SY0-701 Practice Exam 59 — 20 Questions

Question 1

A company wants employees to use one corporate login for multiple SaaS applications, require MFA when users sign in from unmanaged devices, and centralize account lifecycle management. Which design best meets these requirements?

Accepted Answer

Implement federated single sign-on through a central identity provider with MFA and conditional access policies.. Option C is correct because federated single sign-on (SSO) through a central identity provider (IdP) like Azure AD or Okta allows employees to use one corporate login across multiple SaaS applications via protocols such as SAML 2.0 or OIDC. The IdP enforces MFA for unmanaged devices through conditional access policies (e.g., device compliance checks) and centralizes account lifecycle management by provisioning/deprovisioning users from a single directory (e.g., LDAP or SCIM).

Answer

Create separate local usernames and passwords in each SaaS application.

Answer

Use shared accounts for each department and keep one password vault for the team.

Answer

Require all users to connect through a VPN before any SaaS login and remove identity federation.

Question 2

A customer portal has a form that submits a money-transfer request with the user’s existing session cookie. Security testing shows that if a user visits a malicious site while logged in, the portal will submit the transfer request without any additional verification. Which control would best reduce this risk?

Accepted Answer

Add a server-validated anti-CSRF token to each state-changing request. The described attack is a Cross-Site Request Forgery (CSRF), where a malicious site forces an authenticated user's browser to submit a state-changing request without the user's consent. Adding a server-validated anti-CSRF token ensures that each request includes a unique, unpredictable value tied to the user's session, which the server verifies before processing. This prevents the malicious site from forging a valid request because it cannot guess or obtain the token.

Answer

Replace the transfer form with a stored procedure

Answer

Enable input length limits on the transfer amount field

Answer

Turn on content security policy to block all script execution

Question 3

A developer installed an unknown root CA on a laptop. The browser now accepts a proxy certificate for intranet.apps.example without warnings. Which two controls most directly reduce the chance that this endpoint trusts a malicious interception certificate? Select two.

Accepted Answer

Enforce certificate pinning in the application for the expected server certificate.. Option A is correct because certificate pinning hard-codes the expected server certificate or public key into the application, so even if a malicious root CA is trusted by the OS, the application will reject any proxy certificate that does not match the pinned certificate. This directly prevents the browser from accepting the proxy certificate without warnings, as the pinning check occurs at the application layer before the TLS handshake completes.

Answer

Allow employees to add any root CA as long as the certificate is password-protected.

Answer

Rely on HTTPS alone because any certificate over TLS is safe.

Answer

Disable DNS because certificate trust does not depend on hostnames.

Question 4

A file server suddenly renames documents, creates ransom notes, and users can no longer open their files. Which malware type is most likely involved?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts files and demands payment for decryption. The symptoms—documents being renamed, ransom notes appearing, and users losing access to their files—are classic indicators of ransomware activity, which typically uses strong encryption algorithms like AES or RSA to lock files.

Answer

Spyware

Answer

Rootkit

Answer

Worm

Question 5

A company uses a SaaS email platform. The provider manages the servers and application code. Which two tasks remain the company's responsibility? Select two.

Accepted Answer

Configuring who can access company mailboxes and administrative roles.. Option A is correct because in a SaaS model, the customer retains administrative control over user access and role-based permissions. This includes configuring mailbox permissions, setting up multi-factor authentication, and managing administrative roles within the provider's interface. The provider handles the underlying infrastructure, but identity and access management (IAM) remains the customer's responsibility.

Answer

Applying security patches to the provider's mail servers.

Answer

Replacing failed provider storage disks.

Answer

Hardening the provider's hypervisor.

Question 6

A file server used by a shared service account begins renaming documents, deleting shadow copies, and creating outbound SMB connections to many internal hosts. The SOC suspects the malware may be spreading while also encrypting data. Which two actions are the best immediate containment steps? Select two.

