SY0-701 Practice Exam 60 — 20 Questions

Question 1

A help desk technician receives a call from a user who says many of their documents now have strange file extensions and a ransom note appeared on the desktop. The files will not open. What type of malware is the user most likely experiencing?

Accepted Answer

Ransomware that encrypts files and demands payment for recovery. The user's symptoms—unopenable files with strange extensions and a ransom note—are classic indicators of ransomware. Ransomware encrypts files using a symmetric key (e.g., AES-256) and then demands payment, typically in cryptocurrency, to provide the decryption key. This matches the scenario exactly, as the files are rendered inaccessible and a note is left behind.

Answer

Spyware that silently records user activity over time

Answer

A worm that spreads mainly by scanning for other hosts

Answer

A rootkit that hides malicious processes from the operating system

Question 2

A firewall analyst reviews logs and sees one external IP address sending connection attempts to TCP ports 22, 80, 139, 445, and 3389 on dozens of internal hosts every few seconds. No payloads are delivered and no sessions are established. What is the most likely activity?

Accepted Answer

Port scanning, because the source is systematically probing many ports and hosts for exposed services.. The observed behavior—a single external IP sending connection attempts to multiple TCP ports (22, 80, 139, 445, 3389) across many internal hosts at regular intervals—is the hallmark of a port scan. The absence of payload delivery or session establishment confirms the attacker is only probing for open services, not attempting exploitation or data transfer. This matches the definition of a reconnaissance activity, specifically a horizontal port scan targeting common service ports.

Answer

Reflection-based denial-of-service, because the attacker is using third-party systems to amplify traffic.

Answer

Man-in-the-middle, because the attacker is intercepting communications between internal hosts.

Answer

Protocol abuse, because the attacker is sending malformed traffic to crash services.

Question 3

A help desk technician reviews a voicemail in which the caller claims to be from the security team, says the user will be locked out unless they read back a one-time passcode, and leaves a callback number. What type of attack is this?

Accepted Answer

Vishing, because the attacker is using voice communication to pressure the user.. Option B is correct because vishing (voice phishing) uses voice communication—such as phone calls or voicemails—to trick victims into revealing sensitive information. In this scenario, the attacker leaves a voicemail claiming to be from the security team and pressures the user to read back a one-time passcode, which is a classic vishing tactic that exploits trust and urgency over voice channels.

Answer

Smishing, because the attacker is using a text message with a link.

Answer

Baiting, because the attacker is offering a reward to entice the user.

Answer

Pretexting, because the attacker invented a role and story.

Question 4

A help desk team needs to update desktops in a call center without interrupting callers during peak hours. What is the best operational approach?

Accepted Answer

Schedule the updates during an approved maintenance window. Scheduling updates during an approved maintenance window ensures that desktops are updated during a period of low activity, minimizing disruption to call center operations. This approach aligns with change management best practices, allowing for controlled deployment and rollback if issues arise, and avoids the performance degradation or reboots that could interrupt active calls.

Answer

Deploy the updates immediately to all desktops at once

Answer

Ask each user to install updates whenever they have time

Answer

Disable update notifications permanently

Question 5

A firewall ACL must be modified in production to allow a vendor update server. The team wants to minimize the chance of accidentally blocking payroll traffic. Which change-management step is best before applying the rule?

Accepted Answer

Test the proposed rule in a staged policy set and keep a rollback plan ready.. Option B is correct because testing the proposed rule in a staged policy set allows the team to verify that the new ACL entry does not inadvertently match and drop payroll traffic before it is applied to the production firewall. Keeping a rollback plan ready ensures that if the rule causes unexpected blocking, the previous ACL can be restored immediately, minimizing downtime. This aligns with the change-management principle of validating changes in a controlled environment to prevent service disruption.

Answer

Apply the rule immediately and monitor the help desk for complaints.

Answer

Remove all deny rules temporarily so the vendor traffic can pass cleanly.

Answer

Disable logging during the change to avoid slowing down the firewall.

