SY0-701 Practice Exam 60 — 20 Questions

Question 1

A regulated analytics workload is moving to a public cloud. The business wants the strongest practical tenant isolation without managing physical servers, and it also needs an audit trail for changes made to the cloud environment. Which two design choices best meet those requirements? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the workload in a dedicated account, project, or subscription with restricted cross-account access.. Placing the workload in a dedicated account, project, or subscription with restricted cross-account access provides strong logical isolation at the cloud provider's control plane. This approach meets the requirement for tenant isolation without managing physical servers, as it leverages the provider's built-in resource boundaries and IAM policies to prevent unauthorized access between tenants.

Answer

Deploy the workload in a shared public subnet to simplify routing between tenants.

Answer

Assume the cloud provider will record every guest operating system event automatically.

Answer

Disable logging to reduce storage costs because the provider already has all necessary records.

Question 2

During testing, entering ' OR '1'='1 into a login field returns all user records instead of rejecting the input. What is the best fix to address this flaw?

Accepted Answer

Use parameterized queries or prepared statements for database access. The flaw is a classic SQL injection vulnerability, where unsanitized user input is concatenated directly into a SQL query. Parameterized queries (prepared statements) separate SQL logic from data, ensuring that input like ' OR '1'='1 is treated as a literal string value, not executable code. This is the industry-standard mitigation per OWASP and effectively prevents injection attacks.

Answer

Add client-side JavaScript validation to block quote characters

Answer

Store passwords in a stronger hash format

Answer

Change the login page to HTTPS

Question 3

Based on the exhibit, which security principle is the proposed workflow most directly enforcing?

Accepted Answer

Separation of duties, because no single person can create, approve, and implement the same production change.. The proposed workflow enforces separation of duties by requiring three distinct roles—requester, approver, and implementer—to complete a single firewall change. No single person can both create and approve the change, nor can they implement it without prior approval. This directly prevents any one individual from having end-to-end control over a production change, which is the core of separation of duties.

Answer

Least privilege, because each person gets only the minimum access needed for the task.

Answer

Defense in depth, because multiple layers of security are added around firewall changes.

Answer

Need-to-know, because the ticket is visible only to assigned people.

Question 4

An administrator pushed a firewall rule change to allow a new vendor IP range during business hours. Minutes later, payroll users lost access to an internal service. Which change management practice would have best reduced the impact?

Accepted Answer

Test the change in a staging environment and include a rollback plan in the request.. Testing the change in a staging environment first would have revealed any unintended side effects, such as ACL conflicts that blocked payroll traffic. Including a rollback plan ensures that if the change causes issues in production, the administrator can quickly revert the firewall rule to restore service. This aligns with the change management process of minimizing impact through controlled testing and contingency planning.

Answer

Apply changes directly in production so they take effect as quickly as possible.

Answer

Avoid documenting the change until after the maintenance window ends.

Answer

Use verbal approval from the payroll manager instead of the normal ticket process.

Question 5

Based on the exhibit, what is the best governance improvement?

Data handling procedure:
- Managers may approve external sharing exceptions verbally.
- Staff record exceptions in email threads.
- No retention period is defined for exception evidence.

Audit note: multiple exceptions could not be traced to an approver.

Accepted Answer

Replace verbal and email exceptions with a documented approval workflow and retained exception records.. The current procedure lacks a documented approval workflow and retention policy, which directly caused the audit finding that exceptions could not be traced to an approver. Implementing a formal, auditable process ensures non-repudiation and compliance with data handling governance, addressing the root cause rather than relying on informal verbal or email-based approvals.

Answer

Allow each team to decide its own exception format to increase flexibility.

Answer

Remove exception handling entirely so no external sharing can ever occur.

Answer

Keep the procedure unchanged and rely on additional awareness training alone.

Question 6

A security analyst is investigating a potential data exfiltration incident. Which three of the following indicators are most commonly associated with a data exfiltration attack? (Choose three.)

