SY0-701 Practice Exam 60 — 20 Questions

Question 1

An HR assistant should be able to view employee records, but should not have access to payroll administration or IT server tools. Which access model is best for assigning permissions by job role?

Accepted Answer

Role-based access control. Role-based access control (RBAC) is the correct model because it assigns permissions based on job functions rather than individual users. In this scenario, the HR assistant role would be granted read/write access to employee records, while being explicitly denied access to payroll administration and IT server tools, ensuring least privilege and separation of duties. RBAC simplifies administration by grouping permissions into roles, which can be easily assigned or revoked as job responsibilities change.

Answer

Shared local administrator accounts

Answer

Open access for all employees

Answer

Biometric authentication

Question 2

A help desk analyst receives a phone call from someone claiming to be the CFO, who says their phone was lost while traveling and requests an immediate MFA reset and temporary bypass for payroll access. The caller knows the CFO's last name and the company name, but cannot answer the callback verification question. What attack technique is most likely being used?

Accepted Answer

Vishing. The caller is using voice communication to impersonate a high-level executive (CFO) and manipulate the help desk analyst into bypassing security controls, which is the defining characteristic of vishing (voice phishing). The request for an MFA reset and temporary bypass is a social engineering tactic to exploit the analyst's authority bias and urgency, and the inability to pass callback verification confirms the caller is not legitimate.

Answer

Phishing

Answer

Baiting

Answer

Watering hole attack

Question 3

A security manager wants evidence that annual security awareness training was completed by employees. Which artifact is the best proof?

Accepted Answer

A training completion report exported from the learning system. A training completion report exported from the learning system is the best proof because it provides a verifiable, timestamped record of each employee's completion status, including user IDs, course names, completion dates, and scores. This artifact directly demonstrates that the training was actually completed, not just assigned or attended, and can be audited against the organization's training policy.

Answer

A copy of the company logo used on the training slides

Answer

A list of office supplies purchased last quarter

Answer

A screenshot of the company's public homepage

Question 4

In the finance workflow, one employee can create a payment batch but cannot approve it, and the same person also cannot view employee records that are unrelated to the task. Which two principles are being enforced? Select two.

Accepted Answer

Separation of duties, because creation and approval are split between different roles.. Separation of duties is enforced by splitting the payment creation and approval functions between different roles, preventing a single employee from committing fraud by creating and approving a payment without oversight. This principle reduces the risk of unauthorized or malicious actions by requiring collusion for abuse.

Answer

Least privilege, because every user should have no more than one permission overall.

Answer

Defense in depth, because multiple security technologies are layered around the finance system.

Answer

Zero trust, because the employee must always be treated as untrusted by the network.

Question 5

A security analyst is reviewing the results of a dynamic application security test (DAST) on a new e-commerce application. The report indicates that the application's product search functionality is vulnerable to blind SQL injection. The analyst is tasked with recommending a remediation to the development team. The developers currently concatenate user input directly into SQL queries. Which of the following recommendations would most effectively and permanently mitigate this vulnerability?

Accepted Answer

Replace dynamic SQL queries with parameterized prepared statements.. Parameterized prepared statements separate SQL logic from user input, ensuring that input is always treated as data, not executable code. This permanently prevents SQL injection by design, regardless of the input content, unlike input filtering or WAF rules which can be bypassed.

Answer

Implement a web application firewall (WAF) rule to block suspicious SQL keywords in search parameters.

Answer

Sanitize user input by escaping single quotes and other special characters before concatenation.

Answer

Encode all user input using HTML entity encoding before database operations.

Question 6

A regulated analytics workload must run in a public cloud with the strongest practical tenant isolation while avoiding management of physical servers. The workload should also remain off the public internet. Which two deployment choices best fit? Select two.

Accepted Answer

Run the workload on a dedicated host or dedicated instance.. A dedicated host or dedicated instance provides the strongest practical tenant isolation in a public cloud by ensuring that the underlying physical server is not shared with any other customer. This meets the regulatory requirement for strong isolation while avoiding the need to manage physical servers, as the cloud provider still handles hardware maintenance. The dedicated instance model (e.g., AWS Dedicated Instances) offers hardware-level isolation at the instance level, while a dedicated host gives you visibility and control over the physical server, both without requiring you to manage the server itself.

Answer

Use shared tenancy with security groups only.

Answer

Assign an elastic IP so administrators can reach the workload directly from anywhere.

Answer

Expose the workload through a public load balancer to simplify connectivity.

Question 7

A company can patch only one of two internet-facing systems this week. System 1 has a critical vulnerability but is reachable only through the corporate VPN during maintenance windows. System 2 has a medium vulnerability and supports the public payment site, which shows active attack traffic every day. Which system should be prioritized first?

Accepted Answer

System 2, because it is exposed to the public and directly supports a business-critical service. System 2 should be prioritized because it is directly exposed to the public internet and supports a business-critical payment service that is under active attack daily. Even though System 1 has a critical vulnerability, it is only reachable through the corporate VPN during maintenance windows, which significantly reduces its attack surface and exploitability. In risk management, the likelihood of exploitation and business impact often outweigh the CVSS base score alone, making System 2 the higher priority.