Question 6

A cloud-hosted API lets users supply a URL for the service to fetch an image. Shortly after release, logs show requests to 169.254.169.254 and internal admin addresses. What control best reduces this risk?

Accepted Answer

Restrict outbound requests to an allowlist and block internal address ranges.. Option B is correct because restricting outbound requests to an allowlist and blocking internal address ranges directly mitigates the Server-Side Request Forgery (SSRF) vulnerability. The requests to 169.254.169.254 (the AWS/GCP/Azure metadata endpoint) and internal admin addresses indicate an attacker is using the API to probe internal services. An allowlist ensures the API only connects to trusted external hosts, while blocking private and link-local ranges prevents access to internal infrastructure.

Answer

Allow the API to follow any redirect so it works with more image sources.

Answer

Store the fetched image in encrypted form before sending it to users.

Answer

Increase the session timeout to reduce repeated logins by legitimate users.

Question 7

A help desk technician reviews a ticket where a user says they logged out of the payroll portal, but another employee who found the session cookie in a browser debug log could still access the account until the session expired. Which attack best matches this behavior?

Accepted Answer

Session hijacking, because a stolen session token was reused to impersonate the user.. Option A is correct because the described behavior—where a session cookie stolen from a browser debug log is reused by another employee to access the payroll portal—is a classic session hijacking attack. Session hijacking occurs when an attacker captures a valid session token (e.g., a cookie containing a session ID) and uses it to impersonate the authenticated user, bypassing the need for credentials. In this case, the session cookie was not invalidated upon logout, allowing the attacker to reuse it until the session's expiration time.

Answer

Pretexting, because the attacker pretended to be an authorized employee on a phone call.

Answer

CSRF, because the victim was tricked into sending unwanted requests from their browser.

Answer

Insecure deserialization, because serialized objects were accepted without validation.

Question 8

A help desk analyst can reset passwords in the ticketing portal but cannot view payroll records, edit user profiles, or access other HR functions. Which security principle is the organization applying?

Accepted Answer

Least privilege. The help desk analyst is granted only the permissions necessary to perform their job function—resetting passwords—while all other HR functions are explicitly denied. This is the core definition of least privilege: each user or system component receives the minimum set of access rights needed to complete their tasks. By restricting the analyst’s account to password reset operations only, the organization reduces the attack surface and limits potential damage from compromised credentials or insider misuse.

Answer

Defense in depth

Answer

Separation of duties

Answer

Zero trust

Question 9

A help desk team needs to reset passwords on servers during incidents, but they should not keep standing administrator rights all day. Which two controls best support this requirement? Select two.

Accepted Answer

Use privileged access management (PAM) to control and audit elevated access.. Privileged Access Management (PAM) solutions enforce just-in-time (JIT) elevation, time-bound access, and session auditing. This allows the help desk team to obtain administrator rights only when needed for incident response, eliminating the need for standing admin rights while maintaining full audit trails.

Answer

Share one permanent domain administrator account with the whole team.

Answer

Use a regular user account and disable all authentication logging.

Answer

Give every help desk user full access all the time so work is faster.

Question 10

A microservices team stores service private keys inside container images and renews certificates manually once a year. Security wants to reduce damage if a node is compromised and keep certificate trust manageable at scale. Which two changes are the best fit? Select two.

Accepted Answer

Store private keys in an HSM-backed secrets manager or equivalent key vault.. Option A is correct because storing private keys in an HSM-backed secrets manager (e.g., AWS KMS, Azure Key Vault, or HashiCorp Vault with an HSM module) ensures that keys never leave the secure boundary of the HSM. This prevents an attacker who compromises a container or node from extracting the private key material, as the key is used for cryptographic operations via API calls rather than being stored in the filesystem. This directly reduces the blast radius of a node compromise.

Answer

Embed private keys in the container image so redeployments are simpler.

Answer

Replace the CA with a self-signed certificate on every node.

Answer

Convert the key file to base64 before storing it in the image.

