SY0-701 Practice Exam 59 — 20 Questions

Question 1

Based on the exhibit, what should the security team recommend for the finance workstation pilot?

Accepted Answer

Require the vendor to provide the missing supply-chain documentation or an approved compensating-control plan before approval.. The exhibit indicates missing supply-chain documentation for the finance workstation pilot. Without this documentation, the security team cannot verify the integrity and provenance of the hardware and software, which is critical for a pilot involving sensitive financial data. Requiring the vendor to provide the missing documentation or an approved compensating-control plan ensures compliance with supply-chain risk management policies before approval.

Answer

Approve the pilot because the workstations are limited to read-only data and the application is signed.

Answer

Disable segmentation so the pilot can access more systems if troubleshooting is needed.

Answer

Let the finance director sign an informal email and skip the security review.

Question 2

During business impact analysis interviews, the team needs two inputs that help determine which business services must recover first after an outage. Which two inputs are the most useful? Select two.

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) defines the maximum acceptable downtime for a business service, directly indicating the urgency of recovery. Recovery Point Objective (RPO) defines the maximum acceptable data loss, which influences the recovery strategy and priority. Together, they provide the two critical inputs needed to sequence recovery efforts after an outage.

Answer

Annualized Loss Expectancy (ALE)

Answer

Mean Time Between Failures (MTBF)

Answer

Control self-assessment score

Question 3

The SOC has contained a mailbox compromise by resetting the password and revoking active sessions. Investigation shows the attacker created an automatic forwarding rule and added an OAuth consent grant. What should happen next to eradicate the threat?

Accepted Answer

Remove the malicious forwarding rule and review or revoke suspicious OAuth app grants.. The immediate next step after containment is to remove the attacker's persistence mechanisms. The malicious forwarding rule (which exfiltrates emails via SMTP) and the OAuth consent grant (which provides persistent API access) must be removed to fully eradicate the threat. Simply resetting the password and revoking sessions does not remove these backdoors, as OAuth grants persist independently of user credentials.

Answer

Notify all employees to be more careful with email before taking any technical steps.

Answer

Delete the mailbox and create a new account for the user immediately.

Answer

Restore the user's messages from backup and reopen access without further review.

Question 4

Employees in a lobby say their phones automatically connected to a wireless network named CorpWiFi, even though the legitimate access point was offline. They were then shown a fake sign-in page. What threat is this?

Accepted Answer

An evil twin access point impersonating the real corporate wireless network. This is an evil twin attack. The attacker sets up a rogue access point broadcasting the same SSID (CorpWiFi) as the legitimate network. When the real access point goes offline, client devices automatically connect to the stronger signal of the rogue AP, allowing the attacker to present a fake captive portal to harvest credentials.

Answer

A Bluetooth replay attack that reuses captured pairing data

Answer

A cloud misconfiguration exposing a storage bucket to the internet

Answer

A dependency compromise in a software library used by the company portal

Question 5

An HR analyst needs to send a payroll reconciliation file to an external auditor. The file contains employee names, SSNs, bank account numbers, and salary details, but the auditor only needs employee IDs, payment totals, and a control total. What should the analyst do first?

Accepted Answer

Redact or remove unnecessary sensitive fields before sharing the minimum required data.. The principle of data minimization requires that only the necessary data (employee IDs, payment totals, control total) be shared with the external auditor. Redacting or removing unnecessary sensitive fields (SSNs, bank account numbers, salary details) reduces the risk of exposure and complies with privacy regulations. This step should occur before any encryption or transmission to ensure the auditor never receives data they do not need.

Answer

Encrypt the full spreadsheet and send it without changing the contents.

Answer

Compress the file into a password-protected archive and email the password separately.

Answer

Copy the file to a personal cloud storage account to make sharing easier.

Question 6

Procurement is reviewing a new payroll SaaS provider. The business wants independent evidence that the vendor's controls were designed and operating effectively over the last six months. Which document should the security team request?

