (which exfiltrates emails via SMTP) and the OAuth consent grant (which provides persistent API access) must be removed to fully eradicate the threat. Simply resetting the password and revoking sessions does not remove these backdoors, as OAuth grants persist independently of user credentials.

Answer

Notify all employees to be more careful with email before taking any technical steps.

Answer

Delete the mailbox and create a new account for the user immediately.

Answer

Restore the user's messages from backup and reopen access without further review.

Question 12

Employees in a lobby say their phones automatically connected to a wireless network named CorpWiFi, even though the legitimate access point was offline. They were then shown a fake sign-in page. What threat is this?

Accepted Answer

An evil twin access point impersonating the real corporate wireless network. This is an evil twin attack. The attacker sets up a rogue access point broadcasting the same SSID (CorpWiFi) as the legitimate network. When the real access point goes offline, client devices automatically connect to the stronger signal of the rogue AP, allowing the attacker to present a fake captive portal to harvest credentials.

Answer

A Bluetooth replay attack that reuses captured pairing data

Answer

A cloud misconfiguration exposing a storage bucket to the internet

Answer

A dependency compromise in a software library used by the company portal

Question 13

A security analyst is reviewing firewall logs and notices repeated connection attempts from a single external IP address to multiple internal IP addresses on TCP port 22 (SSH). Each attempt uses a different username but the same password: 'Spring2024!'. The attempts occur sporadically over a 12-hour period. Which type of attack is most likely being observed?

Accepted Answer

Password spraying attack. This is a password spraying attack because the attacker uses a single common password ('Spring2024!') against multiple usernames across different internal IP addresses, attempting to avoid account lockout by spreading attempts over time and targets. Unlike brute-force or dictionary attacks that focus many passwords against a single account, password spraying targets many accounts with a few weak passwords, making it harder to detect via failed login thresholds.

Answer

Brute-force attack

Answer

Dictionary attack

Answer

Man-in-the-middle attack

Question 14

An HR analyst needs to send a payroll reconciliation file to an external auditor. The file contains employee names, SSNs, bank account numbers, and salary details, but the auditor only needs employee IDs, payment totals, and a control total. What should the analyst do first?

Accepted Answer

Redact or remove unnecessary sensitive fields before sharing the minimum required data.. The principle of data minimization requires that only the necessary data (employee IDs, payment totals, control total) be shared with the external auditor. Redacting or removing unnecessary sensitive fields (SSNs, bank account numbers, salary details) reduces the risk of exposure and complies with privacy regulations. This step should occur before any encryption or transmission to ensure the auditor never receives data they do not need.

Answer

Encrypt the full spreadsheet and send it without changing the contents.

Answer

Compress the file into a password-protected archive and email the password separately.

Answer

Copy the file to a personal cloud storage account to make sharing easier.

Question 15

Procurement is reviewing a new payroll SaaS provider. The business wants independent evidence that the vendor's controls were designed and operating effectively over the last six months. Which document should the security team request?

Accepted Answer

A SOC 2 Type II report from an independent auditor.. A SOC 2 Type II report provides independent assurance that a service organization's controls are not only designed appropriately (Type I) but also operating effectively over a specified period, typically six to twelve months. This aligns directly with the procurement team's requirement for evidence of control effectiveness over the last six months, making it the correct choice for evaluating a SaaS vendor's security posture.

Answer

A software patch list showing recent updates installed on the vendor's servers.

Answer

A penetration test screenshot showing one web application vulnerability was fixed.

Answer

An internal email from the vendor's security manager stating that controls are mature.

Question 16

A SOC analyst is reviewing logs from a Windows domain controller and notices a large number of failed logon attempts (Event ID 4625) from a single source IP address within a five-minute window. The account names used are random strings such as "a1b2c3", "x9y8z7", etc. The analyst then checks the source IP and finds it is a known external address from a foreign country. Which of the following is the most appropriate next step for the analyst to take?