Question 11

A help desk technician receives an SMS claiming to be from the mobile carrier. The message says the user's corporate number will be suspended unless they open a link and confirm an MFA code. The user has not reported any account issues. What attack is this?

Accepted Answer

Smishing. Smishing is a phishing attack conducted via SMS (Short Message Service). The message impersonates the mobile carrier, creates urgency by threatening suspension, and lures the user to a malicious link to capture MFA codes or credentials. Since the attack vector is SMS, not email or voice, this is smishing.

Answer

Spear phishing

Answer

Vishing

Answer

Baiting

Question 12

A monthly vulnerability scan identifies a critical vulnerability on a public-facing VPN appliance, but the vendor says no patch is available yet. The service must remain online for remote workers. What is the best compensating control to reduce risk right away?

Accepted Answer

Apply virtual patching or traffic filtering to block exploit attempts until remediation is possible.. Option C is correct because virtual patching or traffic filtering (e.g., via an IPS or WAF) provides immediate, compensating protection by inspecting and blocking exploit traffic targeting the vulnerability, without requiring the vendor to release a patch. This allows the VPN appliance to remain online for remote workers while reducing the risk of exploitation until a permanent fix is available.

Answer

Ignore the finding until the next quarterly review because there is no patch available.

Answer

Move the appliance to a less critical VLAN and leave all access rules unchanged.

Answer

Disable logging so that attackers cannot learn the appliance version from log data.

Question 13

A Linux host is patched, but the scanner still flags the package as vulnerable. The vendor advisory says the distribution backported the fix, so the package version did not change. What should the analyst do before closing the ticket?

Accepted Answer

Verify the vendor advisory and package metadata, then document evidence of the fixed build.. Option A is correct because when a vendor backports a security fix to an older package version without incrementing the version number, the vulnerability scanner may still flag the package based on its version string. The analyst must verify the vendor advisory and package metadata (e.g., using `rpm -q --changelog` or `dpkg --status`) to confirm the fix is present, then document this evidence to close the ticket with proper justification.

Answer

Close the ticket immediately because the patch was installed successfully.

Answer

Raise the severity of the finding because the scanner still reports it.

Answer

Disable the scanner until the next maintenance window to avoid repeated alerts.

Question 14

A Java-based internal portal accepts a serialized object during profile import. After a recent test upload, the server made outbound LDAP calls and created a new local account. What attack pattern best explains this behavior?

Accepted Answer

Insecure deserialization, because a crafted object triggered unexpected server-side actions.. Option C is correct because the scenario describes a Java application accepting a serialized object during profile import, which is a classic vector for insecure deserialization attacks. By crafting a malicious serialized object, an attacker can trigger arbitrary code execution on the server, leading to outbound LDAP calls and local account creation—actions that are not part of normal profile import logic. This attack exploits the trust placed in serialized data without proper validation or integrity checks.

Answer

SQL injection, because the attacker likely altered a database query.

Answer

Cross-site scripting, because the attacker could have injected script into the portal.

Answer

CSRF, because the attacker may have forced an administrator to submit a form.

Question 15

A public-facing web service suddenly becomes very slow. NetFlow shows a high volume of small DNS queries leaving attacker-controlled systems and much larger DNS responses arriving at the victim's IP address from many different resolvers. Which attack is taking place?

Accepted Answer

DNS amplification DDoS. This is a DNS amplification DDoS attack. The attacker sends small DNS queries with a spoofed source IP (the victim's IP) to open DNS resolvers, which then send large DNS responses to the victim. The high volume of small queries and much larger responses from many resolvers is the classic signature of an amplification attack, exploiting the UDP protocol's lack of source verification.

Answer

Replay attack

Answer

ARP poisoning

Answer

Session fixation

Question 16

A scanner reports a critical vulnerability on an internal Linux server. The administrator confirms the vulnerable package is installed, but the affected feature is only enabled when an optional module is loaded, and that module is currently disabled. The server also requires downtime for patching. What is the best next step?