Accepted Answer

Isolate the affected server from the network through EDR or switch controls.. Isolating the affected server from the network via EDR or switch controls is correct because it immediately stops the malware from spreading to other hosts through SMB connections and prevents further encryption of network-accessible files. This containment step breaks the lateral movement and data exfiltration channels without relying on potentially compromised credentials or incomplete cleanup.

Answer

Restore the server from backup before taking any containment action.

Answer

Delete the suspicious files from the server to stop the encryption process.

Answer

Inform users that the incident is likely a false positive and continue monitoring.

Question 7

A help desk manager wants sample customer tickets copied into a test environment so developers can reproduce support issues. The tickets include names, phone numbers, and account details. Which action best reduces privacy exposure while still supporting testing?

Accepted Answer

Mask or tokenize the personal data and restrict access to approved testers only.. Option B is correct because masking or tokenizing personal data (e.g., replacing names with pseudonyms, scrambling phone numbers) ensures that developers can work with realistic data structures without exposing personally identifiable information (PII). Restricting access to approved testers further enforces the principle of least privilege, which is a core security control for test environments. This approach balances the need for functional testing with compliance requirements like GDPR or HIPAA.

Answer

Export the full tickets because the developers need realistic records.

Answer

Copy the tickets to a shared cloud drive and protect it with a simple password.

Answer

Remove the account numbers only and leave the rest of the ticket untouched.

Question 8

A facilities manager receives an SMS from "FedEx Delivery" saying a shipment for the research lab cannot clear security until the recipient verifies the package by signing in. The message includes the manager's initials and the warehouse code, and the link opens a cloned sign-in page. Which attack is most likely?

Accepted Answer

Smishing, because the attacker is using a text message to deliver a targeted credential lure.. Smishing is a social engineering attack that uses SMS (Short Message Service) to deliver a fraudulent message designed to trick the recipient into revealing sensitive information. In this scenario, the attacker sends a text message impersonating FedEx, includes the manager's initials and warehouse code for personalization, and provides a link to a cloned sign-in page, which is the classic credential-harvesting mechanism of a smishing attack.

Answer

Vishing, because the attacker is pretending to be a delivery service representative.

Answer

Spear phishing, because the message is targeted using the recipient's role and location.

Answer

Baiting, because the message offers a shipment verification reward to encourage action.

Question 9

A finance clerk reports a call from a person who claimed to be from the bank's fraud department. The caller knew the employee's name, referenced a recent invoice, and asked the employee to read back a one-time MFA code to stop a supposed payment block. Which attack is most likely?

Accepted Answer

Vishing, because the attacker is using a voice call to manipulate the target in real time.. The attack is vishing (voice phishing) because the attacker uses a telephone call to socially engineer the target into divulging a one-time MFA code. The real-time voice interaction and the specific request for an authentication code are hallmarks of vishing, which exploits human trust rather than technical vulnerabilities.

Answer

Smishing, because the attacker requested a code and mentioned a financial problem.

Answer

Baiting, because the caller offered to fix the payment issue for the employee.

Answer

Tailgating, because the attacker used a trusted identity to gain access.

Question 10

A project lead needs to send a spreadsheet labeled confidential to an external auditor. The file contains employee names, salaries, and performance notes. Which handling step best protects the data while still supporting the business need?

Accepted Answer

Use an approved encrypted file-sharing portal with named recipients and access logging. Option B is correct because using an approved encrypted file-sharing portal with named recipients and access logging ensures data-in-transit and data-at-rest encryption, restricts access to only the intended auditor, and provides an audit trail for compliance. This approach meets the business need of securely sharing confidential employee data while supporting regulatory requirements like GDPR or HIPAA, unlike unencrypted email which exposes data to interception.

Answer

Email the attachment unencrypted if the auditor signed an NDA

Answer

Upload the spreadsheet to a public link so the auditor can access it easily

Answer

Remove the confidential label before sending it to avoid confusion

Question 11

A file server suddenly renames documents with a new extension and displays a note demanding payment in cryptocurrency to restore access. What type of malware is most likely involved?