Accepted Answer

A SOC 2 Type II report from an independent auditor.. A SOC 2 Type II report provides independent assurance that a service organization's controls are not only designed appropriately (Type I) but also operating effectively over a specified period, typically six to twelve months. This aligns directly with the procurement team's requirement for evidence of control effectiveness over the last six months, making it the correct choice for evaluating a SaaS vendor's security posture.

Answer

A software patch list showing recent updates installed on the vendor's servers.

Answer

A penetration test screenshot showing one web application vulnerability was fixed.

Answer

An internal email from the vendor's security manager stating that controls are mature.

Question 7

A SOC analyst is reviewing logs from a Windows domain controller and notices a large number of failed logon attempts (Event ID 4625) from a single source IP address within a five-minute window. The account names used are random strings such as "a1b2c3", "x9y8z7", etc. The analyst then checks the source IP and finds it is a known external address from a foreign country. Which of the following is the most appropriate next step for the analyst to take?

Accepted Answer

Investigate whether any of the attempted accounts correspond to actual domain users.. The analyst must first determine if any of the randomly generated account names match existing domain user accounts. If a match is found, it indicates a targeted password-spraying or brute-force attack against valid accounts, requiring immediate account lockdown and credential reset. This investigation step aligns with the incident response process of identification before containment or escalation.

Answer

Immediately block the IP address at the perimeter firewall.

Answer

Run a full antivirus scan on the domain controller.

Answer

Notify the company's legal department for law enforcement involvement.

Question 8

A branch office has users, finance workstations, printers, and IP phones on one flat LAN. After a malware outbreak on a user PC, management wants to limit lateral movement without blocking printing or voice traffic. What should the network team implement?

Accepted Answer

Create separate VLANs for device groups and apply inter-VLAN ACLs that permit only required traffic.. Segmenting devices into separate VLANs (e.g., users, finance, printers, IP phones) and applying inter-VLAN ACLs restricts lateral movement by default while permitting only necessary traffic like printing (TCP 9100) and voice (RTP/UDP 16384-32767). This aligns with the principle of least privilege and zero trust segmentation, preventing malware from spreading across the flat LAN without disrupting critical services.

Answer

Move all devices into one larger subnet and rely on endpoint antivirus for separation.

Answer

Place all devices behind a single proxy server and block all internal east-west traffic.

Answer

Enable port security on the switch and disable all VLAN tagging to reduce complexity.

Question 9

A baseline review found that standard developer accounts are local administrators, unsigned tools can run from user profile folders, and reimaged systems still end up with unauthorized persistence. Which two changes best improve hardening while preserving developer work? Select two.

Accepted Answer

Remove local administrator rights from standard user accounts.. Removing local administrator rights from standard developer accounts enforces the principle of least privilege (PoLP). This prevents developers from making unauthorized system-wide changes, such as installing unsigned tools or creating persistence mechanisms, while still allowing them to perform their work with standard user permissions. This directly addresses the baseline review finding that standard developer accounts are local administrators, which is a common security misconfiguration.

Answer

Turn off logging to preserve disk space.

Answer

Allow unrestricted browser extension installs.

Answer

Merge all developer and production systems into one VLAN.

Question 10

After a new MFA policy rollout, the SIEM generates an alert for five failed logins to a SaaS admin portal from one IP, followed by a successful login to the same account from an IP in another country. The account owner says they were in meetings all day. What should the analyst do first?

Accepted Answer

Correlate identity provider, VPN, and endpoint logs to validate whether the activity matches the user's normal pattern.. The alert shows a successful login after five failures from a different country, which is a classic indicator of a potential account takeover. The analyst must correlate identity provider logs (e.g., Okta, Microsoft Entra ID) for authentication details, VPN logs for network origination, and endpoint logs for device posture to determine if the successful login matches the user's normal behavior. This step validates whether the activity is legitimate or malicious before taking any irreversible action.

Answer

Disable the account immediately without checking any other logs.

Answer

Delete the alert because MFA was enabled and the login eventually succeeded.