Accepted Answer

Large volumes of data being transferred to an external IP address. Unusual outbound network traffic, especially during non-business hours, is a classic indicator of data exfiltration because attackers often schedule transfers when monitoring is less active. Large volumes of data being transferred to an external IP address directly suggests that sensitive data is being moved outside the organization. A sudden increase in DNS queries to a known malicious domain can indicate DNS tunneling, where data is encoded in DNS requests to bypass traditional network controls.

Answer

An employee receiving a phishing email with a malicious attachment

Answer

A spike in CPU usage on a database server

Answer

Multiple failed login attempts from a single user account

Question 7

Based on the exhibit, which action is required to keep the backups restorable after the key-encryption key rotation?

Accepted Answer

Rewrap or keep access to the old KEK version until existing DEKs are migrated.. When a key-encryption key (KEK) is rotated, existing data-encryption keys (DEKs) that were wrapped with the old KEK version become unreadable unless the old KEK is retained or the DEKs are re-wrapped with the new KEK. Option B ensures that backups remain restorable by either keeping the old KEK version accessible or migrating DEKs to the new KEK, maintaining the chain of trust for decryption.

Answer

Delete vault-kek-v1 immediately so only the newest key remains active.

Answer

Re-encrypt the entire backup repository with a single shared password.

Answer

Export vault-kek-v2 into the backup files so each object stores the new key directly.

Question 8

A hospital has clinical workstations, badge readers, and building cameras all connected to the same switching infrastructure. After a workstation infection, the security team wants to prevent those endpoints from laterally reaching the badge readers while still allowing the cameras to report to a recording server. What should be implemented first?

Accepted Answer

Create separate VLANs and apply ACLs between device groups based on business need.. Creating separate VLANs segments the network into distinct broadcast domains, preventing workstations from directly reaching badge readers at Layer 2. Applying ACLs between VLANs then enforces granular access control, allowing only the cameras to communicate with the recording server while blocking lateral movement from infected endpoints. This aligns with the principle of least privilege and is the foundational step for network segmentation.

Answer

Increase the DHCP lease time so devices keep the same IP addresses longer.

Answer

Replace the switches with unmanaged models to simplify configuration.

Answer

Disable the cameras' encryption so the recording server can process traffic faster.

Question 9

Sales staff use company laptops on public Wi-Fi and travel frequently. The company wants the disk contents unreadable if a laptop is stolen, even if the drive is removed and placed in another system. Which control is the best fit?

Accepted Answer

Enable full-disk encryption with a hardware-backed key store such as a TPM, preferably with a pre-boot PIN.. Full-disk encryption (FDE) with a hardware-backed key store like a TPM ensures that the entire disk contents are encrypted at rest. Even if the drive is removed and placed in another system, the decryption key remains bound to the original TPM, and a pre-boot PIN adds an additional authentication factor, making the data unreadable without both the TPM and the correct PIN.

Answer

Require a screen lock after five minutes of inactivity.

Answer

Encrypt only the most sensitive folders with file-level encryption.

Answer

Rely on remote wipe because the device will usually connect to the internet again.

Question 10

A packet capture from a branch office shows the default gateway IP mapped to a MAC address that does not belong to the router. The same suspicious MAC also answers for the DNS server IP, and gratuitous ARP replies appear every 30 seconds. Which two attacks best match this evidence? Select two.

Accepted Answer

ARP spoofing or poisoning is occurring on the local network.. The evidence shows the default gateway IP is mapped to a MAC address that does not belong to the router, and the same suspicious MAC also answers for the DNS server IP. This is a classic indicator of ARP spoofing or poisoning, where an attacker sends forged ARP replies to associate their MAC address with the IP addresses of critical network devices, such as the gateway and DNS server. Gratuitous ARP replies every 30 seconds further confirm an active ARP poisoning attack, as the attacker repeatedly broadcasts these unsolicited replies to maintain the poisoned ARP cache entries on victim hosts.