Accepted Answer

Ransomware. Ransomware is designed to encrypt files on a system, making them inaccessible, and then demand a ransom—typically in cryptocurrency—to restore access. The sudden renaming of documents with a new extension is a hallmark of ransomware encryption, as it appends a custom extension to indicate the files have been locked. The displayed note demanding payment confirms the extortion motive, which is unique to ransomware among the given options.

Answer

Spyware

Answer

Worm

Answer

Rootkit

Question 12

A development manager wants to copy a production customer database into a test environment so testers can reproduce a bug. The database contains names, addresses, and payment tokens. What is the best security practice before the copy is made?

Accepted Answer

Mask, tokenize, or replace sensitive fields with approved test data before moving it.. Option B is correct because copying production data containing sensitive information (names, addresses, payment tokens) into a test environment without sanitization violates data minimization and privacy principles (e.g., GDPR, PCI DSS). The best practice is to apply data masking, tokenization, or substitution with realistic but non-sensitive test data before the copy, ensuring that the test environment does not expose real customer data. This prevents accidental data leakage and reduces compliance risk while still allowing testers to reproduce the bug with functionally equivalent data.

Answer

Copy the production database unchanged and limit access to the QA team.

Answer

Compress the database export to reduce storage and transfer time.

Answer

Encrypt the database backup and give developers the decryption key.

Question 13

A financial institution is implementing a new policy for all remote access to its payment processing system. The system will generate a unique digital signature for each administrative action, and all actions will be recorded in a tamper-evident audit log that is replicated to an immutable storage location. The primary objective of this policy is to ensure that administrators who perform sensitive operations cannot later deny having executed them. Which security goal is this policy primarily intended to enforce?

Accepted Answer

Non-repudiation. The policy's use of unique digital signatures for each administrative action, combined with a tamper-evident audit log replicated to immutable storage, directly enforces non-repudiation. Non-repudiation ensures that an administrator cannot deny having performed a specific action because the digital signature cryptographically binds the action to the administrator's identity, and the immutable log prevents any subsequent alteration or deletion of the record. This is the primary security goal when the objective is to prevent denial of responsibility for sensitive operations.

Answer

Authorization

Answer

Authentication

Answer

Availability

Question 14

A finance portal lets one employee create a payment batch and approve it without review. Management wants to reduce fraud risk while keeping the workflow functional. Which two changes best achieve that goal? Select two.

Accepted Answer

Separate the create and approve functions into different roles or groups.. Option A is correct because it enforces separation of duties, a fundamental internal control that prevents a single user from both creating and approving a payment batch. By assigning the create and approve functions to different roles or groups, the organization ensures no single individual can complete a fraudulent transaction without collusion. This directly reduces fraud risk while maintaining workflow functionality by requiring two distinct actors.

Answer

Give the same user broader administrative access to avoid delays.

Answer

Allow the same role to perform both actions but log the activity after the fact.

Answer

Remove authentication so the process is faster.

Question 15

A company wants to make sure only approved administrators can view and rotate a shared encryption secret used by several applications. What is the best way to manage that secret?

Accepted Answer

Use a centralized secrets vault or key management system. A centralized secrets vault or key management system (KMS) like HashiCorp Vault or AWS KMS provides role-based access control (RBAC), audit logging, and automatic rotation of secrets. This ensures only approved administrators can view and rotate the shared encryption secret, while applications retrieve it via secure APIs without exposing it in code or files.

Answer

Store it in a shared spreadsheet

Answer

Put it directly in application source code

Answer

Email the secret only to trusted administrators

Question 16

A help desk analyst receives a ticket stating that an employee got an urgent text message from someone claiming to be the CEO. The message asked the employee to buy gift cards and send the redemption codes immediately. What attack is most likely taking place?