Answer

Reimage the user's laptop to remove any possible malware right away.

Question 11

Which four of the following are essential considerations when designing a secure cloud architecture in a hybrid environment? (Choose four.)

Accepted Answer

Configuring identity federation with single sign-on (SSO) for centralized access control. Ensuring data encryption both at rest and in transit is critical in a hybrid environment to protect sensitive data from exposure during movement between cloud and on-premises resources and while stored. This includes using TLS 1.2/1.3 for data in transit and AES-256 for data at rest, addressing compliance requirements and mitigating interception risks.

Answer

Placing all cloud resources in a single availability zone to reduce latency

Answer

Using a shared secret key for all API authentication to simplify integration

Question 12

A hospital's claims portal has two open risks. Risk A is an internet-facing login page with a low-severity software flaw, but monitoring shows a steady increase in automated login attempts. Risk B is an internal file share with a medium-severity patch gap, but only a small admin group can access it and no exploitation is observed. Leadership can fund only one remediation this month. Which risk should be prioritized first?

Accepted Answer

Prioritize Risk A because it is exposed to the internet and already shows active attack interest.. Risk A should be prioritized because the internet-facing login page is exposed to the public attack surface, and the steady increase in automated login attempts indicates active reconnaissance or credential-stuffing attacks. Even though the software flaw is low severity, the combination of internet exposure and active attacker interest significantly elevates the likelihood of exploitation, making it a higher priority than an internal file share with no observed exploitation.

Answer

Prioritize Risk B because a medium-severity flaw is always more important than a low-severity flaw.

Answer

Accept Risk A because no confirmed compromise has occurred yet.

Answer

Transfer Risk A to an insurer because public-facing exposure cannot be reduced.

Question 13

Based on the exhibit, which security principle is the proposed workflow most directly enforcing?

Accepted Answer

Separation of duties, because no single person can create, approve, and implement the same production change.. The proposed workflow enforces separation of duties by requiring three distinct roles—requester, approver, and implementer—to complete a single firewall change. No single person can both create and approve the change, nor can they implement it without prior approval. This directly prevents any one individual from having end-to-end control over a production change, which is the core of separation of duties.

Answer

Least privilege, because each person gets only the minimum access needed for the task.

Answer

Defense in depth, because multiple layers of security are added around firewall changes.

Answer

Need-to-know, because the ticket is visible only to assigned people.

Question 14

An administrator pushed a firewall rule change to allow a new vendor IP range during business hours. Minutes later, payroll users lost access to an internal service. Which change management practice would have best reduced the impact?

Accepted Answer

Test the change in a staging environment and include a rollback plan in the request.. Testing the change in a staging environment first would have revealed any unintended side effects, such as ACL conflicts that blocked payroll traffic. Including a rollback plan ensures that if the change causes issues in production, the administrator can quickly revert the firewall rule to restore service. This aligns with the change management process of minimizing impact through controlled testing and contingency planning.

Answer

Apply changes directly in production so they take effect as quickly as possible.

Answer

Avoid documenting the change until after the maintenance window ends.

Answer

Use verbal approval from the payroll manager instead of the normal ticket process.

Question 15

Based on the exhibit, what is the best governance improvement?

Data handling procedure:
- Managers may approve external sharing exceptions verbally.
- Staff record exceptions in email threads.
- No retention period is defined for exception evidence.

Audit note: multiple exceptions could not be traced to an approver.

Accepted Answer

Replace verbal and email exceptions with a documented approval workflow and retained exception records.. The current procedure lacks a documented approval workflow and retention policy, which directly caused the audit finding that exceptions could not be traced to an approver. Implementing a formal, auditable process ensures non-repudiation and compliance with data handling governance, addressing the root cause rather than relying on informal verbal or email-based approvals.

Answer

Allow each team to decide its own exception format to increase flexibility.

Answer

Remove exception handling entirely so no external sharing can ever occur.

Answer

Keep the procedure unchanged and rely on additional awareness training alone.

