SY0-701 Practice Exam 61 — 20 Questions

Question 1

Employees sign in once to the company portal and then can access email, the ticketing system, and the HR site without logging in again. What is this called?

Accepted Answer

Single sign-on. Single sign-on (SSO) allows a user to authenticate once and gain access to multiple applications or systems without re-entering credentials. In this scenario, the company portal acts as the identity provider (IdP), and after initial authentication, it issues a token (e.g., SAML assertion or Kerberos ticket) that is accepted by the email, ticketing, and HR systems as proof of identity. This eliminates the need for repeated logins across these services.

Answer

Port forwarding

Answer

Tokenization

Answer

Network address translation

Question 2

A workstation suddenly begins making SMB connections to many internal servers within a few minutes. What is the best immediate response?

Accepted Answer

Isolate the workstation from the network for containment.. The workstation's sudden SMB connections to many internal servers strongly indicate compromise, such as ransomware or worm propagation. Isolating the workstation immediately contains the threat, preventing lateral movement and further damage while preserving forensic evidence.

Answer

Allow the traffic because SMB is a normal file-sharing protocol.

Answer

Delete the local event logs to reduce alert noise.

Answer

Disable all SMB services on every server immediately.

Question 3

A company is implementing controls to protect against insider threats. Which three of the following controls are most effective for detecting and preventing data exfiltration by a malicious insider? (Choose three.)

Accepted Answer

Enforcing strict role-based access controls (RBAC) with the principle of least privilege. Data Loss Prevention (DLP) solutions are effective because they can inspect content in real time, blocking sensitive data from being sent via email, copied to USB, or uploaded to cloud services. User Behavior Analytics (UBA) detects anomalies such as a user downloading thousands of records at 3 AM, which is a strong indicator of malicious intent. Role-Based Access Control (RBAC) with least privilege limits the data a user can access, reducing the attack surface and making exfiltration harder even if credentials are compromised.

Answer

Conducting annual security awareness training for all staff

Answer

Requiring all employees to use complex passwords changed every 30 days

Answer

Installing antivirus software on all endpoints

Question 4

A DevOps team stores container images in a registry before deployment. Which two practices reduce the chance of deploying a risky image? Select two.

Accepted Answer

Scan images for known vulnerabilities before they are promoted to production.. Scanning container images for known vulnerabilities (e.g., using tools like Trivy or Clair) identifies CVEs in the OS packages or application dependencies before the image reaches production. This proactive check prevents deploying images with exploitable flaws, aligning with secure software supply chain practices. Option B is correct because using trusted minimal base images (e.g., Alpine or distroless) reduces the attack surface, and removing unnecessary packages eliminates potential vulnerabilities from unused components, following the principle of least functionality.

Answer

Run containers as root by default to simplify troubleshooting.

Answer

Mount the host operating system filesystem into every container.

Answer

Deploy images using the latest tag without reviewing version history.

Question 5

Based on the exhibit, what should the administrator do next?

Accepted Answer

Re-download the update from the trusted source and verify the hash again.. If the hash of a downloaded file does not match the vendor-published hash, the file is likely corrupted or tampered with. The administrator should delete the corrupted file, re-download it from the trusted source, and recompute the hash to ensure integrity before installation. This follows the principle of verifying file integrity via cryptographic hashing (e.g., SHA-256) before applying updates.

Answer

Install the update because a longer hash means the file is newer.

Answer

Rename the file to match the vendor’s naming convention and retry installation.

Answer

Disable SHA-256 verification because patch files often change after download.

Question 6

A firewall rule was changed in production to allow a new vendor IP range, and payroll users immediately lost access to an internal service. Which two change-management practices would have reduced the risk of this outage? Select two.

Accepted Answer

Test the rule in a staging environment with representative traffic before production deployment.. Testing the firewall rule in a staging environment with representative traffic allows you to validate that the new vendor IP range does not inadvertently block or conflict with existing rules before impacting production. This practice catches misconfigurations—such as an overly broad permit that shadows a deny rule for payroll users—without risking service disruption. Staging mirrors production ACL logic, so you can verify that the rule order and match criteria (e.g., source IP, destination port) behave as intended.

Answer

Make the change during the busiest business hour so the team can observe the effect immediately.

Answer

Remove logging on the firewall so only the new rule is visible during troubleshooting.

Answer

Skip approval because the vendor was already known to the organization.

Question 7

Users can reach the correct website name, but their browsers are redirected to a fake server after the local DNS cache is altered. What attack is most likely?

Accepted Answer

DNS poisoning. DNS poisoning (also known as DNS cache poisoning) occurs when an attacker inserts forged DNS resource records into the local DNS cache, causing subsequent queries for a legitimate domain to resolve to an attacker-controlled IP address. In this scenario, users type the correct website name, but because the local DNS cache has been altered, their browsers are redirected to a fake server. This directly matches the description of DNS poisoning.

Answer

Denial of service

Answer

Replay attack

Answer

Port scanning

Question 8

A development team deploys a Linux web server on an IaaS cloud VM. The cloud provider secures the datacenter, hardware, and hypervisor. Which control remains the organization's responsibility?