Answer

System 1, because the vulnerability is rated critical

Answer

Neither system, because both are internet-facing and must wait for the next maintenance cycle

Answer

System 1, because VPN access always makes a vulnerability more dangerous than a public application issue

Question 8

A SOC analyst confirms that a workstation is encrypting local files and attempting SMB connections to nearby hosts. The user is still logged in, and the business wants to limit spread without destroying evidence. What is the best immediate action?

Accepted Answer

Quarantine the workstation from the network using EDR or switch port containment. Quarantining the workstation via EDR or switch port containment immediately stops the SMB-based lateral movement and further encryption of network shares, while preserving the volatile evidence (memory, running processes, encryption keys) for forensic analysis. This aligns with the business requirement to limit spread without destroying evidence, as powering off or reimaging would lose critical forensic data.

Answer

Power the workstation off immediately and leave it in place

Answer

Run a full antivirus scan while the workstation remains connected

Answer

Wipe and reimage the workstation from a standard build image

Question 9

Based on the exhibit, which risk treatment should the security manager recommend first?

Accepted Answer

Mitigate the risk by replacing or isolating the appliance and removing direct internet exposure.. The exhibit shows a legacy file transfer appliance with direct internet exposure and known unpatched vulnerabilities. The most immediate and effective risk treatment is to mitigate the risk by replacing or isolating the appliance and removing its direct internet exposure. This directly reduces the likelihood of exploitation by eliminating the attack surface, which aligns with the principle of defense-in-depth and is the first step before considering acceptance, avoidance, or transfer.

Answer

Accept the risk and document it for the next quarterly review.

Answer

Avoid the risk by permanently shutting down the file transfer service.

Answer

Transfer the risk by purchasing cyber insurance and keeping the current configuration.

Question 10

Based on the exhibit, which backup protection change best improves ransomware resilience and protects the backup media if it is stolen?

Accepted Answer

Add an immutable offline or air-gapped copy with separate backup credentials and regular restore testing.. Implementing an immutable, offline or air-gapped backup copy with separate credentials ensures that even if an attacker compromises the primary backup system or steals the media, they cannot modify or delete the backups. Regular restore testing verifies the integrity and recoverability of the data, which is critical for ransomware resilience. This approach aligns with the 3-2-1 backup rule and NIST SP 800-184 guidance for cyber recovery.

Answer

Enable backup encryption only, because encrypted backups cannot be read if stolen.

Answer

Move the USB drive into a different cabinet inside the same server room.

Answer

Reduce the retention period so backups consume less storage space.

Question 11

A remote user's laptop begins launching a legitimate-looking "System Update" application at login. After the update window appears, the browser homepage changes, outbound traffic increases, and the user later reports that saved passwords are being used in unauthorized logins. Which malware type is the most likely primary infection?

Accepted Answer

Trojan, because it is disguised as a harmless utility while delivering malicious payloads.. The malware is disguised as a legitimate 'System Update' application, which is the classic behavior of a Trojan. Trojans rely on social engineering to trick users into executing them, and once activated, they can deliver secondary payloads such as password stealers, browser hijackers, or backdoors. In this scenario, the Trojan likely installed a keylogger or credential harvester to exfiltrate saved passwords, changed browser settings via registry or configuration file manipulation, and increased outbound traffic to a command-and-control (C2) server.

Answer

Worm, because it is spreading automatically to nearby systems on the network.

Answer

Ransomware, because files would be encrypted and a payment demand would appear.

Answer

Rootkit, because the malware is hiding its own presence by modifying kernel behavior.

Question 12

A security analyst receives an automated alert indicating that a standard user account logged in from a geographic location that is unusual for the user, and the login occurred at 3:00 AM local time. The analyst has not yet verified whether this was a successful login or if any additional suspicious activity occurred. According to standard incident response procedures, what should the analyst do NEXT?

Accepted Answer

Review the account's recent activity for signs of compromise.. According to standard incident response procedures, after receiving an alert about unusual login activity, the analyst should first review the account's recent activity to determine whether the login was successful and if any compromise occurred. This is part of the identification/validation phase before taking containment actions.

Answer

Disable the user account immediately and reset the password.

Answer

Conduct a full forensic analysis of the user's workstation.

Answer

Report the incident to law enforcement.

Question 13

A regulated analytics workload must run in the cloud with the strongest isolation from other customers, but the company does not want to manage its own physical server room. Which placement is most appropriate?

Accepted Answer

A dedicated host or equivalent single-tenant compute placement in the provider's environment.. A dedicated host or single-tenant compute placement ensures that the physical server is not shared with any other customer, providing the strongest isolation required for regulated workloads. This model meets the compliance need for physical separation while still being a cloud service, so the company avoids managing its own server room.

Answer

A public subnet with an internet gateway so the workload can be reached directly.