Question 16

A security analyst is investigating a potential data exfiltration incident. Which three of the following indicators are most commonly associated with a data exfiltration attack? (Choose three.)

Accepted Answer

Unusual outbound network traffic, especially during non-business hours. Unusual outbound network traffic, especially during non-business hours, is a classic indicator of data exfiltration because attackers often schedule transfers when monitoring is less active. Large volumes of data being transferred to an external IP address directly suggests that sensitive data is being moved outside the organization. A sudden increase in DNS queries to a known malicious domain can indicate DNS tunneling, where data is encoded in DNS requests to bypass traditional network controls.

Answer

Multiple failed login attempts from a single user account

Answer

A spike in CPU usage on a database server

Answer

An employee receiving a phishing email with a malicious attachment

Question 17

Based on the exhibit, which action is required to keep the backups restorable after the key-encryption key rotation?

Accepted Answer

Rewrap or keep access to the old KEK version until existing DEKs are migrated.. When a key-encryption key (KEK) is rotated, existing data-encryption keys (DEKs) that were wrapped with the old KEK version become unreadable unless the old KEK is retained or the DEKs are re-wrapped with the new KEK. Option B ensures that backups remain restorable by either keeping the old KEK version accessible or migrating DEKs to the new KEK, maintaining the chain of trust for decryption.

Answer

Delete vault-kek-v1 immediately so only the newest key remains active.

Answer

Re-encrypt the entire backup repository with a single shared password.

Answer

Export vault-kek-v2 into the backup files so each object stores the new key directly.

Question 18

A procurement team is evaluating a payroll SaaS vendor. They want independent evidence that the vendor's controls were designed and operating effectively over the last six months, not just at a single point in time. Which report should they request?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides independent assurance that a vendor's controls related to security, availability, processing integrity, confidentiality, or privacy were designed and operating effectively over a period of time (typically 6–12 months). This matches the procurement team's requirement for evidence of sustained control effectiveness, not just a point-in-time snapshot.

Answer

SOC 1 Type I report

Answer

Non-disclosure agreement

Answer

Network penetration test letter

Question 19

Sales staff use company laptops on public Wi-Fi and travel frequently. The company wants the disk contents unreadable if a laptop is stolen, even if the drive is removed and placed in another system. Which control is the best fit?

Accepted Answer

Enable full-disk encryption with a hardware-backed key store such as a TPM, preferably with a pre-boot PIN.. Full-disk encryption (FDE) with a hardware-backed key store like a TPM ensures that the entire disk contents are encrypted at rest. Even if the drive is removed and placed in another system, the decryption key remains bound to the original TPM, and a pre-boot PIN adds an additional authentication factor, making the data unreadable without both the TPM and the correct PIN.

Answer

Require a screen lock after five minutes of inactivity.

Answer

Encrypt only the most sensitive folders with file-level encryption.

Answer

Rely on remote wipe because the device will usually connect to the internet again.

Question 20

A packet capture from a branch office shows the default gateway IP mapped to a MAC address that does not belong to the router. The same suspicious MAC also answers for the DNS server IP, and gratuitous ARP replies appear every 30 seconds. Which two attacks best match this evidence? Select two.

Accepted Answer

ARP spoofing or poisoning is occurring on the local network.. The evidence shows the default gateway IP is mapped to a MAC address that does not belong to the router, and the same suspicious MAC also answers for the DNS server IP. This is a classic indicator of ARP spoofing or poisoning, where an attacker sends forged ARP replies to associate their MAC address with the IP addresses of critical network devices, such as the gateway and DNS server. Gratuitous ARP replies every 30 seconds further confirm an active ARP poisoning attack, as the attacker repeatedly broadcasts these unsolicited replies to maintain the poisoned ARP cache entries on victim hosts.

Answer

The network is experiencing a SYN flood against the gateway.

Answer

An external host is performing broad port scanning on public services.

Answer

A password-spraying campaign is targeting remote logins.