Accepted Answer

Apply OS patches and harden services running inside the virtual machine.. Under the IaaS shared responsibility model, the cloud provider owns security 'of' the cloud (datacenter, hardware, hypervisor, network backbone), while the customer owns security 'in' the cloud. Since the VM is IaaS, the guest OS, its patches, and the services running inside it are entirely the customer's responsibility. Applying OS patches and hardening services is a canonical customer-side IaaS task.

Answer

Monitor physical badge access at the provider facility.

Answer

Replace the provider's network backbone with a private carrier circuit.

Answer

Ensure the hypervisor is updated before every release cycle.

Question 9

Field technicians use company-owned tablets that also run approved personal apps. Security needs corporate email and documents isolated from personal data, selective wipe of only business content if a device is lost, and compliance checks before access is allowed. What should be deployed?

Accepted Answer

Mobile device management with a work profile or container and conditional access.. Mobile device management (MDM) with a work profile or container (e.g., Android Work Profile or iOS Managed Open In) provides the required isolation between corporate and personal data. Conditional access enforces compliance checks (e.g., device health attestation, OS patch level) before granting access to corporate resources. This combination also enables selective wipe of only the work container without affecting personal apps or data, meeting the lost-device requirement.

Answer

Full-disk encryption on the tablets with no additional device management.

Answer

A mobile VPN client with split tunneling enabled for user convenience.

Answer

An antivirus app with a blacklist of approved and unapproved mobile apps.

Question 10

A manager wants files on a stolen laptop to remain unreadable even if the drive is removed and connected to another computer. Which control should be implemented?

Accepted Answer

Full-disk encryption. Full-disk encryption (FDE) encrypts the entire storage volume, including the operating system, applications, and all user data. When the drive is removed and connected to another computer, the encrypted data remains inaccessible without the correct decryption key or passphrase, ensuring files stay unreadable. This directly addresses the manager's requirement for data confidentiality even after physical theft.

Answer

File compression

Answer

Packet filtering

Answer

Digital signing

Question 11

A development manager wants to copy a production customer database into a test environment so testers can reproduce a bug. The database contains names, addresses, and payment tokens. What is the best security practice before the copy is made?

Accepted Answer

Mask, tokenize, or replace sensitive fields with approved test data before moving it.. Copying production data containing sensitive information (names, addresses, payment tokens) into a test environment without sanitization violates data minimization and privacy principles (e.g., GDPR, PCI DSS). The best practice is to apply data masking, tokenization, or substitution with realistic but non-sensitive test data before the copy, ensuring that the test environment does not expose real customer data. This prevents accidental data leakage and reduces compliance risk while still allowing testers to reproduce the bug with functionally equivalent data.

Answer

Copy the production database unchanged and limit access to the QA team.

Answer

Compress the database export to reduce storage and transfer time.

Answer

Encrypt the database backup and give developers the decryption key.

Question 12

A team is deploying a containerized API to a public cloud. The service must be reachable only by internal corporate applications, and secrets must not be embedded in images or readable as plaintext by administrators of the underlying host. Which two actions best fit the design? Select two.

Accepted Answer

Place the API in a private subnet and expose it only through an internal load balancer or private endpoint.. Placing the API in a private subnet and exposing it only through an internal load balancer or private endpoint ensures that the service is reachable only by internal corporate applications, as traffic never traverses the public internet. This design leverages network segmentation and private IP addressing to enforce access control at the network layer, aligning with the requirement for internal-only reachability.

Answer

Give each container a public IP and restrict access by source IP allowlist.

Answer

Bake database passwords into the container image so deployment is simpler.

Answer

Assume the cloud provider's tenant isolation alone is enough to protect secrets from misuse.

Question 13

An endpoint investigation shows winword.exe launching powershell.exe with -nop -w hidden -enc arguments. The same host also has a newly created WMI permanent event subscription, and no new executable has appeared in Downloads or Program Files. Which two findings are most consistent with a fileless compromise and persistence mechanism? Select two.

Accepted Answer

PowerShell was launched with encoded, hidden execution arguments from a document process.. The use of winword.exe to launch powershell.exe with `-nop -w hidden -enc` arguments is a classic fileless execution technique. The encoded command runs entirely in memory without writing a payload to disk, and the launch from a document process (winword.exe) indicates a macro or exploit-based initial access, consistent with a fileless compromise.

Answer

A new executable named updater.exe was copied into Program Files by an administrator.

Answer

The browser cache was cleared after a routine user sign-out.

Answer

A signed video driver updated successfully through Windows Update.

Question 14

A security manager at a hospital is reviewing the annual vendor risk assessment for a cloud-based electronic health record (EHR) provider. The provider's SOC 2 Type II report, issued six months ago, identifies a significant deficiency in logical access controls: the provider failed to revoke access for former employees in a timely manner. The provider's management has asserted that this deficiency has been fully remediated, but the next SOC 2 audit is not scheduled for another eight months. The hospital's data protection policy requires that any vendor handling protected health information (PHI) must have a current SOC 2 Type II report with no unresolved significant deficiencies. Which of the following is the most appropriate next step for the security manager?