Answer

A shared-tenancy virtual machine in the provider's default compute pool.

Answer

A serverless function because it removes all underlying infrastructure concerns.

Question 14

After building a new file server, an administrator reviews the security baseline and notices that a remote desktop service is enabled even though no one uses it. What is the best hardening action?

Accepted Answer

Disable the unnecessary service. The best hardening action is to disable the unnecessary remote desktop service because it reduces the attack surface. An enabled but unused service, such as Remote Desktop Protocol (RDP) on TCP/3389, is a common vector for brute-force attacks and exploits (e.g., BlueKeep, CVE-2019-0708). Disabling it eliminates this risk without affecting legitimate operations.

Answer

Keep the service enabled in case someone needs it later

Answer

Change the server name to make it harder to find

Answer

Increase disk space on the server

Question 15

A web application must keep running if one application server fails. Management wants the simplest design that automatically switches traffic to a healthy server. Which two choices support that goal? Select two.

Accepted Answer

Place the application behind a load balancer with health checks.. A load balancer with health checks can automatically detect a failed application server and redirect traffic to healthy servers, ensuring continuous availability. This is the simplest design that meets the requirement for automatic failover without manual intervention. Health checks typically use HTTP/HTTPS probes or TCP port checks to verify server responsiveness.

Answer

Run the application on a single server with nightly backups.

Answer

Disable health checks to avoid false failovers.

Answer

Put the database on the public internet for easier access.

Question 16

A vulnerability scan reports that a Windows file share has SMB signing disabled and anonymous read access is permitted to one directory containing payroll exports. No exploitation has been observed yet. Which action best reduces exposure with minimal business impact?

Accepted Answer

Enable SMB signing and remove anonymous access to the share.. Enabling SMB signing prevents man-in-the-middle attacks that could tamper with file transfers, and removing anonymous read access eliminates unauthorized visibility into sensitive payroll data. These changes directly address the two vulnerabilities (SMB signing disabled and anonymous read access) without disrupting legitimate file-sharing operations, thus minimizing business impact.

Answer

Remove all backup jobs until the scan is cleared.

Answer

Disable the file server and rebuild it from scratch immediately.

Answer

Increase the directory quota so the share cannot overflow.

Question 17

A branch office needs to send a confidential design document to headquarters over an untrusted network. Headquarters already has the public/private key pair available for document exchange. Which method is most appropriate to keep the file confidential during transit without first sharing a secret key?

Accepted Answer

Encrypt the file with headquarters' public key. Encrypting the file with headquarters' public key ensures that only headquarters, possessing the corresponding private key, can decrypt and read the file. This method provides confidentiality over an untrusted network without requiring a pre-shared secret key, as the public key can be freely distributed.

Answer

Publish a hash of the file for comparison

Answer

Sign the file with the branch office private key only

Answer

Compress the file before sending it

Question 18

A vulnerability scan finds two issues: a critical deserialization flaw on a non-production lab server behind a VPN, and a high-severity privilege escalation flaw on the production jump server that administrators use to reach the rest of the environment. Which should be remediated first?

Accepted Answer

The jump server flaw, because it affects a production administrative access point. The jump server flaw must be remediated first because it is a high-severity privilege escalation vulnerability on a production system that administrators use as a gateway to the entire environment. Compromise of this jump server would give an attacker administrative access to all connected production systems, making the business impact far greater than the critical deserialization flaw on an isolated non-production lab server. In risk-based prioritization, severity alone is insufficient; the asset's role, exposure, and potential blast radius must be considered.

Answer

The lab server flaw, because critical severity always comes first

Answer

Neither issue, because VPN access reduces the need for urgent remediation

Answer

The lab server flaw, because non-production systems are always easier to patch later

Question 19

Employees must sign in to several cloud applications with their corporate account, and terminated users should lose access without separate password resets in each app. What is the best solution?

Accepted Answer

Use federation with single sign-on from a central identity provider.. Federation with single sign-on (SSO) from a central identity provider (IdP) allows users to authenticate once using their corporate account, and the IdP issues security tokens (e.g., SAML assertions or OIDC tokens) that each cloud application trusts. When a user is terminated, the administrator disables the account in the IdP, and all applications immediately reject the user's tokens, eliminating the need for separate password resets in each app.

Answer

Create a separate local username and password in every cloud application.

Answer

Store the same shared password in a password manager for all applications.

Answer

Allow each application to authenticate users only by device MAC address.

Question 20

Employees use one corporate login to sign in to email, the ticketing portal, and the HR application. After signing in once, the other apps accept the same identity without separate passwords. What capability is this?

Accepted Answer

Single sign-on (SSO). Single sign-on (SSO) allows a user to authenticate once and gain access to multiple applications without re-entering credentials. In this scenario, the corporate login provides a token (e.g., Kerberos ticket or SAML assertion) that is accepted by the email, ticketing portal, and HR application, eliminating the need for separate passwords. This is the core capability of SSO.

Answer

Federation

Answer

Multi-factor authentication (MFA)

Answer

Session timeout