Answer

The network is experiencing a SYN flood against the gateway.

Answer

An external host is performing broad port scanning on public services.

Answer

A password-spraying campaign is targeting remote logins.

Question 11

An HR assistant should be able to view employee records, but should not have access to payroll administration or IT server tools. Which access model is best for assigning permissions by job role?

Accepted Answer

Role-based access control. Role-based access control (RBAC) is the correct model because it assigns permissions based on job functions rather than individual users. In this scenario, the HR assistant role would be granted read/write access to employee records, while being explicitly denied access to payroll administration and IT server tools, ensuring least privilege and separation of duties. RBAC simplifies administration by grouping permissions into roles, which can be easily assigned or revoked as job responsibilities change.

Answer

Shared local administrator accounts

Answer

Open access for all employees

Answer

Biometric authentication

Question 12

A help desk analyst receives a phone call from someone claiming to be the CFO, who says their phone was lost while traveling and requests an immediate MFA reset and temporary bypass for payroll access. The caller knows the CFO's last name and the company name, but cannot answer the callback verification question. What attack technique is most likely being used?

Accepted Answer

Vishing. The caller is using voice communication to impersonate a high-level executive (CFO) and manipulate the help desk analyst into bypassing security controls, which is the defining characteristic of vishing (voice phishing). The request for an MFA reset and temporary bypass is a social engineering tactic to exploit the analyst's authority bias and urgency, and the inability to pass callback verification confirms the caller is not legitimate.

Answer

Phishing

Answer

Baiting

Answer

Watering hole attack

Question 13

A security manager wants evidence that annual security awareness training was completed by employees. Which artifact is the best proof?

Accepted Answer

A training completion report exported from the learning system. A training completion report exported from the learning system is the best proof because it provides a verifiable, timestamped record of each employee's completion status, including user IDs, course names, completion dates, and scores. This artifact directly demonstrates that the training was actually completed, not just assigned or attended, and can be audited against the organization's training policy.

Answer

A copy of the company logo used on the training slides

Answer

A list of office supplies purchased last quarter

Answer

A screenshot of the company's public homepage

Question 14

In the finance workflow, one employee can create a payment batch but cannot approve it, and the same person also cannot view employee records that are unrelated to the task. Which two principles are being enforced? Select two.

Accepted Answer

Separation of duties, because creation and approval are split between different roles.. Separation of duties is enforced by splitting the payment creation and approval functions between different roles, preventing a single employee from committing fraud by creating and approving a payment without oversight. This principle reduces the risk of unauthorized or malicious actions by requiring collusion for abuse.

Answer

Least privilege, because every user should have no more than one permission overall.

Answer

Defense in depth, because multiple security technologies are layered around the finance system.

Answer

Zero trust, because the employee must always be treated as untrusted by the network.

Question 15

A security analyst is reviewing the results of a dynamic application security test (DAST) on a new e-commerce application. The report indicates that the application's product search functionality is vulnerable to blind SQL injection. The analyst is tasked with recommending a remediation to the development team. The developers currently concatenate user input directly into SQL queries. Which of the following recommendations would most effectively and permanently mitigate this vulnerability?

Accepted Answer

Replace dynamic SQL queries with parameterized prepared statements.. Parameterized prepared statements separate SQL logic from user input, ensuring that input is always treated as data, not executable code. This permanently prevents SQL injection by design, regardless of the input content, unlike input filtering or WAF rules which can be bypassed.

Answer

Implement a web application firewall (WAF) rule to block suspicious SQL keywords in search parameters.

Answer

Sanitize user input by escaping single quotes and other special characters before concatenation.

Answer

Encode all user input using HTML entity encoding before database operations.

Question 16

A regulated analytics workload must run in a public cloud with the strongest practical tenant isolation while avoiding management of physical servers. The workload should also remain off the public internet. Which two deployment choices best fit? Select two.