Accepted Answer

Require the vendor to provide a bridge letter from their external auditor confirming that the remediation has been implemented and is operating effectively.. The hospital's policy requires a current SOC 2 Type II report with no unresolved significant deficiencies. Since the deficiency was reported but is claimed to be fixed, a bridge letter from the external auditor provides independent assurance that the remediation is effective and operating as intended, bridging the gap until the next formal audit. This is the most appropriate step because it maintains compliance without prematurely terminating a critical vendor relationship.

Answer

Accept the vendor's assertion that the deficiency has been remediated and continue the relationship as is.

Answer

Immediately terminate the contract with the EHR provider and begin the process of selecting a new vendor.

Answer

Increase the frequency of manual access reviews performed by the hospital's internal IT staff on the vendor's systems.

Question 15

A help desk agent receives a phone call from someone claiming to be a regional sales manager who says they are locked out before a customer demo. The caller knows a few employee names and asks the agent to reset the account and temporarily bypass MFA. What attack is most likely?

Accepted Answer

Vishing, because the attacker is using a voice call to pressure support staff into changing access.. Vishing (voice phishing) specifically involves using a phone call to socially engineer a target into performing an action, such as resetting credentials and bypassing MFA. The attacker pressures the help desk agent by creating urgency around a customer demo, which is a classic vishing tactic to bypass security controls.

Answer

Spear phishing, because the caller used specific employee details to appear credible.

Answer

Pretexting, because the attacker is creating a false identity and believable story.

Answer

Baiting, because the attacker offered a tempting opportunity tied to a customer demo.

Question 16

Based on the exhibit, what is the most likely issue with the software component being built?

Accepted Answer

Supply-chain compromise, because the dependency may have been altered before it reached the build pipeline.. The exhibit shows a build pipeline that fetches a dependency from a public repository. If the dependency has been tampered with before it reaches the pipeline, this is a classic supply-chain compromise. Attackers often inject malicious code into popular open-source packages, which then gets incorporated into the build, compromising the final software component.

Answer

Cross-site scripting, because the package name suggests the application handles web content.

Answer

Credential stuffing, because automated systems frequently reuse credentials during updates.

Answer

Replay attack, because the nightly pipeline used an old copy of the package request.

Question 17

A company moves a Linux server to infrastructure as a service (IaaS). Which task remains the customer's responsibility?

Accepted Answer

Patching the guest operating system and installed applications.. In an IaaS model, the cloud provider manages the physical infrastructure, hypervisor, and network backbone, while the customer retains responsibility for securing and maintaining the guest operating system and any installed applications. This includes applying security patches, updating software, and configuring the OS-level firewall. For a Linux server, the customer must run commands like `apt update && apt upgrade` or `yum update` to patch the OS and manage application dependencies.

Answer

Replacing failed power supplies in the data center.

Answer

Maintaining the hypervisor on the host system.

Answer

Building and securing the provider's network backbone.

Question 18

Based on the exhibit, what is the primary security concern with the current access assignments, and what concept is being violated?

Accepted Answer

The configuration violates separation of duties by letting one person prepare and approve the same payroll activity.. The exhibit shows a single user account with permissions to both prepare and approve payroll transactions. This violates the security principle of separation of duties, which requires that no single individual has control over all phases of a critical process. The primary concern is that this configuration enables fraud or error without independent oversight, as the same person could create and authorize a fraudulent payroll entry.

Answer

The system is missing multifactor authentication for payroll users.

Answer

The account should be converted to a shared group account for the finance team.

Answer

The permissions are acceptable because payroll users always need full access to related finance functions.

Question 19

A security analyst detects an encrypted outbound connection from a web server to an unknown IP address. The connection is persistent and occurs every 5 minutes. What is the MOST appropriate first step for the analyst to take?

Accepted Answer

Review the server's process list and logs to identify the source.. The first step in investigating an unknown encrypted outbound connection is to identify the process or service responsible for initiating it. Reviewing the server's process list and logs allows the analyst to determine whether the connection is legitimate (e.g., a scheduled update or backup) or malicious (e.g., a beacon from implanted malware). Without this visibility, actions like blocking or disconnecting could disrupt legitimate services or alert an attacker prematurely.

Answer

Disconnect the server from the network immediately.

Answer

Block the IP address at the perimeter firewall.

Answer

Escalate the incident to the incident response team.

Question 20

A SIEM alert shows five failed logins to a SaaS admin portal from one IP, followed by a successful login from a new city three minutes later. Which two actions are the best next steps for the analyst to validate the event before containment? Select two.

Accepted Answer

Review the identity provider and MFA logs to confirm the successful login came from the same account and device context.. Reviewing the identity provider (IdP) and MFA logs allows the analyst to verify whether the successful login originated from the same user account and device context as the failed attempts. This step is critical to determine if the successful login was an attacker who bypassed MFA or a legitimate user who eventually succeeded, providing evidence of account compromise or a false positive.

Answer

Immediately disable the SaaS platform for every user until the investigation is finished.

Answer

Reimage the user’s laptop immediately to remove any possible malware.

Answer

Delete the failed login records to reduce noise in the SIEM.