Accepted Answer

Investigate whether any of the attempted accounts correspond to actual domain users.. The analyst must first determine if any of the randomly generated account names match existing domain user accounts. If a match is found, it indicates a targeted password-spraying or brute-force attack against valid accounts, requiring immediate account lockdown and credential reset. This investigation step aligns with the incident response process of identification before containment or escalation.

Answer

Immediately block the IP address at the perimeter firewall.

Answer

Run a full antivirus scan on the domain controller.

Answer

Notify the company's legal department for law enforcement involvement.

Question 17

A baseline review found that standard developer accounts are local administrators, unsigned tools can run from user profile folders, and reimaged systems still end up with unauthorized persistence. Which two changes best improve hardening while preserving developer work? Select two.

Accepted Answer

Remove local administrator rights from standard user accounts.. Removing local administrator rights from standard developer accounts enforces the principle of least privilege (PoLP). This prevents developers from making unauthorized system-wide changes, such as installing unsigned tools or creating persistence mechanisms, while still allowing them to perform their work with standard user permissions. This directly addresses the baseline review finding that standard developer accounts are local administrators, which is a common security misconfiguration.

Answer

Turn off logging to preserve disk space.

Answer

Allow unrestricted browser extension installs.

Answer

Merge all developer and production systems into one VLAN.

Question 18

After a new MFA policy rollout, the SIEM generates an alert for five failed logins to a SaaS admin portal from one IP, followed by a successful login to the same account from an IP in another country. The account owner says they were in meetings all day. What should the analyst do first?

Accepted Answer

Correlate identity provider, VPN, and endpoint logs to validate whether the activity matches the user's normal pattern.. The alert shows a successful login after five failures from a different country, which is a classic indicator of a potential account takeover. The analyst must correlate identity provider logs (e.g., Okta, Azure AD) for authentication details, VPN logs for network origination, and endpoint logs for device posture to determine if the successful login matches the user's normal behavior. This step validates whether the activity is legitimate or malicious before taking any irreversible action.

Answer

Disable the account immediately without checking any other logs.

Answer

Delete the alert because MFA was enabled and the login eventually succeeded.

Answer

Reimage the user's laptop to remove any possible malware right away.

Question 19

At a conference, employees connect to a Wi-Fi network named "CorpGuest" and then see certificate warnings in their browsers. The network has a stronger signal than the hotel's legitimate guest Wi-Fi. What attack is this?

Accepted Answer

Rogue access point. This scenario describes a rogue access point attack. The attacker sets up a Wi-Fi network named "CorpGuest" with a stronger signal than the legitimate hotel guest Wi-Fi, tricking employees into connecting to it. Once connected, the attacker can intercept traffic and present a fake certificate, causing browser certificate warnings. This is a classic evil twin variant of a rogue access point attack.

Answer

ARP poisoning

Answer

Replay attack

Answer

Denial of service

Question 20

A hospital's claims portal has two open risks. Risk A is an internet-facing login page with a low-severity software flaw, but monitoring shows a steady increase in automated login attempts. Risk B is an internal file share with a medium-severity patch gap, but only a small admin group can access it and no exploitation is observed. Leadership can fund only one remediation this month. Which risk should be prioritized first?

Accepted Answer

Prioritize Risk A because it is exposed to the internet and already shows active attack interest.. Risk A should be prioritized because the internet-facing login page is exposed to the public attack surface, and the steady increase in automated login attempts indicates active reconnaissance or credential-stuffing attacks. Even though the software flaw is low severity, the combination of internet exposure and active attacker interest significantly elevates the likelihood of exploitation, making it a higher priority than an internal file share with no observed exploitation.

Answer

Prioritize Risk B because a medium-severity flaw is always more important than a low-severity flaw.

Answer

Accept Risk A because no confirmed compromise has occurred yet.

Answer

Transfer Risk A to an insurer because public-facing exposure cannot be reduced.