Accepted Answer

Run the workload on a dedicated host or dedicated instance.. A dedicated host or dedicated instance provides the strongest practical tenant isolation in a public cloud by ensuring that the underlying physical server is not shared with any other customer. This meets the regulatory requirement for strong isolation while avoiding the need to manage physical servers, as the cloud provider still handles hardware maintenance. The dedicated instance model (e.g., AWS Dedicated Instances) offers hardware-level isolation at the instance level, while a dedicated host gives you visibility and control over the physical server, both without requiring you to manage the server itself.

Answer

Use shared tenancy with security groups only.

Answer

Assign an elastic IP so administrators can reach the workload directly from anywhere.

Answer

Expose the workload through a public load balancer to simplify connectivity.

Question 17

A user reports that a shared department drive is rapidly renaming files and creating ransom notes on a Windows file server. The SOC confirms suspicious activity is still occurring on that server. What should the incident responder do first?

Accepted Answer

Isolate the server from the network while keeping it powered on if possible.. The immediate priority is to contain the ransomware outbreak by isolating the server from the network, which stops the malicious activity from spreading to other systems while preserving volatile evidence (e.g., running processes, memory contents) for forensic analysis. Powering off the server (Option A) would destroy this critical evidence and may not stop the encryption process if it is already in memory. Isolation via network disconnection (e.g., disabling the NIC or unplugging the cable) is the standard first step in incident response for active ransomware.

Answer

Shut down the server immediately to stop all malicious activity.

Answer

Restore the drive from backup before collecting any evidence.

Answer

Inform users to continue working until the forensic team arrives.

Question 18

Before applying a major patch to a virtual machine, the administrator wants a quick way to return the VM to its exact pre-change state if the patch fails. What should the administrator create?

Accepted Answer

A snapshot of the virtual machine. A snapshot captures the exact state of the virtual machine (disk, memory, and power state) at a point in time, allowing the administrator to revert instantly if the patch fails. This is the fastest and most storage-efficient method for a quick rollback compared to a full backup, which is slower and more resource-intensive.

Answer

A full backup to removable media

Answer

A separate VLAN for the virtual machine

Answer

A digital certificate for the patch server

Question 19

A company can patch only one of two internet-facing systems this week. System 1 has a critical vulnerability but is reachable only through the corporate VPN during maintenance windows. System 2 has a medium vulnerability and supports the public payment site, which shows active attack traffic every day. Which system should be prioritized first?

Accepted Answer

System 2, because it is exposed to the public and directly supports a business-critical service. System 2 should be prioritized because it is directly exposed to the public internet and supports a business-critical payment service that is under active attack daily. Even though System 1 has a critical vulnerability, it is only reachable through the corporate VPN during maintenance windows, which significantly reduces its attack surface and exploitability. In risk management, the likelihood of exploitation and business impact often outweigh the CVSS base score alone, making System 2 the higher priority.

Answer

System 1, because the vulnerability is rated critical

Answer

Neither system, because both are internet-facing and must wait for the next maintenance cycle

Answer

System 1, because VPN access always makes a vulnerability more dangerous than a public application issue

Question 20

A SOC analyst confirms that a workstation is encrypting local files and attempting SMB connections to nearby hosts. The user is still logged in, and the business wants to limit spread without destroying evidence. What is the best immediate action?

Accepted Answer

Quarantine the workstation from the network using EDR or switch port containment. Quarantining the workstation via EDR or switch port containment immediately stops the SMB-based lateral movement and further encryption of network shares, while preserving the volatile evidence (memory, running processes, encryption keys) for forensic analysis. This aligns with the business requirement to limit spread without destroying evidence, as powering off or reimaging would lose critical forensic data.

Answer

Power the workstation off immediately and leave it in place

Answer

Run a full antivirus scan while the workstation remains connected

Answer

Wipe and reimage the workstation from a standard build image