Accepted Answer

Smishing, because the attacker is using SMS or text messaging to trick the employee into taking an action.. Option B is correct because the attack uses SMS/text messaging as the delivery vector, which is the defining characteristic of smishing. The urgent request to buy gift cards and send redemption codes is a classic social engineering tactic designed to exploit the employee's trust in the CEO's authority, not to steal credentials or install malware directly.

Answer

Phishing, because the attacker is trying to steal information through a deceptive message sent to a user.

Answer

Vishing, because the attacker is using a phone call to pressure the employee into complying.

Answer

Baiting, because the attacker is tempting the user with a reward in exchange for cooperation.

Question 17

A finance application stores approval records for wire transfers. Auditors need to prove which employee approved each transfer, and employees must not be able to deny their approval later. Which security objective is best addressed by binding each approval to an individual identity and preserving immutable logs?

Accepted Answer

Nonrepudiation, because the organization needs proof that a specific person performed the approval.. Nonrepudiation ensures that an action cannot be denied by the person who performed it. By binding each approval to a unique employee identity and preserving immutable logs, the organization can irrefutably prove who approved each wire transfer, preventing employees from later denying their approval. This directly addresses the requirement for accountability and proof of action.

Answer

Confidentiality, because the approval records should be hidden from everyone except finance staff.

Answer

Availability, because the approval system must remain online during business hours.

Answer

Integrity, because the record must never be changed after it is saved.

Question 18

A finance team deploys a regulated workload to a public cloud. They want operating system login events, process activity, and network flow metadata to be retained in one central place for detection and investigation. Which action best supports this requirement with the least operational overhead?

Accepted Answer

Enable cloud-native logging and forward guest telemetry from the workload into a centralized security logging service or SIEM.. Option B is correct because it directly addresses the requirement to centralize OS login events, process activity, and network flow metadata from a public cloud workload. Cloud-native logging (e.g., AWS CloudTrail, Azure Monitor) can capture guest OS telemetry via agents (e.g., Amazon CloudWatch Agent, Azure Log Analytics agent) and forward it to a centralized security logging service or SIEM, minimizing operational overhead by leveraging built-in cloud services rather than custom infrastructure.

Answer

Rely on the cloud provider to automatically secure all guest operating systems and collect every log type by default.

Answer

Move the workload to a private data center so the cloud provider can no longer access any telemetry.

Answer

Disable host logging and rely only on perimeter firewall logs to reduce storage costs.

Question 19

A finance laptop is powered on, the user is still logged in, and it remains connected to Wi-Fi after a malware alert. What should the responder do first to preserve volatile evidence?

Accepted Answer

Collect volatile data such as memory, running processes, and active network connections.. Option B is correct because the laptop is powered on, the user is logged in, and it is connected to the network, meaning volatile data (memory contents, running processes, active network connections) is at immediate risk of being lost if the system is shut down or tampered with. The responder must collect this data first to preserve evidence of the malware's current state, including any malicious processes, network connections, and in-memory artifacts that would disappear on power loss.

Answer

Power the laptop off immediately to stop any further attacker activity.

Answer

Run a full antimalware scan before touching any other data.

Answer

Disconnect the power cable and remove the battery to prevent changes.

Question 20

A help desk analyst receives a phone call from someone claiming to be the CFO, who says their phone was lost while traveling and requests an immediate MFA reset and temporary bypass for payroll access. The caller knows the CFO's last name and the company name, but cannot answer the callback verification question. What attack technique is most likely being used?

Accepted Answer

Vishing. The caller is using voice communication to impersonate a high-level executive (CFO) and manipulate the help desk analyst into bypassing security controls, which is the defining characteristic of vishing (voice phishing). The request for an MFA reset and temporary bypass is a social engineering tactic to exploit the analyst's authority bias and urgency, and the inability to pass callback verification confirms the caller is not legitimate.

Answer

Phishing

Answer

Baiting

Answer

Watering hole attack