Accepted Answer

Verify whether the vulnerable function is reachable, then apply a compensating control or schedule remediation. Option B is correct because even though the vulnerable module is disabled, the administrator must first verify that the vulnerable function is not reachable through other means (e.g., via a different service or misconfiguration). If it is unreachable, applying a compensating control (like a firewall rule or SELinux policy) can mitigate risk without immediate downtime, allowing patching to be scheduled. This aligns with the principle of defense-in-depth and proper risk management.

Answer

Immediately accept the risk and leave the server unchanged

Answer

Mark the finding as a false positive and close the ticket

Answer

Remove the server from production immediately and rebuild it from scratch

Question 17

A help desk ticket reports that a user's Microsoft 365 mailbox sent hundreds of messages to external contacts, and the user says they are still receiving MFA prompts they did not start. The attacker may still have an active web session. What is the best first containment action?

Accepted Answer

Revoke the account's active sessions and reset the password immediately.. Option B is correct because the user is still receiving unsolicited MFA prompts, indicating an attacker likely has an active web session with a valid token. Revoking all active sessions immediately invalidates any existing tokens or cookies, while resetting the password ensures the attacker cannot re-authenticate. This is the fastest way to cut off the attacker's access and stop further abuse of the mailbox.

Answer

Delete the suspicious sent messages and close the ticket.

Answer

Wait until the end of the workday to avoid interrupting the user.

Answer

Reimage the user's laptop before touching the email account.

Question 18

A security analyst is investigating a series of alerts from the web application firewall. Users are reporting that when they view a product review page on the company's e-commerce site, their browser automatically redirects to a malicious website. The analyst examines the database and finds that a product review submitted by a user contains a <script> tag that loads a JavaScript file from an external domain. Which type of attack has occurred?

Accepted Answer

Stored cross-site scripting (XSS). The attack is stored cross-site scripting (XSS) because the malicious <script> tag was permanently stored in the product review database. When any user views the product review page, the browser loads and executes the external JavaScript file from the attacker's domain, causing an automatic redirect to a malicious website. This matches the classic stored XSS pattern where payload persists in server-side storage and executes in the victim's browser context.

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Answer

Reflected cross-site scripting (XSS)

Question 19

A security analyst notices that a phishing campaign is targeting employees with emails that appear to be from the company's IT support team. The emails contain a link to a website that mimics the corporate password reset portal. Which of the following controls would be MOST effective in preventing users from reaching the malicious website, assuming the link uses HTTPS?

Accepted Answer

Implement a URL filtering policy on the company's web proxy.. A URL filtering policy on the company's web proxy is the most effective control because it can block access to the malicious website based on its domain, category, or reputation, regardless of whether the link uses HTTPS. Since the proxy can perform SSL/TLS inspection (decrypting the HTTPS traffic) or use domain reputation lists, it prevents users from even reaching the phishing site. This directly addresses the core issue of users navigating to a known or suspicious URL.

Answer

Deploy an email security gateway that performs sandboxing of attachments.

Answer

Enable multi-factor authentication on all corporate accounts.

Answer

Conduct a security awareness training session on phishing.

Question 20

A regulated analytics workload is moving to a public cloud. The business wants the strongest practical tenant isolation without managing physical servers, and it also needs an audit trail for changes made to the cloud environment. Which two design choices best meet those requirements? Select two.

Accepted Answer

Place the workload in a dedicated account, project, or subscription with restricted cross-account access.. Option A is correct because placing the workload in a dedicated account, project, or subscription with restricted cross-account access provides strong logical isolation at the cloud provider's control plane. This approach meets the requirement for tenant isolation without managing physical servers, as it leverages the provider's built-in resource boundaries and IAM policies to prevent unauthorized access between tenants.

Answer

Deploy the workload in a shared public subnet to simplify routing between tenants.

Answer

Assume the cloud provider will record every guest operating system event automatically.

Answer

Disable logging to reduce storage costs because the provider already has all necessary records.